@bluealba/platform-cli 1.2.0-alpha.1 → 1.2.0-alpha.3

package/dist/index.js

@@ -204,7 +204,7 @@ function ConfirmPrompt({ value }) {
 import { Fzf } from "fzf";
 
 // src/commands/create-application/create-application.command.ts
-import { join as join12, resolve as resolve2 } from "path";
+import { join as join13, resolve as resolve2 } from "path";
 import { cwd as cwd4 } from "process";
 import { mkdir as mkdir3 } from "fs/promises";
 
@@ -730,6 +730,15 @@ async function getDefaults() {
   const cache = await readCacheFile();
   return cache.defaults;
 }
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set(["clientSecret"]);
+function maskSensitiveFields(obj) {
+  return JSON.parse(
+    JSON.stringify(
+      obj,
+      (key, value) => SENSITIVE_KEYS.has(key) && typeof value === "string" && value.length > 0 ? "***" : value
+    )
+  );
+}
 var LEGACY_CONFIG_FILE = "standalone.json";
 async function readLegacyConfig(appDir) {
   try {
@@ -742,6 +751,50 @@ async function readLegacyConfig(appDir) {
   }
 }
 
+// src/utils/workspace-claude-md.ts
+import { join as join12 } from "path";
+import { writeFile as writeFile6 } from "fs/promises";
+async function writeWorkspaceClaudeMd(rootDir, manifest) {
+  const { product, applications } = manifest;
+  const coreDirName = `${product.name}-core`;
+  const appLines = applications.map(
+    (app) => `- \`${product.name}-${app.name}/\` \u2014 ${app.displayName}: ${app.description}`
+  );
+  const appSection = appLines.length > 0 ? `
+### Applications
+
+${appLines.join("\n")}
+` : "";
+  const content = `# ${product.displayName} Platform
+
+This is a **Blue Alba Platform** workspace for \`@${product.organization}\`.
+
+For any platform-related task, use the \`/platform\` skill \u2014 it routes to the correct specialized skill automatically.
+
+## Workspace Layout
+
+### Core
+
+- \`${coreDirName}/\` \u2014 Core monorepo (bootstrap service, customization UI, local dev environment)
+  - \`${coreDirName}/local/\` \u2014 Docker Compose files, .env, SSL certificates
+  - \`${coreDirName}/local/platform-docker-compose.yml\` \u2014 Platform infrastructure (nginx, postgres, gateway)
+  - \`${coreDirName}/local/${product.name}-core-docker-compose.yml\` \u2014 Core application services
+  - \`${coreDirName}/local/.env\` \u2014 Environment variables (shared by all applications)
+${appSection}
+## Common Commands
+
+\`\`\`sh
+platform install             # Install all monorepos
+platform start               # Start the full platform locally via Docker
+platform stop                # Stop all running containers
+platform status              # Show platform health and service status
+platform create-application  # Add a new application to this platform
+platform standalone          # Run a single application in isolation
+\`\`\`
+`;
+  await writeFile6(join12(rootDir, "CLAUDE.md"), content, "utf-8");
+}
+
 // src/commands/create-application/create-application.command.ts
 var CREATE_APPLICATION_COMMAND_NAME = "create-application";
 var createApplicationCommand = {
@@ -779,7 +832,7 @@ async function createApplication(params, logger) {
     platformName = manifest.product.name;
     organizationName = manifest.product.organization;
     const localPath = `../${platformName}-${applicationName}`;
-    applicationDir = resolve2(join12(rootDir, coreDirName), localPath);
+    applicationDir = resolve2(join13(rootDir, coreDirName), localPath);
   } else {
     if (!params.platformName || !params.organizationName) {
       logger.log("Error: platformName and organizationName are required when creating an application outside a platform.");
@@ -787,10 +840,10 @@ async function createApplication(params, logger) {
     }
     platformName = params.platformName;
     organizationName = params.organizationName;
-    applicationDir = join12(cwd4(), `${platformName}-${applicationName}`);
+    applicationDir = join13(cwd4(), `${platformName}-${applicationName}`);
   }
   const bootstrapServiceName = `${platformName}-${applicationName}-bootstrap-service`;
-  const bootstrapServiceDir = join12(applicationDir, "services", bootstrapServiceName);
+  const bootstrapServiceDir = join13(applicationDir, "services", bootstrapServiceName);
   logger.log(`Creating application monorepo "${applicationName}"...`);
   try {
     await scaffoldApplicationMonorepo(applicationDir, organizationName, platformName, applicationName, logger);
@@ -798,8 +851,8 @@ async function createApplication(params, logger) {
     logger.log(`Error: Could not scaffold application monorepo \u2014 ${formatError(err)}`);
     return;
   }
-  await mkdir3(join12(applicationDir, "services"), { recursive: true });
-  await mkdir3(join12(applicationDir, "ui"), { recursive: true });
+  await mkdir3(join13(applicationDir, "services"), { recursive: true });
+  await mkdir3(join13(applicationDir, "ui"), { recursive: true });
   logger.log(`Creating bootstrap service "${bootstrapServiceName}"...`);
   const bootstrapServiceBaseDir = `${platformName}-${applicationName}/services`;
   try {
@@ -833,7 +886,7 @@ async function createApplication(params, logger) {
   }
   if (hasUserInterface) {
     const uiName = `${platformName}-${applicationName}-ui`;
-    const uiDir = join12(applicationDir, "ui", uiName);
+    const uiDir = join13(applicationDir, "ui", uiName);
     const uiBaseDir = `${platformName}-${applicationName}/ui`;
     try {
       await scaffoldUiModule(uiDir, organizationName, platformName, applicationName, applicationDisplayName, uiBaseDir, logger);
@@ -844,7 +897,7 @@ async function createApplication(params, logger) {
   }
   if (hasBackendService) {
     const serviceName = `${platformName}-${applicationName}-service`;
-    const serviceDir = join12(applicationDir, "services", serviceName);
+    const serviceDir = join13(applicationDir, "services", serviceName);
     const serviceBaseDir = `${platformName}-${applicationName}/services`;
     try {
       await scaffoldNestjsService(serviceDir, organizationName, platformName, applicationName, applicationDisplayName, serviceBaseDir, logger);
@@ -853,7 +906,7 @@ async function createApplication(params, logger) {
       return;
     }
   }
-  const dockerComposePath = join12(applicationDir, "docker-compose.yml");
+  const dockerComposePath = join13(applicationDir, "docker-compose.yml");
   let uiPort;
   let servicePort;
   if (insidePlatform && localDir && manifest) {
@@ -889,6 +942,12 @@ async function createApplication(params, logger) {
     } catch (err) {
       logger.log(`Warning: Could not update product manifest \u2014 ${formatError(err)}`);
     }
+    try {
+      await writeWorkspaceClaudeMd(rootDir, updatedManifest);
+      logger.log(`Updated workspace CLAUDE.md.`);
+    } catch (err) {
+      logger.log(`Warning: Could not update workspace CLAUDE.md \u2014 ${formatError(err)}`);
+    }
   } else {
     try {
       await saveDefaults({ platformName, organizationName });
@@ -906,7 +965,7 @@ async function createApplication(params, logger) {
 }
 
 // src/commands/init/init.command.ts
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { cwd as cwd5 } from "process";
 
 // src/utils/string.ts
@@ -916,8 +975,8 @@ function camelize(name) {
 
 // src/commands/init/scaffold-platform.ts
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { join as join13, dirname as dirname8 } from "path";
-var templateDir = join13(
+import { join as join14, dirname as dirname8 } from "path";
+var templateDir = join14(
   dirname8(fileURLToPath6(import.meta.url)),
   "..",
   "templates",
@@ -929,8 +988,8 @@ async function scaffoldPlatform(outputDir, variables, logger) {
 
 // src/commands/init/scaffold-platform-bootstrap.ts
 import { fileURLToPath as fileURLToPath7 } from "url";
-import { join as join14, dirname as dirname9 } from "path";
-var templateDir2 = join14(
+import { join as join15, dirname as dirname9 } from "path";
+var templateDir2 = join15(
   dirname9(fileURLToPath7(import.meta.url)),
   "..",
   "templates",
@@ -942,8 +1001,8 @@ async function scaffoldPlatformBootstrap(outputDir, variables, logger) {
 
 // src/commands/init/scaffold-customization-ui.ts
 import { fileURLToPath as fileURLToPath8 } from "url";
-import { join as join15, dirname as dirname10 } from "path";
-var templateDir3 = join15(
+import { join as join16, dirname as dirname10 } from "path";
+var templateDir3 = join16(
   dirname10(fileURLToPath8(import.meta.url)),
   "..",
   "templates",
@@ -954,10 +1013,10 @@ async function scaffoldCustomizationUi(outputDir, variables, logger) {
 }
 
 // src/commands/init/register-customization-module.ts
-import { join as join16 } from "path";
-import { readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
+import { join as join17 } from "path";
+import { readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
 async function registerCustomizationModule(bootstrapServiceDir, organizationName, logger, platformName = "platform") {
-  const modulesJsonPath = join16(bootstrapServiceDir, "src", "data", "platform", "modules.json");
+  const modulesJsonPath = join17(bootstrapServiceDir, "src", "data", "platform", "modules.json");
   const customizationUiName = `${platformName}-customization-ui`;
   const entry = {
     name: `@${organizationName}/${customizationUiName}`,
@@ -975,13 +1034,13 @@ async function registerCustomizationModule(bootstrapServiceDir, organizationName
   };
   const existing = JSON.parse(await readFile6(modulesJsonPath, "utf-8"));
   existing.push(entry);
-  await writeFile6(modulesJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  await writeFile7(modulesJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   logger.log(`Registered customization module in ${modulesJsonPath}`);
 }
 
 // src/commands/init/generate-local-env.ts
-import { readFile as readFile7, writeFile as writeFile7 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import { join as join18 } from "path";
 
 // src/utils/random.ts
 import { randomBytes } from "crypto";
@@ -991,14 +1050,14 @@ function generateRandomSecret() {
 
 // src/commands/init/generate-local-env.ts
 async function generateLocalEnv(outputDir, logger, coreDirName = "core") {
-  const examplePath = join17(outputDir, coreDirName, "local", ".env.example");
-  const envPath = join17(outputDir, coreDirName, "local", ".env");
+  const examplePath = join18(outputDir, coreDirName, "local", ".env.example");
+  const envPath = join18(outputDir, coreDirName, "local", ".env");
   logger.log(`Generating ${coreDirName}/local/.env with random secrets...`);
   const content = await readFile7(examplePath, "utf-8");
   const result = content.replace(/^(PAE_AUTH_JWT_SECRET|PAE_GATEWAY_SERVICE_ACCESS_SECRET|PAE_DB_PASSWORD)=$/gm, (_, key) => {
     return `${key}=${generateRandomSecret()}`;
   });
-  await writeFile7(envPath, result, "utf-8");
+  await writeFile8(envPath, result, "utf-8");
 }
 
 // src/commands/init/init.command.ts
@@ -1044,17 +1103,24 @@ async function init(params, logger) {
     logger.log(`Error: Could not generate ${coreDirName}/local/.env \u2014 ${formatError(err)}`);
     return;
   }
+  let manifest;
   try {
-    const manifest = createInitialManifest({ organizationName, platformName, platformDisplayName });
+    manifest = createInitialManifest({ organizationName, platformName, platformDisplayName });
     await writeManifest(manifest, outputDir, coreDirName);
     logger.log(`Created product manifest: ${coreDirName}/product.manifest.json`);
   } catch (err) {
     logger.log(`Error: Could not write product manifest \u2014 ${formatError(err)}`);
     return;
   }
+  try {
+    await writeWorkspaceClaudeMd(outputDir, manifest);
+    logger.log(`Created workspace CLAUDE.md`);
+  } catch (err) {
+    logger.log(`Warning: Could not write workspace CLAUDE.md \u2014 ${formatError(err)}`);
+  }
   try {
     await scaffoldPlatformBootstrap(
-      join18(outputDir, coreDirName, "services", bootstrapServiceName),
+      join19(outputDir, coreDirName, "services", bootstrapServiceName),
       variables,
       logger
     );
@@ -1064,7 +1130,7 @@ async function init(params, logger) {
   }
   try {
     await scaffoldCustomizationUi(
-      join18(outputDir, coreDirName, "ui", customizationUiName),
+      join19(outputDir, coreDirName, "ui", customizationUiName),
       variables,
       logger
     );
@@ -1074,7 +1140,7 @@ async function init(params, logger) {
   }
   try {
     await registerCustomizationModule(
-      join18(outputDir, coreDirName, "services", bootstrapServiceName),
+      join19(outputDir, coreDirName, "services", bootstrapServiceName),
       organizationName,
       logger,
       platformName
@@ -1087,7 +1153,7 @@ async function init(params, logger) {
 }
 
 // src/commands/configure-idp/configure-idp.command.ts
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { fetch as undiciFetch, Agent } from "undici";
 
 // src/utils/env-reader.ts
@@ -1171,7 +1237,7 @@ async function configureIdp(params, logger) {
     logger.log("Error: Cannot configure an IDP \u2014 no platform initialized in this directory.");
     return;
   }
-  const envPath = join19(layout.localDir, ".env");
+  const envPath = join20(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -1223,13 +1289,13 @@ async function configureIdp(params, logger) {
 }
 
 // src/commands/create-service-module/create-service-module.command.ts
-import { join as join21, resolve as resolve3 } from "path";
+import { join as join22, resolve as resolve3 } from "path";
 import { access as access4 } from "fs/promises";
 
 // src/commands/create-service-module/scaffold-service-module.ts
 import { fileURLToPath as fileURLToPath9 } from "url";
-import { join as join20, dirname as dirname11 } from "path";
-var nestjsServiceModuleTemplateDir2 = join20(
+import { join as join21, dirname as dirname11 } from "path";
+var nestjsServiceModuleTemplateDir2 = join21(
   dirname11(fileURLToPath9(import.meta.url)),
   "..",
   "templates",
@@ -1264,7 +1330,7 @@ function buildCustomServiceModuleEntry(organizationName, serviceName, serviceDis
 }
 
 // src/commands/create-service-module/append-docker-compose.ts
-import { readFile as readFile9, writeFile as writeFile8 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
 async function appendServiceToDockerCompose(dockerComposePath, serviceName, platformName, applicationName, port, logger) {
   const block = `
   ${serviceName}:
@@ -1280,7 +1346,7 @@ async function appendServiceToDockerCompose(dockerComposePath, serviceName, plat
 `;
   try {
     const existing = await readFile9(dockerComposePath, "utf-8");
-    await writeFile8(dockerComposePath, existing + block, "utf-8");
+    await writeFile9(dockerComposePath, existing + block, "utf-8");
     logger.log(`Updated docker-compose: ${dockerComposePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -1316,7 +1382,7 @@ async function createServiceModule(params, logger) {
     logger.log(`Error: The specified application "${applicationName}" is not registered in the product manifest.`);
     return;
   }
-  const applicationDir = resolve3(join21(rootDir, coreDirName), appEntry.localPath);
+  const applicationDir = resolve3(join22(rootDir, coreDirName), appEntry.localPath);
   try {
     await access4(applicationDir);
   } catch {
@@ -1325,7 +1391,7 @@ async function createServiceModule(params, logger) {
   }
   const suffix = serviceNameSuffix === void 0 ? "service" : serviceNameSuffix;
   const fullServiceName = suffix ? `${platformName}-${serviceName}-${suffix}` : `${platformName}-${serviceName}`;
-  const serviceDir = join21(applicationDir, "services", fullServiceName);
+  const serviceDir = join22(applicationDir, "services", fullServiceName);
   try {
     await access4(serviceDir);
     logger.log(`Error: A service named "${fullServiceName}" already exists in application "${applicationName}".`);
@@ -1346,21 +1412,21 @@ async function createServiceModule(params, logger) {
     logger.log(`Error: Could not scaffold NestJS service \u2014 ${formatError(err)}`);
     return;
   }
-  const bootstrapServiceDir = join21(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
+  const bootstrapServiceDir = join22(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
   const moduleEntry = buildCustomServiceModuleEntry(organizationName, fullServiceName, serviceDisplayName);
   await addModuleEntry(bootstrapServiceDir, applicationName, moduleEntry, logger);
-  const dockerComposePath = join21(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  const dockerComposePath = join22(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
   const port = await getNextAvailablePort(localDir);
   await appendServiceToDockerCompose(dockerComposePath, fullServiceName, platformName, applicationName, port, logger);
   logger.log(`Done! Service module "${fullServiceName}" added to application "${applicationName}".`);
 }
 
 // src/commands/create-ui-module/create-ui-module.command.ts
-import { join as join22, resolve as resolve4 } from "path";
+import { join as join23, resolve as resolve4 } from "path";
 import { access as access5, readdir as readdir4 } from "fs/promises";
 
 // src/commands/create-ui-module/append-ui-docker-compose.ts
-import { readFile as readFile10, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile10 } from "fs/promises";
 async function appendUiToDockerCompose(dockerComposePath, platformName, applicationName, port, logger, uiNameOverride) {
   const uiName = uiNameOverride ?? `${platformName}-${applicationName}-ui`;
   const block = `
@@ -1375,7 +1441,7 @@ async function appendUiToDockerCompose(dockerComposePath, platformName, applicat
 `;
   try {
     const existing = await readFile10(dockerComposePath, "utf-8");
-    await writeFile9(dockerComposePath, existing + block, "utf-8");
+    await writeFile10(dockerComposePath, existing + block, "utf-8");
     logger.log(`Updated docker-compose: ${dockerComposePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -1411,14 +1477,14 @@ async function createUiModule(params, logger) {
     logger.log(`Error: The specified application "${applicationName}" is not registered in the product manifest.`);
     return;
   }
-  const applicationDir = resolve4(join22(rootDir, coreDirName), appEntry.localPath);
+  const applicationDir = resolve4(join23(rootDir, coreDirName), appEntry.localPath);
   try {
     await access5(applicationDir);
   } catch {
     logger.log(`Error: The specified application "${applicationName}" does not exist in the platform.`);
     return;
   }
-  const uiDir = join22(applicationDir, "ui");
+  const uiDir = join23(applicationDir, "ui");
   try {
     const uiEntries = await readdir4(uiDir);
     const existingUiModules = uiEntries.filter((e) => e !== ".gitkeep");
@@ -1430,7 +1496,7 @@ async function createUiModule(params, logger) {
   }
   const uiSuffix = uiModuleSuffix === void 0 ? "ui" : uiModuleSuffix;
   const uiName = uiSuffix ? `${platformName}-${applicationName}-${uiSuffix}` : `${platformName}-${applicationName}`;
-  const uiOutputDir = join22(uiDir, uiName);
+  const uiOutputDir = join23(uiDir, uiName);
   const uiBaseDir = `${platformName}-${applicationName}/ui`;
   try {
     await scaffoldUiModule(uiOutputDir, organizationName, platformName, applicationName, applicationDisplayName, uiBaseDir, logger);
@@ -1438,10 +1504,10 @@ async function createUiModule(params, logger) {
     logger.log(`Error: Could not scaffold UI module \u2014 ${formatError(err)}`);
     return;
   }
-  const bootstrapServiceDir = join22(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
+  const bootstrapServiceDir = join23(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
   const moduleEntry = buildUiModuleEntry(organizationName, platformName, applicationName, applicationDisplayName, uiName);
   await addModuleEntry(bootstrapServiceDir, applicationName, moduleEntry, logger);
-  const dockerComposePath = join22(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  const dockerComposePath = join23(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
   const port = await getNextAvailablePort(localDir);
   await appendUiToDockerCompose(dockerComposePath, platformName, applicationName, port, logger, uiName);
   logger.log(`Done! UI module "${uiName}" added to application "${applicationName}".`);
@@ -1450,13 +1516,13 @@ async function createUiModule(params, logger) {
 // src/commands/status/status-checks.ts
 import { spawn as spawn3 } from "child_process";
 import { access as access8 } from "fs/promises";
-import { join as join25, resolve as resolve7 } from "path";
+import { join as join26, resolve as resolve7 } from "path";
 import { fetch as undiciFetch2, Agent as Agent2 } from "undici";
 
 // src/commands/local-scripts/docker-compose-orchestrator.ts
 import { spawn } from "child_process";
-import { access as access6 } from "fs/promises";
-import { join as join23, resolve as resolve5 } from "path";
+import { access as access6, readFile as readFile11, writeFile as writeFile11 } from "fs/promises";
+import { dirname as dirname12, join as join24, resolve as resolve5 } from "path";
 function runDockerCompose(args2, logger, rootDir, signal) {
   return new Promise((resolvePromise) => {
     const child = spawn("docker", ["compose", ...args2], {
@@ -1519,17 +1585,30 @@ function captureDockerCompose(args2, rootDir) {
     child.on("error", (err) => reject(err));
   });
 }
+async function generateProxyAppCompose(appDir, localDir, platformName, applicationName) {
+  const appComposePath = join24(appDir, "docker-compose.yml");
+  const content = await readFile11(appComposePath, "utf-8");
+  const withAbsContexts = content.replace(
+    /^(\s+context:\s+)\.\/(.*)$/gm,
+    `$1${appDir}/$2`
+  );
+  const appParentDir = dirname12(appDir);
+  const rewritten = withAbsContexts.replace(/\$\{PWD\}/g, appParentDir);
+  const proxyPath = join24(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  await writeFile11(proxyPath, rewritten, "utf-8");
+  return proxyPath;
+}
 async function getAppComposePaths(localDir, coreDir, platformName, manifest, logger) {
   const results = [];
   for (const app of manifest.applications) {
-    const appDir = resolve5(join23(coreDir), app.localPath);
-    const newPath = join23(appDir, "docker-compose.yml");
-    const legacyPrefixedPath = join23(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const legacyUnprefixedPath = join23(localDir, `${app.name}-docker-compose.yml`);
+    const appDir = resolve5(join24(coreDir), app.localPath);
+    const newPath = join24(appDir, "docker-compose.yml");
+    const legacyPrefixedPath = join24(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const legacyUnprefixedPath = join24(localDir, `${app.name}-docker-compose.yml`);
     let resolved = null;
     try {
       await access6(newPath);
-      resolved = newPath;
+      resolved = await generateProxyAppCompose(appDir, localDir, platformName, app.name);
     } catch {
       try {
         await access6(legacyPrefixedPath);
@@ -1553,8 +1632,8 @@ async function getAppComposePaths(localDir, coreDir, platformName, manifest, log
 async function buildFullComposeArgs(layout, manifest, logger) {
   const { coreDirName, localDir, coreDir } = layout;
   const platformName = manifest.product.name;
-  const prefixedCoreCompose = join23(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCoreCompose = join23(localDir, "core-docker-compose.yml");
+  const prefixedCoreCompose = join24(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCoreCompose = join24(localDir, "core-docker-compose.yml");
   let coreComposePath;
   try {
     await access6(prefixedCoreCompose);
@@ -1564,7 +1643,7 @@ async function buildFullComposeArgs(layout, manifest, logger) {
   }
   const fileArgs = [
     "-f",
-    join23(localDir, "platform-docker-compose.yml"),
+    join24(localDir, "platform-docker-compose.yml"),
     "-f",
     coreComposePath
   ];
@@ -1584,8 +1663,8 @@ async function buildSelectedComposeFiles(layout, selectedManifest, includeCore)
   const platformName = selectedManifest.product.name;
   const files = [];
   if (includeCore) {
-    const prefixedCoreCompose = join23(localDir, `${coreDirName}-docker-compose.yml`);
-    const unprefixedCoreCompose = join23(localDir, "core-docker-compose.yml");
+    const prefixedCoreCompose = join24(localDir, `${coreDirName}-docker-compose.yml`);
+    const unprefixedCoreCompose = join24(localDir, "core-docker-compose.yml");
     let coreComposePath;
     try {
       await access6(prefixedCoreCompose);
@@ -1593,7 +1672,7 @@ async function buildSelectedComposeFiles(layout, selectedManifest, includeCore)
     } catch {
       coreComposePath = unprefixedCoreCompose;
     }
-    files.push(join23(localDir, "platform-docker-compose.yml"), coreComposePath);
+    files.push(join24(localDir, "platform-docker-compose.yml"), coreComposePath);
   }
   const appEntries = await getAppComposePaths(localDir, coreDir, platformName, selectedManifest);
   for (const { composePath } of appEntries) {
@@ -1637,7 +1716,7 @@ async function getServicesFromComposeFiles(selectedFiles, allFiles, rootDir) {
 async function startEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1659,7 +1738,7 @@ async function startEnvironment(layout, manifest, logger, signal, includeCore =
 async function stopEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1681,7 +1760,7 @@ async function stopEnvironment(layout, manifest, logger, signal, includeCore = t
 async function resetEnvironment(layout, manifest, logger, signal) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const fileArgs = await buildFullComposeArgs(layout, manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
   await runDockerCompose([...projectArgs, ...fileArgs, "down", "-v"], logger, rootDir, signal);
@@ -1689,7 +1768,7 @@ async function resetEnvironment(layout, manifest, logger, signal) {
 async function destroyEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest, removeImages = true) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1716,7 +1795,7 @@ async function destroyEnvironment(layout, manifest, logger, signal, includeCore
 // src/commands/local-scripts/npm-orchestrator.ts
 import { spawn as spawn2 } from "child_process";
 import { access as access7 } from "fs/promises";
-import { resolve as resolve6, join as join24 } from "path";
+import { resolve as resolve6, join as join25 } from "path";
 function runCommand(command, args2, workDir, logger, signal) {
   return new Promise((resolvePromise) => {
     const child = spawn2(command, args2, {
@@ -1773,7 +1852,7 @@ async function installDependencies(layout, manifest, logger, signal, includeCore
   const { coreDir, coreDirName } = layout;
   const appDirs = [];
   for (const app of manifest.applications) {
-    const appDir = resolve6(join24(coreDir), app.localPath);
+    const appDir = resolve6(join25(coreDir), app.localPath);
     if (!await dirExists(appDir)) {
       logger.log(`Warning: Application directory "${app.name}" not found at ${appDir} \u2014 skipping install.`);
       continue;
@@ -1799,7 +1878,7 @@ async function buildAll(layout, manifest, logger, signal, includeCore = true) {
   }
   const appDirs = [];
   for (const app of manifest.applications) {
-    const appDir = resolve6(join24(coreDir), app.localPath);
+    const appDir = resolve6(join25(coreDir), app.localPath);
     if (!await dirExists(appDir)) {
       logger.log(`Warning: Application directory "${app.name}" not found at ${appDir} \u2014 skipping build.`);
       continue;
@@ -1980,13 +2059,13 @@ async function checkInstalled(layout, manifest) {
   const results = [];
   const coreCheck = {
     name: layout.coreDirName,
-    path: join25(layout.coreDir, "node_modules"),
-    exists: await pathExists(join25(layout.coreDir, "node_modules"))
+    path: join26(layout.coreDir, "node_modules"),
+    exists: await pathExists(join26(layout.coreDir, "node_modules"))
   };
   results.push(coreCheck);
   for (const app of manifest.applications) {
     const appDir = resolve7(layout.coreDir, app.localPath);
-    const nodeModulesPath = join25(appDir, "node_modules");
+    const nodeModulesPath = join26(appDir, "node_modules");
     results.push({
       name: app.name,
       path: nodeModulesPath,
@@ -1997,7 +2076,7 @@ async function checkInstalled(layout, manifest) {
 }
 async function checkBuilt(layout, manifest) {
   const results = [];
-  const coreTurboPath = join25(layout.coreDir, ".turbo");
+  const coreTurboPath = join26(layout.coreDir, ".turbo");
   results.push({
     name: layout.coreDirName,
     path: coreTurboPath,
@@ -2005,7 +2084,7 @@ async function checkBuilt(layout, manifest) {
   });
   for (const app of manifest.applications) {
     const appDir = resolve7(layout.coreDir, app.localPath);
-    const appTurboPath = join25(appDir, ".turbo");
+    const appTurboPath = join26(appDir, ".turbo");
     results.push({
       name: app.name,
       path: appTurboPath,
@@ -2017,13 +2096,13 @@ async function checkBuilt(layout, manifest) {
 async function resolveComposeFiles(layout, manifest) {
   const { localDir, coreDirName } = layout;
   const platformName = manifest.product.name;
-  const files = [join25(localDir, "platform-docker-compose.yml")];
-  const prefixedCore = join25(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCore = join25(localDir, "core-docker-compose.yml");
+  const files = [join26(localDir, "platform-docker-compose.yml")];
+  const prefixedCore = join26(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCore = join26(localDir, "core-docker-compose.yml");
   files.push(await pathExists(prefixedCore) ? prefixedCore : unprefixedCore);
   for (const app of manifest.applications) {
-    const prefixed = join25(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const unprefixed = join25(localDir, `${app.name}-docker-compose.yml`);
+    const prefixed = join26(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const unprefixed = join26(localDir, `${app.name}-docker-compose.yml`);
     if (await pathExists(prefixed)) files.push(prefixed);
     else if (await pathExists(unprefixed)) files.push(unprefixed);
   }
@@ -2129,15 +2208,15 @@ async function getServicesForComposeFiles(selectedFiles, allFiles, rootDir) {
 async function checkContainersPerApp(layout, manifest, allContainers) {
   const { localDir, coreDirName, rootDir } = layout;
   const platformName = manifest.product.name;
-  const prefixedCore = join25(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCore = join25(localDir, "core-docker-compose.yml");
+  const prefixedCore = join26(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCore = join26(localDir, "core-docker-compose.yml");
   const coreComposePath = await pathExists(prefixedCore) ? prefixedCore : unprefixedCore;
-  const platformComposePath = join25(localDir, "platform-docker-compose.yml");
+  const platformComposePath = join26(localDir, "platform-docker-compose.yml");
   const allFiles = [platformComposePath, coreComposePath];
   const appComposeMap = /* @__PURE__ */ new Map();
   for (const app of manifest.applications) {
-    const prefixed = join25(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const unprefixed = join25(localDir, `${app.name}-docker-compose.yml`);
+    const prefixed = join26(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const unprefixed = join26(localDir, `${app.name}-docker-compose.yml`);
     if (await pathExists(prefixed)) {
       appComposeMap.set(app.name, prefixed);
       allFiles.push(prefixed);
@@ -2184,7 +2263,7 @@ async function checkContainersPerApp(layout, manifest, allContainers) {
   return groups;
 }
 async function checkIdpProviders(layout) {
-  const envPath = join25(layout.localDir, ".env");
+  const envPath = join26(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -2303,7 +2382,7 @@ var statusCommand = {
 };
 
 // src/commands/manage-platform-admins/manage-platform-admins.command.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { fetch as undiciFetch3, Agent as Agent3 } from "undici";
 var MANAGE_PLATFORM_ADMINS_COMMAND_NAME = "manage-platform-admins";
 var managePlatformAdminsCommand = {
@@ -2317,7 +2396,7 @@ async function getGatewayConfig(logger) {
     logger.log("Error: Cannot manage platform admins \u2014 no platform initialized in this directory.");
     return null;
   }
-  const envPath = join26(layout.localDir, ".env");
+  const envPath = join27(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -2439,19 +2518,61 @@ async function removePlatformAdmin(ruleId, logger) {
 var baPlatformPlugin = {
   name: "ba-platform-plugin",
   description: "Blue Alba Platform knowledge and CLI skills for AI assistants",
-  version: "1.0.0",
+  version: "1.2.0",
   skills: [
     {
       name: "platform",
-      description: "Comprehensive Blue Alba Platform architecture and concepts knowledge",
+      description: "Blue Alba Platform orchestrator \u2014 routes to the correct specialized skill or answers general architecture questions. Use this skill for ANY platform-related request.",
       type: "skill",
       sourceFile: "skills/ba-platform/platform.skill.md"
     },
     {
       name: "platform-cli",
-      description: "Blue Alba Platform CLI commands and usage knowledge",
+      description: "Blue Alba Platform CLI commands, usage, installation, and headless mode reference",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-cli.skill.md"
+    },
+    {
+      name: "platform-add-operation",
+      description: "Adds an authorization operation (permission/RBAC guard) to a bootstrap service and enforces it in UI or backend routes",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-add-operation.skill.md"
+    },
+    {
+      name: "platform-add-feature-flag",
+      description: "Declares a feature flag in a bootstrap service and gates a React component or NestJS endpoint behind it",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-add-feature-flag.skill.md"
+    },
+    {
+      name: "platform-add-scheduled-job",
+      description: "Adds a cron-scheduled job to a bootstrap service to run a backend endpoint on a recurring schedule",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-add-scheduled-job.skill.md"
+    },
+    {
+      name: "platform-add-menu-item",
+      description: "Creates a new page component and wires it as a menu item/route in a single-spa UI module",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-add-menu-item.skill.md"
+    },
+    {
+      name: "platform-extend-shell",
+      description: "Injects a custom component into a shell extension point (navbar, branding, user section)",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-extend-shell.skill.md"
+    },
+    {
+      name: "platform-add-presence",
+      description: "Adds real-time user presence (live avatars, who-is-viewing) to a component using the Rooms API",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-add-presence.skill.md"
+    },
+    {
+      name: "platform-scaffold-module",
+      description: "Scaffolds a new UI module or NestJS service module in a platform monorepo using the CLI",
+      type: "skill",
+      sourceFile: "skills/ba-platform/platform-scaffold-module.skill.md"
     }
   ]
 };
@@ -3138,20 +3259,20 @@ async function installAiPluginService(params, context) {
 
 // src/commands/install-ai-plugin/providers/claude.provider.ts
 import { homedir as homedir3 } from "os";
-import { join as join27 } from "path";
-import { readFile as readFile11, writeFile as writeFile10, mkdir as mkdir4, rm } from "fs/promises";
+import { join as join28 } from "path";
+import { readFile as readFile12, writeFile as writeFile12, mkdir as mkdir4, rm } from "fs/promises";
 var ClaudeProvider = class {
   name = "claude";
-  baseDir = join27(homedir3(), ".claude");
+  baseDir = join28(homedir3(), ".claude");
   getInstallPath(skillName) {
-    return join27(this.baseDir, "skills", skillName, "SKILL.md");
+    return join28(this.baseDir, "skills", skillName, "SKILL.md");
   }
   manifestPath(pluginName) {
-    return join27(this.baseDir, `${pluginName}.manifest.json`);
+    return join28(this.baseDir, `${pluginName}.manifest.json`);
   }
   async readManifest(pluginName) {
     try {
-      const content = await readFile11(this.manifestPath(pluginName), "utf-8");
+      const content = await readFile12(this.manifestPath(pluginName), "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -3159,7 +3280,7 @@ var ClaudeProvider = class {
   }
   async writeManifest(manifest) {
     await mkdir4(this.baseDir, { recursive: true });
-    await writeFile10(
+    await writeFile12(
       this.manifestPath(manifest.plugin),
       JSON.stringify(manifest, null, 2),
       "utf-8"
@@ -3179,16 +3300,16 @@ var ClaudeProvider = class {
   }
   async installSkill(skill, docsSource, logger) {
     const sourcePath = docsSource.resolve(skill.sourceFile);
-    let content = await readFile11(sourcePath, "utf-8");
+    let content = await readFile12(sourcePath, "utf-8");
     const docsPath = docsSource.resolve("docs");
     content = content.replaceAll("{{docsPath}}", docsPath);
     const installPath = this.getInstallPath(skill.name);
-    await mkdir4(join27(installPath, ".."), { recursive: true });
-    await writeFile10(installPath, content, "utf-8");
+    await mkdir4(join28(installPath, ".."), { recursive: true });
+    await writeFile12(installPath, content, "utf-8");
     logger.log(`  Installed skill: ${installPath}`);
   }
   async removeSkill(skillName, logger) {
-    const skillDir = join27(this.baseDir, "skills", skillName);
+    const skillDir = join28(this.baseDir, "skills", skillName);
     try {
       await rm(skillDir, { recursive: true, force: true });
       logger.log(`  Removed skill: ${skillDir}`);
@@ -3196,11 +3317,11 @@ var ClaudeProvider = class {
     }
   }
   async updatePermissions(docsSource, logger) {
-    const settingsPath = join27(this.baseDir, "settings.json");
+    const settingsPath = join28(this.baseDir, "settings.json");
     const docsPath = docsSource.resolve("docs");
     let settings = {};
     try {
-      const content = await readFile11(settingsPath, "utf-8");
+      const content = await readFile12(settingsPath, "utf-8");
       settings = JSON.parse(content);
     } catch {
     }
@@ -3212,7 +3333,7 @@ var ClaudeProvider = class {
     permissions.additionalDirectories = [...additionalDirectories, docsPath];
     settings.permissions = permissions;
     await mkdir4(this.baseDir, { recursive: true });
-    await writeFile10(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
+    await writeFile12(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
     logger.log(`  Granted read access to docs: ${docsPath}`);
   }
 };
@@ -3232,11 +3353,11 @@ function getProvider(name) {
 
 // src/commands/install-ai-plugin/docs-source/local.docs-source.ts
 import { fileURLToPath as fileURLToPath10 } from "url";
-import { join as join28, dirname as dirname12 } from "path";
-var packageRoot = join28(dirname12(fileURLToPath10(import.meta.url)), "..");
+import { join as join29, dirname as dirname13 } from "path";
+var packageRoot = join29(dirname13(fileURLToPath10(import.meta.url)), "..");
 var LocalDocsSource = class {
   resolve(relativePath) {
-    return join28(packageRoot, relativePath);
+    return join29(packageRoot, relativePath);
   }
 };
 
@@ -3280,17 +3401,17 @@ async function installAiPluginUiController(ctx) {
 
 // src/controllers/ui/standalone.ui-controller.ts
 import { rm as rm3 } from "fs/promises";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 import { cwd as cwd7 } from "process";
 import { exec } from "child_process";
 
 // src/commands/standalone/app-monorepo-check.ts
 import { access as access9, readdir as readdir5 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { cwd as cwd6 } from "process";
 async function findAppMonorepoLayout(startDir = cwd6()) {
-  const composePath = join29(startDir, "docker-compose.yml");
-  const packageJsonPath = join29(startDir, "package.json");
+  const composePath = join30(startDir, "docker-compose.yml");
+  const packageJsonPath = join30(startDir, "package.json");
   try {
     await access9(composePath);
     await access9(packageJsonPath);
@@ -3308,7 +3429,7 @@ async function hasCoreChildDir(dir) {
     for (const entry of entries) {
       if (entry.isDirectory() && (entry.name.endsWith("-core") || entry.name === "core")) {
         try {
-          await access9(join29(dir, entry.name, "product.manifest.json"));
+          await access9(join30(dir, entry.name, "product.manifest.json"));
           return true;
         } catch {
         }
@@ -3323,15 +3444,15 @@ async function isInAppMonorepo() {
 }
 
 // src/commands/standalone/standalone-auto-detect.ts
-import { readdir as readdir6, readFile as readFile12 } from "fs/promises";
-import { join as join30, basename as basename2 } from "path";
+import { readdir as readdir6, readFile as readFile13 } from "fs/promises";
+import { join as join31, basename as basename2 } from "path";
 async function autoDetectAppIdentity(appDir) {
   const fromBootstrap = await detectFromBootstrap(appDir);
   if (fromBootstrap) return fromBootstrap;
   return detectFromPackageJson(appDir);
 }
 async function detectFromBootstrap(appDir) {
-  const servicesDir = join30(appDir, "services");
+  const servicesDir = join31(appDir, "services");
   let entries;
   try {
     entries = await readdir6(servicesDir);
@@ -3341,7 +3462,7 @@ async function detectFromBootstrap(appDir) {
   const bootstrapDirs = entries.filter((e) => e.endsWith("-bootstrap-service"));
   if (bootstrapDirs.length === 0) return null;
   for (const bootstrapDirName of bootstrapDirs) {
-    const dataDir = join30(servicesDir, bootstrapDirName, "src", "data");
+    const dataDir = join31(servicesDir, bootstrapDirName, "src", "data");
     let dataDirEntries;
     try {
       dataDirEntries = await readdir6(dataDir);
@@ -3350,9 +3471,9 @@ async function detectFromBootstrap(appDir) {
     }
     for (const subDir of dataDirEntries) {
       if (subDir === "platform") continue;
-      const appJsonPath = join30(dataDir, subDir, "application.json");
+      const appJsonPath = join31(dataDir, subDir, "application.json");
       try {
-        const content = await readFile12(appJsonPath, "utf-8");
+        const content = await readFile13(appJsonPath, "utf-8");
         const appData = JSON.parse(content);
         if (!appData.name) continue;
         const applicationName = appData.name;
@@ -3370,7 +3491,7 @@ async function detectFromBootstrap(appDir) {
 }
 async function detectFromPackageJson(appDir) {
   try {
-    const content = await readFile12(join30(appDir, "package.json"), "utf-8");
+    const content = await readFile13(join31(appDir, "package.json"), "utf-8");
     const pkg = JSON.parse(content);
     const rawName = pkg.name ?? "";
     const applicationName = rawName.includes("/") ? rawName.split("/")[1] ?? rawName : rawName;
@@ -3393,23 +3514,24 @@ function inferPlatformNameFromAppDir(appDir, applicationName) {
 }
 
 // src/commands/standalone/standalone-orchestrator.ts
-import { join as join31, dirname as dirname13 } from "path";
-import { mkdir as mkdir5, rm as rm2, readdir as readdir7, access as access10, writeFile as writeFile11, readFile as readFile13 } from "fs/promises";
+import { join as join32, dirname as dirname14 } from "path";
+import { mkdir as mkdir5, rm as rm2, readdir as readdir7, access as access10, writeFile as writeFile13, readFile as readFile14, open } from "fs/promises";
+import { constants } from "fs";
 import { fetch as undiciFetch4, Agent as Agent4 } from "undici";
 var TMP_BASE = "/tmp";
 var STANDALONE_PREFIX = "platform-standalone-";
 var DETACH_MARKER = ".standalone-running";
 function getTmpDir(platformName) {
-  return join31(TMP_BASE, `${STANDALONE_PREFIX}${platformName}`);
+  return join32(TMP_BASE, `${STANDALONE_PREFIX}${platformName}`);
 }
 async function findRunningSingleton() {
   try {
     const entries = await readdir7(TMP_BASE, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name.startsWith(STANDALONE_PREFIX)) {
-        const candidateDir = join31(TMP_BASE, entry.name);
+        const candidateDir = join32(TMP_BASE, entry.name);
         try {
-          await access10(join31(candidateDir, DETACH_MARKER));
+          await access10(join32(candidateDir, DETACH_MARKER));
           return candidateDir;
         } catch {
         }
@@ -3453,7 +3575,7 @@ async function configureIdpFromConfig(config, localDir, logger) {
     logger.log("No IDP configured \u2014 run 'platform standalone-config set' to add an IDP. Skipping IDP setup.");
     return;
   }
-  const envPath = join31(localDir, ".env");
+  const envPath = join32(localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -3508,7 +3630,7 @@ async function configureAdminUsersFromConfig(config, localDir, logger) {
   if (!config.adminUsers || config.adminUsers.length === 0) {
     return;
   }
-  const envPath = join31(localDir, ".env");
+  const envPath = join32(localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -3551,19 +3673,19 @@ async function configureAdminUsersFromConfig(config, localDir, logger) {
   }
 }
 function buildLayout(tmpDir, coreDirName) {
-  const coreDir = join31(tmpDir, coreDirName);
+  const coreDir = join32(tmpDir, coreDirName);
   return {
     rootDir: tmpDir,
     coreDir,
     coreDirName,
-    localDir: join31(coreDir, "local")
+    localDir: join32(coreDir, "local")
   };
 }
-async function generateProxyAppCompose(appDir, localDir, platformName, applicationName, logger) {
-  const appComposePath = join31(appDir, "docker-compose.yml");
+async function generateProxyAppCompose2(appDir, localDir, platformName, applicationName, logger) {
+  const appComposePath = join32(appDir, "docker-compose.yml");
   let content;
   try {
-    content = await readFile13(appComposePath, "utf-8");
+    content = await readFile14(appComposePath, "utf-8");
   } catch {
     logger.log(`Warning: No docker-compose.yml found at ${appComposePath} \u2014 app services won't start.`);
     return;
@@ -3572,10 +3694,10 @@ async function generateProxyAppCompose(appDir, localDir, platformName, applicati
     /^(\s+context:\s+)\.\/(.*)$/gm,
     `$1${appDir}/$2`
   );
-  const appParentDir = dirname13(appDir);
+  const appParentDir = dirname14(appDir);
   const rewritten = withAbsContexts.replace(/\$\{PWD\}/g, appParentDir);
-  const proxyPath = join31(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
-  await writeFile11(proxyPath, rewritten, "utf-8");
+  const proxyPath = join32(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  await writeFile13(proxyPath, rewritten, "utf-8");
   logger.log(`Generated app compose with absolute build paths.`);
 }
 function buildComposeManifest(manifest) {
@@ -3601,7 +3723,23 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   }
   logger.log(`Starting standalone platform for "${applicationDisplayName}"...`);
   await mkdir5(tmpDir, { recursive: true });
-  await writeFile11(join31(tmpDir, DETACH_MARKER), platformName, "utf-8");
+  let markerFd;
+  try {
+    markerFd = await open(
+      join32(tmpDir, DETACH_MARKER),
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY
+    );
+    await markerFd.writeFile(platformName, "utf-8");
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      logger.log(`Error: A standalone platform is already starting at ${tmpDir}.`);
+      logger.log(`Run "platform standalone-stop" to stop it before starting a new one.`);
+      return;
+    }
+    throw err;
+  } finally {
+    await markerFd?.close();
+  }
   const variables = {
     organizationName,
     platformName,
@@ -3626,9 +3764,9 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
     }
   );
   await writeManifest(npmManifest, tmpDir, coreDirName);
-  const bootstrapServiceDir = join31(tmpDir, coreDirName, "services", bootstrapServiceName);
+  const bootstrapServiceDir = join32(tmpDir, coreDirName, "services", bootstrapServiceName);
   await scaffoldPlatformBootstrap(bootstrapServiceDir, variables, logger);
-  const customizationUiDir = join31(tmpDir, coreDirName, "ui", customizationUiName);
+  const customizationUiDir = join32(tmpDir, coreDirName, "ui", customizationUiName);
   await scaffoldCustomizationUi(customizationUiDir, variables, logger);
   await registerCustomizationModule(bootstrapServiceDir, organizationName, logger, platformName);
   const layout = buildLayout(tmpDir, coreDirName);
@@ -3638,7 +3776,7 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   logger.log("Building...");
   await buildAll(layout, npmManifest, logger, signal, true);
   if (signal?.aborted) return;
-  await generateProxyAppCompose(appDir, layout.localDir, platformName, applicationName, logger);
+  await generateProxyAppCompose2(appDir, layout.localDir, platformName, applicationName, logger);
   const composeManifest = buildComposeManifest(npmManifest);
   await writeManifest(composeManifest, tmpDir, coreDirName);
   logger.log("Resetting previous environment (removing stale containers and volumes)...");
@@ -3647,7 +3785,7 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   logger.log("Starting containers...");
   await startEnvironment(layout, composeManifest, logger, signal);
   if (signal?.aborted) return;
-  const env = await readEnvFile(join31(layout.localDir, ".env")).catch(() => /* @__PURE__ */ new Map());
+  const env = await readEnvFile(join32(layout.localDir, ".env")).catch(() => /* @__PURE__ */ new Map());
   const gatewayUrl = env.get("PAE_GATEWAY_HOST_URL") ?? "https://localhost:443";
   const gatewayReady = await waitForGateway(gatewayUrl, logger);
   if (!gatewayReady) {
@@ -3667,16 +3805,27 @@ Standalone platform is running in the background.`);
   logger.log("\nPlatform is running. Press Ctrl+C to stop and clean up.");
   const keepAlive = setInterval(() => {
   }, 60 * 6e4);
+  let cleanupInProgress = false;
   const shutdown = () => {
+    if (cleanupInProgress) {
+      logger.log("\nForce exiting. Containers may need manual cleanup:");
+      logger.log(`  docker compose -p ${platformName}-platform down -v --remove-orphans`);
+      process.exit(1);
+    }
+    cleanupInProgress = true;
     clearInterval(keepAlive);
-    void (async () => {
+    (async () => {
       logger.log("\nShutting down standalone platform...");
       await destroyEnvironment(layout, composeManifest, logger);
       await cleanupTmpDir(tmpDir, logger);
-    })();
+      process.exit(0);
+    })().catch((err) => {
+      logger.log(`Error during cleanup: ${err.message}`);
+      process.exit(1);
+    });
   };
-  process.once("SIGINT", shutdown);
-  process.once("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
 }
 async function stopStandalone(logger) {
   const runningDir = await findRunningSingleton();
@@ -3690,7 +3839,7 @@ async function stopStandalone(logger) {
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name.endsWith("-core")) {
         try {
-          await access10(join31(runningDir, entry.name, "product.manifest.json"));
+          await access10(join32(runningDir, entry.name, "product.manifest.json"));
           coreDirName = entry.name;
           break;
         } catch {
@@ -3805,7 +3954,7 @@ async function standaloneUiController(ctx) {
       const deleteLegacy = await ctx.confirm("Delete the local standalone.json?", true);
       if (deleteLegacy) {
         try {
-          await rm3(join32(appDir, "standalone.json"));
+          await rm3(join33(appDir, "standalone.json"));
           ctx.log("Deleted standalone.json.");
         } catch {
           ctx.log("Warning: Could not delete standalone.json.");
@@ -3937,7 +4086,7 @@ async function standaloneConfigShowUiController(ctx) {
     if (config) {
       ctx.log(`Standalone config for ${detected.platformName}/${detected.applicationName}:
 `);
-      ctx.log(JSON.stringify(config, null, 2));
+      ctx.log(JSON.stringify(maskSensitiveFields(config), null, 2));
     } else {
       ctx.log(`No config found for ${detected.platformName}/${detected.applicationName}.`);
       ctx.log(`Run 'platform standalone' or 'platform standalone-config set' to configure.`);
@@ -3956,7 +4105,7 @@ async function showAll(ctx) {
   if (Object.keys(defaults).length === 0) {
     ctx.log("(none)");
   } else {
-    ctx.log(JSON.stringify(defaults, null, 2));
+    ctx.log(JSON.stringify(maskSensitiveFields(defaults), null, 2));
   }
   ctx.log("\n--- Apps ---");
   if (apps.length === 0) {
@@ -4862,7 +5011,7 @@ async function standaloneConfigShowCliController(args2) {
     const [pn, an] = parts;
     const config = await resolveAppConfig(pn, an);
     if (config) {
-      console.log(JSON.stringify(config, null, 2));
+      console.log(JSON.stringify(maskSensitiveFields(config), null, 2));
     } else {
       console.error(`No config found for ${appArg}.`);
       process.exit(1);
@@ -4873,12 +5022,12 @@ async function standaloneConfigShowCliController(args2) {
   if (detected) {
     const config = await resolveAppConfig(detected.platformName, detected.applicationName);
     if (config) {
-      console.log(JSON.stringify(config, null, 2));
+      console.log(JSON.stringify(maskSensitiveFields(config), null, 2));
       return;
     }
   }
   const cache = await readCacheFile();
-  console.log(JSON.stringify(cache, null, 2));
+  console.log(JSON.stringify(maskSensitiveFields(cache), null, 2));
 }
 async function standaloneConfigSetCliController(args2) {
   if (args2["defaults"] === "true") {