@agenticprimitives/create-app 0.0.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,29 @@
+# @agenticprimitives/create-app
+
+```
+npx @agenticprimitives/create-app my-product --template product-repo --pin 1.0.0-alpha.24
+cd my-product && pnpm install && npx ap doctor
+```
+
+Writes a product repository the way spec 399 §3.6 describes it — the shape `ap-discovery`, `ap-home` and
+`ap-naming` are created from, never a copy of the monorepo root:
+
+| Written | Purpose |
+| --- | --- |
+| `package.json`, `pnpm-workspace.yaml`, `.npmrc`, `tsconfig.base.json` | pnpm workspace over `apps/*` + `examples/*`; strict peers; exact `@agenticprimitives/*` pins |
+| `agentic.lock.json` | the coherent pin set, the rules-source digests, the doctor config, the template revision |
+| `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/*.mdc` | projected from the pinned rules source (edit the source, run `ap doctor --rules --write`) |
+| `.github/workflows/ci.yml` | typecheck · test · `ap doctor` · `ap doctor --rules` |
+| `.github/workflows/live-gates-nightly.yml` | `ap test --live-gates live-gates.json` + `ap conform a2a\|mcp` against the shadow deployment |
+| `live-gates.json` | the gates ledger (spec 392 shape), empty until the first verify script moves in |
+| `wrangler.example.toml` | the env layout: `env-a` / `env-b` live (Ring 0 deploys until the cut), `env-a-split` shadow (this repo) |
+| `scripts/set-cloudflare-secrets.sh` | per-env secrets from a gitignored `.secrets.<env>` file, never echoed |
+| `DEPLOYER.md`, `docs/MOVED.md` | deployer of record per app + env; the text the cut PR leaves in Ring 0 |
+
+Options: `--name <kebab>` (defaults to the directory name), `--pin <exact version>` (defaults to the generating
+devkit's version; resolve a dist-tag afterwards with `ap upgrade --pin <tag>`), `--json`.
+
+Exit codes: `0` written · `2` usage (non-empty dir, bad name, bad pin, unknown template) · `3` error.
+
+The template carries no hostname, no vertical vocabulary and no key (ADR-0021): every deployment-specific value
+is a `<placeholder>` the product fills in.

package/bin/create-app.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// create-app — the Developer Kit generator (spec 398 §10.3, spec 399 §3.6).
+//
+//   npx @agenticprimitives/create-app <dir> --template product-repo [--name <kebab>] [--pin <exact-version>] [--json]
+//
+// Writes a product repository from the template, pins one coherent @agenticprimitives/* set, projects the rules
+// files, and leaves `pnpm install` + `ap doctor` to you (printed at the end). Exit 0 written · 2 usage · 3 error.
+import { resolve } from 'node:path';
+import { createApp, TEMPLATE_NAMES } from '../dist/index.js';
+
+const argv = process.argv.slice(2);
+const flag = (n) => argv.includes(`--${n}`);
+const opt = (n) => { const i = argv.indexOf(`--${n}`); return i >= 0 && !String(argv[i + 1] ?? '--').startsWith('--') ? argv[i + 1] : undefined; };
+const dir = argv.find((a, i) => !a.startsWith('--') && !(i > 0 && argv[i - 1].startsWith('--') && opt(argv[i - 1].slice(2)) === a));
+const json = flag('json');
+if (!dir || flag('help')) {
+  const usage = `create-app <dir> --template ${TEMPLATE_NAMES.join('|')} [--name <kebab>] [--pin <exact-version>] [--json]`;
+  if (json) console.log(JSON.stringify({ ok: !!dir, usage })); else console.log(usage);
+  process.exit(dir ? 0 : 2);
+}
+try {
+  const result = await createApp({ dir: resolve(dir), template: opt('template') ?? 'product-repo', name: opt('name'), pin: opt('pin') });
+  if (json) console.log(JSON.stringify({ ok: true, result }, null, 2));
+  else console.log(`create-app · ${result.template} → ${result.dir} (${result.name}, pinned ${result.pin})\n${result.files.map((f) => `  ${f}`).join('\n')}\n\nnext: cd ${result.dir} && pnpm install && npx ap doctor`);
+} catch (e) {
+  const code = e?.code ?? 'E_UNEXPECTED';
+  if (json) console.log(JSON.stringify({ ok: false, error: { code, message: e.message } })); else console.error(`✗ ${code}: ${e.message}`);
+  process.exit(code === 'E_USAGE' ? 2 : 3);
+}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+import { type DoctorConfigOverrides } from '@agenticprimitives/devkit';
+export declare const PACKAGE_NAME: "@agenticprimitives/create-app";
+export declare const PACKAGE_STATUS: "w0-product-repo-template";
+export declare const SPEC_REF: "specs/399-repository-split-program.md";
+export declare const TEMPLATES_DIR: string;
+export declare const TEMPLATE_NAMES: readonly ["product-repo"];
+export type TemplateName = (typeof TEMPLATE_NAMES)[number];
+/** Bump when the template tree changes shape; recorded in the generated lock so `ap upgrade` can diff it later. */
+export declare const TEMPLATE_REVISION = "2026-09-11.1";
+/** The packages every product pins from the start (the kit, the live-gates runner, the two conformance suites). */
+export declare const BASELINE_PINS: readonly ["@agenticprimitives/devkit", "@agenticprimitives/evaluation", "@agenticprimitives/a2a", "@agenticprimitives/mcp-protocol"];
+export interface CreateAppOptions {
+    /** Absolute target directory; created if absent, must be empty or absent. */
+    dir: string;
+    template?: TemplateName;
+    /** Product / repository name (`ap-discovery`). Defaults to the directory's base name. */
+    name?: string;
+    /** Exact version every baseline @agenticprimitives/* pin gets. Defaults to the generating devkit's version. */
+    pin?: string;
+    devkitVersion?: string;
+    /** Extra substitutions `{{key}}` → value. */
+    vars?: Record<string, string>;
+}
+export interface CreateAppResult {
+    dir: string;
+    template: TemplateName;
+    name: string;
+    pin: string;
+    files: string[];
+}
+/** The doctor config a fresh product carries: no monorepo layout, exact pins required, rules from the bundled corpus. */
+export declare function productDoctorConfig(name: string): DoctorConfigOverrides;
+export declare function createApp(opts: CreateAppOptions): Promise<CreateAppResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAA4G,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEjL,eAAO,MAAM,YAAY,EAAG,+BAAwC,CAAC;AACrE,eAAO,MAAM,cAAc,EAAG,0BAAmC,CAAC;AAClE,eAAO,MAAM,QAAQ,EAAG,uCAAgD,CAAC;AAEzE,eAAO,MAAM,aAAa,QAAmE,CAAC;AAC9F,eAAO,MAAM,cAAc,2BAA4B,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,mHAAmH;AACnH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,mHAAmH;AACnH,eAAO,MAAM,aAAa,sIAAuI,CAAC;AAElK,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+GAA+G;IAC/G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE;AAEpH,yHAAyH;AACzH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAevE;AAkBD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuChF"}

package/dist/index.js

@@ -0,0 +1,109 @@
+// @agenticprimitives/create-app — the generator (spec 398 §10.3 `npx @agenticprimitives/create-app@<release>`,
+// spec 399 §3.6 the product-repo template). One template today: `product-repo`, the shape every product repository
+// starts from — W1 creates ap-discovery from it, never from a copy of the monorepo root. Generation is pure over
+// the template tree plus a substitution map; the rules files are projected by the devkit so a product carries the
+// doctrine by digest from day one (ADR-0063 §8).
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DevkitError, ERROR_CODES, loadRulesCorpus, projectRules, rulesLockEntries, writeLock } from '@agenticprimitives/devkit';
+export const PACKAGE_NAME = '@agenticprimitives/create-app';
+export const PACKAGE_STATUS = 'w0-product-repo-template';
+export const SPEC_REF = 'specs/399-repository-split-program.md';
+export const TEMPLATES_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'templates');
+export const TEMPLATE_NAMES = ['product-repo'];
+/** Bump when the template tree changes shape; recorded in the generated lock so `ap upgrade` can diff it later. */
+export const TEMPLATE_REVISION = '2026-09-11.1';
+/** The packages every product pins from the start (the kit, the live-gates runner, the two conformance suites). */
+export const BASELINE_PINS = ['@agenticprimitives/devkit', '@agenticprimitives/evaluation', '@agenticprimitives/a2a', '@agenticprimitives/mcp-protocol'];
+/** The doctor config a fresh product carries: no monorepo layout, exact pins required, rules from the bundled corpus. */
+export function productDoctorConfig(name) {
+    return {
+        webNoDirectMcp: { browserApps: [], allowMarkers: ['@external-mcp-client-demo'] },
+        noPrivateKeys: { roots: ['apps', 'examples'], allowedIn: [], toleratedEnvNames: [] },
+        noHmacHomeBridge: { dir: 'apps', hmacCall: 'bridgeInteractions', sessionRpcCall: 'callInteractions', ceilings: { hmac: 0, total: 0 } },
+        noCrossSubjectVaultReads: { roots: [], exemptFiles: ['self-only.ts'], gate: 'subjectOfRead' },
+        failOpenKnobs: { roots: ['apps', 'examples'], allowlist: [] },
+        internalMarkerSplit: { src: 'apps', secret: 'A2A_CUSTODY_BRIDGE_SECRET', marker: 'x-ap-internal', budget: {} },
+        custodianCoverage: { skip: `${name} carries no Home custody surface yet — enable when a Home moves in (specs 294/295)` },
+        archetypeCatalog: { skip: `${name} carries no archetype catalog yet — enable when a Home moves in (spec 354 §3)` },
+        capabilityVocabulary: { homeGlobs: ['apps/**/*.{ts,tsx}'], packagesGlob: 'packages/*/src/**/*.ts', wireAllowed: [] },
+        demoPersonOrgDistinct: { skip: `${name} carries no persona roster yet — enable when @agenticprimitives-demo/estate is consumed (spec 399 §2.6)` },
+        rulesDrift: { cursorRules: '.cursor/rules', lock: 'agentic.lock.json', agentsMd: 'AGENTS.md', claudeMd: 'CLAUDE.md' },
+        lockCoherent: { allowWorkspace: false, scope: '@agenticprimitives/' },
+    };
+}
+function substitute(text, vars) {
+    return text.replace(/\{\{([a-zA-Z0-9_.-]+)\}\}/g, (m, k) => (vars[k] !== undefined ? vars[k] : m));
+}
+function walk(dir) {
+    const out = [];
+    for (const e of readdirSync(dir).sort()) {
+        const p = join(dir, e);
+        if (statSync(p).isDirectory())
+            out.push(...walk(p));
+        else
+            out.push(p);
+    }
+    return out;
+}
+const TEXT = /\.(md|json|yaml|yml|toml|ts|tsx|mjs|js|sh|txt|gitignore|tmpl)$|^(\.gitignore|\.npmrc)$/;
+export async function createApp(opts) {
+    const template = opts.template ?? 'product-repo';
+    if (!TEMPLATE_NAMES.includes(template))
+        throw new DevkitError(ERROR_CODES.E_USAGE, `unknown template "${template}" (known: ${TEMPLATE_NAMES.join(', ')})`);
+    const src = join(TEMPLATES_DIR, template);
+    if (!existsSync(src))
+        throw new DevkitError(ERROR_CODES.E_INPUT_MISSING, `template tree missing: ${src}`);
+    if (existsSync(opts.dir) && readdirSync(opts.dir).length > 0)
+        throw new DevkitError(ERROR_CODES.E_USAGE, `${opts.dir} is not empty — create-app writes only into an empty or absent directory`);
+    const name = opts.name ?? opts.dir.split(sep).filter(Boolean).pop() ?? 'product';
+    if (!/^[a-z][a-z0-9-]*$/.test(name))
+        throw new DevkitError(ERROR_CODES.E_USAGE, `name "${name}" must be kebab-case (a-z, 0-9, -)`);
+    const devkitVersion = opts.devkitVersion ?? readOwnDevkitVersion();
+    const pin = opts.pin ?? devkitVersion;
+    if (!/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(pin))
+        throw new DevkitError(ERROR_CODES.E_USAGE, `--pin "${pin}" must be an exact version (use \`ap upgrade --pin <tag>\` after generation to resolve a dist-tag)`);
+    const vars = { name, pin, devkitVersion, templateRevision: TEMPLATE_REVISION, ...(opts.vars ?? {}) };
+    mkdirSync(opts.dir, { recursive: true });
+    const files = [];
+    for (const abs of walk(src)) {
+        const relPath = relative(src, abs).split(sep).join('/');
+        const target = relPath.endsWith('.tmpl') ? relPath.slice(0, -5) : relPath;
+        const out = join(opts.dir, target);
+        mkdirSync(dirname(out), { recursive: true });
+        const base = target.split('/').pop() ?? '';
+        if (TEXT.test(base) || TEXT.test(relPath))
+            writeFileSync(out, substitute(readFileSync(abs, 'utf8'), vars));
+        else
+            cpSync(abs, out);
+        files.push(target);
+    }
+    // The lock: the coherent baseline set, the doctor config, the template revision; rules digests from the projection.
+    const corpus = loadRulesCorpus({ root: opts.dir });
+    const lock = {
+        lockVersion: 1,
+        packages: Object.fromEntries(BASELINE_PINS.map((p) => [p, pin])),
+        rules: rulesLockEntries(corpus),
+        devkit: devkitVersion,
+        template: { name: template, revision: TEMPLATE_REVISION },
+        doctor: productDoctorConfig(name),
+    };
+    writeLock(opts.dir, lock);
+    files.push('agentic.lock.json');
+    const projected = projectRules({ root: opts.dir, corpus, write: true, all: true, createCursorDir: true });
+    for (const p of projected)
+        if (p.status === 'written')
+            files.push(p.path);
+    return { dir: opts.dir, template, name, pin, files: [...new Set(files)].sort() };
+}
+function readOwnDevkitVersion() {
+    try {
+        const p = join(dirname(fileURLToPath(import.meta.url)), '..', 'node_modules', '@agenticprimitives', 'devkit', 'package.json');
+        return JSON.parse(readFileSync(p, 'utf8')).version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,mHAAmH;AACnH,iHAAiH;AACjH,kHAAkH;AAClH,iDAAiD;AACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAkD,MAAM,2BAA2B,CAAC;AAEjL,MAAM,CAAC,MAAM,YAAY,GAAG,+BAAwC,CAAC;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,0BAAmC,CAAC;AAClE,MAAM,CAAC,MAAM,QAAQ,GAAG,uCAAgD,CAAC;AAEzE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAc,CAAU,CAAC;AAExD,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,mHAAmH;AACnH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,2BAA2B,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,iCAAiC,CAAU,CAAC;AAiBlK,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO;QACL,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAChF,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACpF,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtI,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE;QAC7F,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7D,mBAAmB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;QAC9G,iBAAiB,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,oFAAoF,EAAE;QACxH,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,+EAA+E,EAAE;QAClH,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,wBAAwB,EAAE,WAAW,EAAE,EAAE,EAAE;QACpH,qBAAqB,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,yGAAyG,EAAE;QACjJ,UAAU,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;QACrH,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAA4B;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC/C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG,wFAAwF,CAAC;AAEtG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,qBAAqB,QAAQ,aAAa,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3J,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,eAAe,EAAE,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC1G,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,0EAA0E,CAAC,CAAC;IAChM,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC;IACjF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,oCAAoC,CAAC,CAAC;IACnI,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,oGAAoG,CAAC,CAAC;IAClN,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7H,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;;YACtG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,oHAAoH;IACpH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAkB;QAC1B,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE;QACzD,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC;KAClC,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1G,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC9H,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC,OAAO,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@agenticprimitives/create-app",
+  "version": "0.0.0-alpha.1",
+  "description": "The Developer Kit generator (spec 398 §10.3, spec 399 §3.6): `create-app <dir> --template product-repo` writes a product repository — pnpm workspace, exact @agenticprimitives/* pins, agentic.lock.json, `ap doctor` + `ap test` CI, a nightly live-gates workflow over the evaluation runner, a generic wrangler env layout with a shadow env, the projected rules files — so a product is built from the template, never from a copy of the monorepo root.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
+    "directory": "packages/create-app"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "create-app": "./bin/create-app.mjs"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "LICENSE",
+    "dist",
+    "bin",
+    "templates",
+    "spec.md",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@agenticprimitives/devkit": "0.0.0-alpha.1"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.8"
+  },
+  "keywords": [
+    "agentic",
+    "primitives",
+    "create-app",
+    "generator",
+    "template",
+    "product-repo"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run test/unit --passWithNoTests",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}

package/spec.md

@@ -0,0 +1,11 @@
+# @agenticprimitives/create-app — package spec
+
+Spec of record: [specs/399-repository-split-program.md](../../specs/399-repository-split-program.md) §3.6 (the
+product-repo template: pnpm workspace, exact pins, `agentic.lock.json`, `ap doctor` + `ap test` in CI, the wrangler env
+layout with a shadow env, secrets script, nightly live-gates workflow over `packages/evaluation`'s runner, generated
+rules files — "done when `ap-discovery` is created from it") and [specs/398-agentic-primitives-ux-strategy.md](../../specs/398-agentic-primitives-ux-strategy.md)
+§10.2–10.5 (`packages/create-app` is the generator; `templates/` is the tree it consumes; white-label content stays out).
+
+Owns: the template tree, the substitution + generation, the product's initial `agentic.lock.json` (baseline pins,
+rules digests, doctor config). Does not own: the rules source or its projection (`devkit`), any runtime starter code
+(the Next.js + A2A starter of 398 §10.1 is a later template), any deployment name.

package/templates/product-repo/.github/workflows/ci.yml.tmpl

@@ -0,0 +1,33 @@
+name: ci
+
+# Product CI (spec 399 §3.6): typecheck + tests + `ap doctor` (the doctrine gates as CLIs) + `ap doctor --rules`
+# (drift between the projected rules and the pinned source). Conformance of the SHADOW deployment runs in the
+# nightly beside the live gates, not here.
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm test
+      - name: ap doctor
+        run: pnpm exec ap doctor --json > doctor-report.json || (cat doctor-report.json; exit 1)
+      - name: ap doctor --rules (projection drift)
+        run: pnpm exec ap doctor --rules
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: doctor-report
+          path: doctor-report.json

package/templates/product-repo/.github/workflows/live-gates-nightly.yml.tmpl

@@ -0,0 +1,46 @@
+name: live-gates-nightly
+
+# Spec 392 / spec 399 §5.4: the product's live gates, nightly, against its SHADOW deployment during the parallel
+# run and against the live environment after the cut. The runner is @agenticprimitives/evaluation's
+# (`ap test --live-gates`); the gates are DATA in live-gates.json. Artifact-only: the report is uploaded, the run
+# is red when a `required` gate fails. Conformance of the same deployment runs beside it.
+on:
+  schedule:
+    - cron: '17 6 * * *'
+  workflow_dispatch:
+    inputs:
+      home:
+        description: 'HOME_URL to run against (defaults to live-gates.json#home)'
+        required: false
+
+jobs:
+  gates:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    env:
+      HOME_URL: ${{ github.event.inputs.home }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: live gates
+        run: pnpm exec ap test --live-gates live-gates.json --json > live-gates-report.json || (cat live-gates-report.json; exit 1)
+      - name: A2A conformance of the deployment
+        if: env.A2A_URL != ''
+        env:
+          A2A_URL: ${{ vars.A2A_URL }}
+        run: pnpm exec ap conform a2a "$A2A_URL"
+      - name: MCP conformance of the deployment
+        if: env.MCP_URL != ''
+        env:
+          MCP_URL: ${{ vars.MCP_URL }}
+        run: pnpm exec ap conform mcp "$MCP_URL"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: live-gates-report
+          path: live-gates-report.json

package/templates/product-repo/AGENTS.md.tmpl

@@ -0,0 +1,16 @@
+# {{name}} — agent instructions
+
+Binding rules for every AI coding assistant working in this repository. The rules below are PROJECTED from the
+pinned source (`agentic.lock.json#rules`) by `ap doctor --rules --write`; do not edit the managed block, and do not
+restate a rule in your own words (ADR-0063 §8).
+
+## Start here
+
+1. `CLAUDE.md` — the repository guide.
+2. `DEPLOYER.md` — which repository deploys which environment; never deploy a live env this repo does not own.
+3. `agentic.lock.json` — the coherent `@agenticprimitives/*` set; change it only through `ap upgrade`.
+
+## Always-on rules
+
+<!-- ap:rules -->
+<!-- /ap:rules -->

package/templates/product-repo/CLAUDE.md.tmpl

@@ -0,0 +1,25 @@
+# {{name}} — Claude guide
+
+A product repository on published `@agenticprimitives/*` packages (ADR-0063; spec 399). Generated from the
+`product-repo` template ({{templateRevision}}). This repo owns its apps, runtime, ops scripts, live gates, product
+specs and white-label config; Ring 0 owns the packages and the doctrine.
+
+## Hard rules (this repository)
+
+- **Exact pins, one coherent set.** Every `@agenticprimitives/*` dependency is an exact published version from
+  `agentic.lock.json#packages`; move them only with `ap upgrade --canary | --pin`. Never a workspace alias, never a fork.
+- **Doctrine is projected, never restated.** The managed block below and `.cursor/rules/*.mdc` are generated
+  from the pinned source; `ap doctor` (`rules-drift`) fails on any edit.
+- **No new app-resident primitive.** Anything a second product would need is a package API in Ring 0 (spec 399 §4).
+- **Shadow first.** This repo deploys `<env>-split` during the parallel run; a live env changes hands only in the
+  announced cut PR (`DEPLOYER.md`). Worker names, DO bindings and migration tags never change.
+- **Web → A2A, never MCP** (ADR-0044); **the vault is the record** (ADR-0055); **no silent fallbacks** (ADR-0013).
+
+## Validate
+
+`pnpm check` (typecheck + tests + `ap doctor`) · `pnpm doctor:rules` · `pnpm live-gates` (needs `HOME_URL`).
+
+## Binding rules (projected)
+
+<!-- ap:rules -->
+<!-- /ap:rules -->

package/templates/product-repo/DEPLOYER.md.tmpl

@@ -0,0 +1,14 @@
+# DEPLOYER — who deploys what (spec 399 §5.5 / §10)
+
+Two deployers must never both believe they own a live environment. This file names, per app and per
+environment, which repository is the deployer of record. Until an app's announced cut PR, Ring 0
+(`agenticprimitives`) deploys the LIVE environments and this repository deploys only its SHADOW environments.
+
+| App | Environment | Deployer of record | Since | Notes |
+| --- | --- | --- | --- | --- |
+| `apps/<app>` | `env-a-split` (shadow) | {{name}} | {{templateRevision}} | fresh DOs, own secrets, own hostnames |
+| `apps/<app>` | `env-a` (live) | agenticprimitives (Ring 0) | — | flips here at the cut PR, same Worker name |
+| `apps/<app>` | `env-b` (live) | agenticprimitives (Ring 0) | — | idem |
+
+Rules: a row flips only in the cut PR, with the seven green shadow nights attached; a flipped row is reversible by
+reverting that PR for the seven nights after; the shadow env keeps deploying meanwhile.

package/templates/product-repo/README.md.tmpl

@@ -0,0 +1,40 @@
+# {{name}}
+
+A product repository on published `@agenticprimitives/*` packages, generated from the Developer Kit's
+`product-repo` template (spec 399 §3.6, revision {{templateRevision}}) by `@agenticprimitives/create-app`
+{{devkitVersion}}. Ring 0 (`agenticprimitives`) keeps the packages, the contracts and the kit; this repository
+owns its UX, its runtime (Workers, Durable Objects, bindings, wrangler configs, secrets), its ops scripts, its
+live gates, its product specs and its white-label config (ADR-0063 §2).
+
+## Layout
+
+| Path | What lives there |
+| --- | --- |
+| `apps/*` | the product's deployables — each with its own `wrangler.toml` (see `wrangler.example.toml` for the env layout) |
+| `examples/*` | relying-app demonstrations of the product's ceremonies; each builds against published packages or is retired |
+| `scripts/` | ops scripts that operate THIS product's deployments (`set-cloudflare-secrets.sh`, provisioning, verify scripts) |
+| `live-gates.json` | the live-gates ledger (spec 392 shape) the nightly runs through `ap test --live-gates` |
+| `agentic.lock.json` | the coherent `@agenticprimitives/*` set, the rules-source digests, the doctor config |
+| `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/` | projected from the pinned rules source — regenerate with `ap doctor --rules --write`, never edit the managed block |
+| `DEPLOYER.md` | which repository deploys which Worker, and in which environment — one line per app |
+
+## Commands
+
+```
+pnpm install
+pnpm doctor                     # ap doctor — the doctrine rules over this tree
+pnpm doctor:rules               # drift between the projected rules and the pinned source
+pnpm upgrade:canary             # newest canary of every pin, one coherent set, then doctor
+pnpm upgrade:pin 1.0.0-alpha.24 # or one named version / dist-tag
+pnpm live-gates                 # the ledger against HOME_URL (nightly in CI)
+pnpm conform:a2a https://…      # A2A 1.0 conformance of a deployment
+pnpm conform:mcp https://…      # MCP conformance of a deployment
+```
+
+## Rules that bind every change
+
+- Every `@agenticprimitives/*` dependency is an exact published version; the set is coherent (`lock-coherent`).
+- Doctrine is projected, never restated: `AGENTS.md` / `CLAUDE.md` managed blocks and `.cursor/rules/*.mdc` come
+  from the pinned source by digest (`rules-drift`). A product repo may not paraphrase a rule.
+- A shadow environment (`<env>-split`) is where this repo deploys during a parallel run; the live environment
+  changes hands only at the announced cut (spec 399 §5.3). Worker names, DO bindings and migration tags never change.

package/templates/product-repo/apps/README.md

@@ -0,0 +1,5 @@
+# apps/
+
+One directory per deployable. Copied in from Ring 0 with history (`git filter-repo` on a CLONE, never on origin),
+or created new. Each carries its own `wrangler.toml` on the layout in `../wrangler.example.toml`, its `.secrets.<env>`
+(gitignored), and imports `@agenticprimitives/*` only at the exact versions in `../agentic.lock.json`.

package/templates/product-repo/docs/MOVED.md.tmpl

@@ -0,0 +1,12 @@
+# MOVED
+
+<!-- The text the CUT PR drops into Ring 0 at `apps/<app>/MOVED.md` when this app leaves agenticprimitives
+     (spec 399 §5.1 / §5.6). Fill the placeholders; keep it to these lines. -->
+
+This app now lives in **{{name}}** (`<repository url>`), extracted with history from agenticprimitives at commit
+`<ring-0 commit>` into `<product commit>` on `<date>`.
+
+- Deployer of record: {{name}} (see its `DEPLOYER.md`). Worker names, DO bindings and migration tags are unchanged.
+- Product specs: copied to `{{name}}/specs/`; the Ring-0 copies are pointers listed in `specs/INDEX.md`.
+- Ops scripts: `{{name}}/scripts/`.
+- Reversible by reverting the cut PR for seven nights after `<date>`.

package/templates/product-repo/examples/README.md

@@ -0,0 +1,4 @@
+# examples/
+
+Relying-app demonstrations of this product's ceremonies (spec 399 §2.1). Each example builds against the published
+packages or is retired; none ships from Ring 0.

package/templates/product-repo/live-gates.json

@@ -0,0 +1,5 @@
+{
+  "$comment": "The live-gates ledger (spec 392 shape): every verify script with the authority twin it carries, run nightly by `ap test --live-gates live-gates.json` through @agenticprimitives/evaluation's runner against HOME_URL. `required` gates fail the run; the rest report; `paced` gates are spaced for a metered model plan. Add a gate = one entry.",
+  "home": "https://<shadow-home>",
+  "gates": []
+}

package/templates/product-repo/package.json.tmpl

@@ -0,0 +1,29 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.0",
+  "private": true,
+  "description": "{{name}} — a product repository on published @agenticprimitives/* packages (ADR-0063). Generated by @agenticprimitives/create-app {{devkitVersion}}, template product-repo {{templateRevision}}.",
+  "type": "module",
+  "engines": { "node": ">=22.18", "pnpm": ">=9" },
+  "scripts": {
+    "doctor": "ap doctor",
+    "doctor:rules": "ap doctor --rules",
+    "test": "pnpm -r test",
+    "typecheck": "pnpm -r typecheck",
+    "build": "pnpm -r build",
+    "check": "pnpm typecheck && pnpm test && ap doctor",
+    "live-gates": "ap test --live-gates live-gates.json",
+    "conform:a2a": "ap conform a2a",
+    "conform:mcp": "ap conform mcp",
+    "upgrade:canary": "ap upgrade --canary",
+    "upgrade:pin": "ap upgrade --pin"
+  },
+  "devDependencies": {
+    "@agenticprimitives/a2a": "{{pin}}",
+    "@agenticprimitives/devkit": "{{pin}}",
+    "@agenticprimitives/evaluation": "{{pin}}",
+    "@agenticprimitives/mcp-protocol": "{{pin}}",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.8"
+  }
+}

package/templates/product-repo/pnpm-workspace.yaml

@@ -0,0 +1,6 @@
+# A product repository: its apps (Workers, Next.js, DOs), its ops scripts, and the examples that demonstrate its
+# ceremonies. Every @agenticprimitives/* import is a published EXACT version (agentic.lock.json#packages) —
+# never a workspace alias, never a fork (ADR-0037 / ADR-0063 §2). `ap doctor` (lock-coherent) refuses otherwise.
+packages:
+  - 'apps/*'
+  - 'examples/*'

package/templates/product-repo/scripts/set-cloudflare-secrets.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# set-cloudflare-secrets.sh — set each app's Worker secrets for ONE environment from the operator's shell.
+#
+#   ./scripts/set-cloudflare-secrets.sh <env> apps/<app>            # e.g. env-a-split
+#
+# Reads NAME=value pairs from `apps/<app>/.secrets.<env>` (gitignored; never committed) and pushes each with
+# `wrangler secret put --env <env>`. Values never echo. The live envs are set only by the deployer of record
+# (DEPLOYER.md); during the parallel run that is the shadow env only.
+set -euo pipefail
+ENV_NAME="${1:?usage: set-cloudflare-secrets.sh <env> <app-dir>}"
+APP_DIR="${2:?usage: set-cloudflare-secrets.sh <env> <app-dir>}"
+FILE="$APP_DIR/.secrets.$ENV_NAME"
+[ -f "$FILE" ] || { echo "no $FILE — nothing to set" >&2; exit 2; }
+while IFS='=' read -r name value; do
+  [ -z "$name" ] && continue
+  case "$name" in \#*) continue ;; esac
+  printf '%s' "$value" | (cd "$APP_DIR" && npx wrangler secret put "$name" --env "$ENV_NAME") >/dev/null
+  echo "set $name for $ENV_NAME ($APP_DIR)"
+done < "$FILE"

package/templates/product-repo/tsconfig.base.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "declaration": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "useUnknownInCatchVariables": true
+  }
+}

package/templates/product-repo/wrangler.example.toml

@@ -0,0 +1,40 @@
+# The env layout every app in this repository follows (spec 399 §5.3). Copy into apps/<app>/wrangler.toml.
+#
+#   [env.env-a]         a LIVE environment Ring 0 deploys until the cut — names, bindings, DO classes and migration
+#   [env.env-b]         tags are copied VERBATIM from the Ring-0 config and never renamed (a rename orphans DO storage)
+#   [env.env-a-split]   the SHADOW environment this repository deploys during the parallel run: fresh DOs, its own
+#                       secrets, its own hostnames; nightly live gates run against it until seven nights are green
+#
+# Secrets are never in this file: scripts/set-cloudflare-secrets.sh sets them per env from the operator's shell.
+name = "<worker-name>"
+main = "src/index.ts"
+compatibility_date = "2026-09-01"
+
+[vars]
+ALLOWED_ORIGINS = ""
+
+[env.env-a]
+name = "<worker-name>"
+routes = [{ pattern = "<live-host-a>/*", custom_domain = true }]
+[env.env-a.vars]
+ALLOWED_ORIGINS = ""
+
+[env.env-b]
+name = "<worker-name>-b"
+routes = [{ pattern = "<live-host-b>/*", custom_domain = true }]
+[env.env-b.vars]
+ALLOWED_ORIGINS = ""
+
+[env.env-a-split]
+name = "<worker-name>-split"
+routes = [{ pattern = "<shadow-host>/*", custom_domain = true }]
+[env.env-a-split.vars]
+ALLOWED_ORIGINS = ""
+
+# Durable Objects: the SAME class names and migration tags as the live config — copied, never edited.
+# [[durable_objects.bindings]]
+# name = "<BINDING>"
+# class_name = "<ClassName>"
+# [[migrations]]
+# tag = "<tag-as-in-ring-0>"
+# new_sqlite_classes = ["<ClassName>"]