@bluealba/platform-cli 1.2.0-alpha.2 → 1.2.0-alpha.4

package/dist/index.js

@@ -204,7 +204,7 @@ function ConfirmPrompt({ value }) {
 import { Fzf } from "fzf";
 
 // src/commands/create-application/create-application.command.ts
-import { join as join12, resolve as resolve2 } from "path";
+import { join as join13, resolve as resolve2 } from "path";
 import { cwd as cwd4 } from "process";
 import { mkdir as mkdir3 } from "fs/promises";
 
@@ -730,6 +730,15 @@ async function getDefaults() {
   const cache = await readCacheFile();
   return cache.defaults;
 }
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set(["clientSecret"]);
+function maskSensitiveFields(obj) {
+  return JSON.parse(
+    JSON.stringify(
+      obj,
+      (key, value) => SENSITIVE_KEYS.has(key) && typeof value === "string" && value.length > 0 ? "***" : value
+    )
+  );
+}
 var LEGACY_CONFIG_FILE = "standalone.json";
 async function readLegacyConfig(appDir) {
   try {
@@ -742,6 +751,50 @@ async function readLegacyConfig(appDir) {
   }
 }
 
+// src/utils/workspace-claude-md.ts
+import { join as join12 } from "path";
+import { writeFile as writeFile6 } from "fs/promises";
+async function writeWorkspaceClaudeMd(rootDir, manifest) {
+  const { product, applications } = manifest;
+  const coreDirName = `${product.name}-core`;
+  const appLines = applications.map(
+    (app) => `- \`${product.name}-${app.name}/\` \u2014 ${app.displayName}: ${app.description}`
+  );
+  const appSection = appLines.length > 0 ? `
+### Applications
+
+${appLines.join("\n")}
+` : "";
+  const content = `# ${product.displayName} Platform
+
+This is a **Blue Alba Platform** workspace for \`@${product.organization}\`.
+
+For any platform-related task, use the \`/platform\` skill \u2014 it routes to the correct specialized skill automatically.
+
+## Workspace Layout
+
+### Core
+
+- \`${coreDirName}/\` \u2014 Core monorepo (bootstrap service, customization UI, local dev environment)
+  - \`${coreDirName}/local/\` \u2014 Docker Compose files, .env, SSL certificates
+  - \`${coreDirName}/local/platform-docker-compose.yml\` \u2014 Platform infrastructure (nginx, postgres, gateway)
+  - \`${coreDirName}/local/${product.name}-core-docker-compose.yml\` \u2014 Core application services
+  - \`${coreDirName}/local/.env\` \u2014 Environment variables (shared by all applications)
+${appSection}
+## Common Commands
+
+\`\`\`sh
+platform install             # Install all monorepos
+platform start               # Start the full platform locally via Docker
+platform stop                # Stop all running containers
+platform status              # Show platform health and service status
+platform create-application  # Add a new application to this platform
+platform standalone          # Run a single application in isolation
+\`\`\`
+`;
+  await writeFile6(join12(rootDir, "CLAUDE.md"), content, "utf-8");
+}
+
 // src/commands/create-application/create-application.command.ts
 var CREATE_APPLICATION_COMMAND_NAME = "create-application";
 var createApplicationCommand = {
@@ -779,7 +832,7 @@ async function createApplication(params, logger) {
     platformName = manifest.product.name;
     organizationName = manifest.product.organization;
     const localPath = `../${platformName}-${applicationName}`;
-    applicationDir = resolve2(join12(rootDir, coreDirName), localPath);
+    applicationDir = resolve2(join13(rootDir, coreDirName), localPath);
   } else {
     if (!params.platformName || !params.organizationName) {
       logger.log("Error: platformName and organizationName are required when creating an application outside a platform.");
@@ -787,10 +840,10 @@ async function createApplication(params, logger) {
     }
     platformName = params.platformName;
     organizationName = params.organizationName;
-    applicationDir = join12(cwd4(), `${platformName}-${applicationName}`);
+    applicationDir = join13(cwd4(), `${platformName}-${applicationName}`);
   }
   const bootstrapServiceName = `${platformName}-${applicationName}-bootstrap-service`;
-  const bootstrapServiceDir = join12(applicationDir, "services", bootstrapServiceName);
+  const bootstrapServiceDir = join13(applicationDir, "services", bootstrapServiceName);
   logger.log(`Creating application monorepo "${applicationName}"...`);
   try {
     await scaffoldApplicationMonorepo(applicationDir, organizationName, platformName, applicationName, logger);
@@ -798,8 +851,8 @@ async function createApplication(params, logger) {
     logger.log(`Error: Could not scaffold application monorepo \u2014 ${formatError(err)}`);
     return;
   }
-  await mkdir3(join12(applicationDir, "services"), { recursive: true });
-  await mkdir3(join12(applicationDir, "ui"), { recursive: true });
+  await mkdir3(join13(applicationDir, "services"), { recursive: true });
+  await mkdir3(join13(applicationDir, "ui"), { recursive: true });
   logger.log(`Creating bootstrap service "${bootstrapServiceName}"...`);
   const bootstrapServiceBaseDir = `${platformName}-${applicationName}/services`;
   try {
@@ -833,7 +886,7 @@ async function createApplication(params, logger) {
   }
   if (hasUserInterface) {
     const uiName = `${platformName}-${applicationName}-ui`;
-    const uiDir = join12(applicationDir, "ui", uiName);
+    const uiDir = join13(applicationDir, "ui", uiName);
     const uiBaseDir = `${platformName}-${applicationName}/ui`;
     try {
       await scaffoldUiModule(uiDir, organizationName, platformName, applicationName, applicationDisplayName, uiBaseDir, logger);
@@ -844,7 +897,7 @@ async function createApplication(params, logger) {
   }
   if (hasBackendService) {
     const serviceName = `${platformName}-${applicationName}-service`;
-    const serviceDir = join12(applicationDir, "services", serviceName);
+    const serviceDir = join13(applicationDir, "services", serviceName);
     const serviceBaseDir = `${platformName}-${applicationName}/services`;
     try {
       await scaffoldNestjsService(serviceDir, organizationName, platformName, applicationName, applicationDisplayName, serviceBaseDir, logger);
@@ -853,7 +906,7 @@ async function createApplication(params, logger) {
       return;
     }
   }
-  const dockerComposePath = join12(applicationDir, "docker-compose.yml");
+  const dockerComposePath = join13(applicationDir, "docker-compose.yml");
   let uiPort;
   let servicePort;
   if (insidePlatform && localDir && manifest) {
@@ -889,6 +942,12 @@ async function createApplication(params, logger) {
     } catch (err) {
       logger.log(`Warning: Could not update product manifest \u2014 ${formatError(err)}`);
     }
+    try {
+      await writeWorkspaceClaudeMd(rootDir, updatedManifest);
+      logger.log(`Updated workspace CLAUDE.md.`);
+    } catch (err) {
+      logger.log(`Warning: Could not update workspace CLAUDE.md \u2014 ${formatError(err)}`);
+    }
   } else {
     try {
       await saveDefaults({ platformName, organizationName });
@@ -906,7 +965,7 @@ async function createApplication(params, logger) {
 }
 
 // src/commands/init/init.command.ts
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { cwd as cwd5 } from "process";
 
 // src/utils/string.ts
@@ -916,8 +975,8 @@ function camelize(name) {
 
 // src/commands/init/scaffold-platform.ts
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { join as join13, dirname as dirname8 } from "path";
-var templateDir = join13(
+import { join as join14, dirname as dirname8 } from "path";
+var templateDir = join14(
   dirname8(fileURLToPath6(import.meta.url)),
   "..",
   "templates",
@@ -929,8 +988,8 @@ async function scaffoldPlatform(outputDir, variables, logger) {
 
 // src/commands/init/scaffold-platform-bootstrap.ts
 import { fileURLToPath as fileURLToPath7 } from "url";
-import { join as join14, dirname as dirname9 } from "path";
-var templateDir2 = join14(
+import { join as join15, dirname as dirname9 } from "path";
+var templateDir2 = join15(
   dirname9(fileURLToPath7(import.meta.url)),
   "..",
   "templates",
@@ -942,8 +1001,8 @@ async function scaffoldPlatformBootstrap(outputDir, variables, logger) {
 
 // src/commands/init/scaffold-customization-ui.ts
 import { fileURLToPath as fileURLToPath8 } from "url";
-import { join as join15, dirname as dirname10 } from "path";
-var templateDir3 = join15(
+import { join as join16, dirname as dirname10 } from "path";
+var templateDir3 = join16(
   dirname10(fileURLToPath8(import.meta.url)),
   "..",
   "templates",
@@ -954,10 +1013,10 @@ async function scaffoldCustomizationUi(outputDir, variables, logger) {
 }
 
 // src/commands/init/register-customization-module.ts
-import { join as join16 } from "path";
-import { readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
+import { join as join17 } from "path";
+import { readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
 async function registerCustomizationModule(bootstrapServiceDir, organizationName, logger, platformName = "platform") {
-  const modulesJsonPath = join16(bootstrapServiceDir, "src", "data", "platform", "modules.json");
+  const modulesJsonPath = join17(bootstrapServiceDir, "src", "data", "platform", "modules.json");
   const customizationUiName = `${platformName}-customization-ui`;
   const entry = {
     name: `@${organizationName}/${customizationUiName}`,
@@ -975,13 +1034,13 @@ async function registerCustomizationModule(bootstrapServiceDir, organizationName
   };
   const existing = JSON.parse(await readFile6(modulesJsonPath, "utf-8"));
   existing.push(entry);
-  await writeFile6(modulesJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  await writeFile7(modulesJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   logger.log(`Registered customization module in ${modulesJsonPath}`);
 }
 
 // src/commands/init/generate-local-env.ts
-import { readFile as readFile7, writeFile as writeFile7 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import { join as join18 } from "path";
 
 // src/utils/random.ts
 import { randomBytes } from "crypto";
@@ -991,14 +1050,14 @@ function generateRandomSecret() {
 
 // src/commands/init/generate-local-env.ts
 async function generateLocalEnv(outputDir, logger, coreDirName = "core") {
-  const examplePath = join17(outputDir, coreDirName, "local", ".env.example");
-  const envPath = join17(outputDir, coreDirName, "local", ".env");
+  const examplePath = join18(outputDir, coreDirName, "local", ".env.example");
+  const envPath = join18(outputDir, coreDirName, "local", ".env");
   logger.log(`Generating ${coreDirName}/local/.env with random secrets...`);
   const content = await readFile7(examplePath, "utf-8");
   const result = content.replace(/^(PAE_AUTH_JWT_SECRET|PAE_GATEWAY_SERVICE_ACCESS_SECRET|PAE_DB_PASSWORD)=$/gm, (_, key) => {
     return `${key}=${generateRandomSecret()}`;
   });
-  await writeFile7(envPath, result, "utf-8");
+  await writeFile8(envPath, result, "utf-8");
 }
 
 // src/commands/init/init.command.ts
@@ -1044,17 +1103,24 @@ async function init(params, logger) {
     logger.log(`Error: Could not generate ${coreDirName}/local/.env \u2014 ${formatError(err)}`);
     return;
   }
+  let manifest;
   try {
-    const manifest = createInitialManifest({ organizationName, platformName, platformDisplayName });
+    manifest = createInitialManifest({ organizationName, platformName, platformDisplayName });
     await writeManifest(manifest, outputDir, coreDirName);
     logger.log(`Created product manifest: ${coreDirName}/product.manifest.json`);
   } catch (err) {
     logger.log(`Error: Could not write product manifest \u2014 ${formatError(err)}`);
     return;
   }
+  try {
+    await writeWorkspaceClaudeMd(outputDir, manifest);
+    logger.log(`Created workspace CLAUDE.md`);
+  } catch (err) {
+    logger.log(`Warning: Could not write workspace CLAUDE.md \u2014 ${formatError(err)}`);
+  }
   try {
     await scaffoldPlatformBootstrap(
-      join18(outputDir, coreDirName, "services", bootstrapServiceName),
+      join19(outputDir, coreDirName, "services", bootstrapServiceName),
       variables,
       logger
     );
@@ -1064,7 +1130,7 @@ async function init(params, logger) {
   }
   try {
     await scaffoldCustomizationUi(
-      join18(outputDir, coreDirName, "ui", customizationUiName),
+      join19(outputDir, coreDirName, "ui", customizationUiName),
       variables,
       logger
     );
@@ -1074,7 +1140,7 @@ async function init(params, logger) {
   }
   try {
     await registerCustomizationModule(
-      join18(outputDir, coreDirName, "services", bootstrapServiceName),
+      join19(outputDir, coreDirName, "services", bootstrapServiceName),
       organizationName,
       logger,
       platformName
@@ -1087,7 +1153,7 @@ async function init(params, logger) {
 }
 
 // src/commands/configure-idp/configure-idp.command.ts
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { fetch as undiciFetch, Agent } from "undici";
 
 // src/utils/env-reader.ts
@@ -1171,7 +1237,7 @@ async function configureIdp(params, logger) {
     logger.log("Error: Cannot configure an IDP \u2014 no platform initialized in this directory.");
     return;
   }
-  const envPath = join19(layout.localDir, ".env");
+  const envPath = join20(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -1223,13 +1289,13 @@ async function configureIdp(params, logger) {
 }
 
 // src/commands/create-service-module/create-service-module.command.ts
-import { join as join21, resolve as resolve3 } from "path";
-import { access as access4 } from "fs/promises";
+import { join as join22, resolve as resolve3 } from "path";
+import { access as access5 } from "fs/promises";
 
 // src/commands/create-service-module/scaffold-service-module.ts
 import { fileURLToPath as fileURLToPath9 } from "url";
-import { join as join20, dirname as dirname11 } from "path";
-var nestjsServiceModuleTemplateDir2 = join20(
+import { join as join21, dirname as dirname11 } from "path";
+var nestjsServiceModuleTemplateDir2 = join21(
   dirname11(fileURLToPath9(import.meta.url)),
   "..",
   "templates",
@@ -1264,7 +1330,7 @@ function buildCustomServiceModuleEntry(organizationName, serviceName, serviceDis
 }
 
 // src/commands/create-service-module/append-docker-compose.ts
-import { readFile as readFile9, writeFile as writeFile8 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
 async function appendServiceToDockerCompose(dockerComposePath, serviceName, platformName, applicationName, port, logger) {
   const block = `
   ${serviceName}:
@@ -1280,7 +1346,7 @@ async function appendServiceToDockerCompose(dockerComposePath, serviceName, plat
 `;
   try {
     const existing = await readFile9(dockerComposePath, "utf-8");
-    await writeFile8(dockerComposePath, existing + block, "utf-8");
+    await writeFile9(dockerComposePath, existing + block, "utf-8");
     logger.log(`Updated docker-compose: ${dockerComposePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -1288,6 +1354,46 @@ async function appendServiceToDockerCompose(dockerComposePath, serviceName, plat
   }
 }
 
+// src/commands/pipelines/update-azure-pipeline-services.ts
+import { readFile as readFile10, writeFile as writeFile10, access as access4 } from "fs/promises";
+var END_MARKER = "# platform-cli:managed-services-end";
+async function addServiceToAzurePipeline(pipelinePath, serviceName, serviceFolder, logger) {
+  try {
+    await access4(pipelinePath);
+  } catch {
+    return;
+  }
+  let content;
+  try {
+    content = await readFile10(pipelinePath, "utf-8");
+  } catch (err) {
+    logger.log(`Warning: Could not read Azure pipeline file \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  if (!content.includes(END_MARKER)) {
+    logger.log(`Warning: Azure pipeline file does not contain managed services markers \u2014 skipping automatic update.`);
+    logger.log(`Add the service manually to .azuredevops/azure-pipeline.yml`);
+    return;
+  }
+  if (content.includes(`- name: ${serviceName}`)) {
+    logger.log(`Service "${serviceName}" is already listed in the Azure pipeline \u2014 skipping.`);
+    return;
+  }
+  const newEntry = `        - name: ${serviceName}
+          folder: ${serviceFolder}
+`;
+  const updated = content.replace(
+    `        ${END_MARKER}`,
+    `${newEntry}        ${END_MARKER}`
+  );
+  try {
+    await writeFile10(pipelinePath, updated, "utf-8");
+    logger.log(`Updated Azure pipeline: added "${serviceName}" to services list.`);
+  } catch (err) {
+    logger.log(`Warning: Could not update Azure pipeline \u2014 ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 // src/commands/create-service-module/create-service-module.command.ts
 var CREATE_SERVICE_MODULE_COMMAND_NAME = "create-service-module";
 var createServiceModuleCommand = {
@@ -1316,18 +1422,18 @@ async function createServiceModule(params, logger) {
     logger.log(`Error: The specified application "${applicationName}" is not registered in the product manifest.`);
     return;
   }
-  const applicationDir = resolve3(join21(rootDir, coreDirName), appEntry.localPath);
+  const applicationDir = resolve3(join22(rootDir, coreDirName), appEntry.localPath);
   try {
-    await access4(applicationDir);
+    await access5(applicationDir);
   } catch {
     logger.log(`Error: The specified application "${applicationName}" does not exist in the platform.`);
     return;
   }
   const suffix = serviceNameSuffix === void 0 ? "service" : serviceNameSuffix;
   const fullServiceName = suffix ? `${platformName}-${serviceName}-${suffix}` : `${platformName}-${serviceName}`;
-  const serviceDir = join21(applicationDir, "services", fullServiceName);
+  const serviceDir = join22(applicationDir, "services", fullServiceName);
   try {
-    await access4(serviceDir);
+    await access5(serviceDir);
     logger.log(`Error: A service named "${fullServiceName}" already exists in application "${applicationName}".`);
     return;
   } catch {
@@ -1346,21 +1452,23 @@ async function createServiceModule(params, logger) {
     logger.log(`Error: Could not scaffold NestJS service \u2014 ${formatError(err)}`);
     return;
   }
-  const bootstrapServiceDir = join21(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
+  const bootstrapServiceDir = join22(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
   const moduleEntry = buildCustomServiceModuleEntry(organizationName, fullServiceName, serviceDisplayName);
   await addModuleEntry(bootstrapServiceDir, applicationName, moduleEntry, logger);
-  const dockerComposePath = join21(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  const dockerComposePath = join22(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
   const port = await getNextAvailablePort(localDir);
   await appendServiceToDockerCompose(dockerComposePath, fullServiceName, platformName, applicationName, port, logger);
+  const azurePipelinePath = join22(applicationDir, ".azuredevops", "azure-pipeline.yml");
+  await addServiceToAzurePipeline(azurePipelinePath, fullServiceName, `services/${fullServiceName}`, logger);
   logger.log(`Done! Service module "${fullServiceName}" added to application "${applicationName}".`);
 }
 
 // src/commands/create-ui-module/create-ui-module.command.ts
-import { join as join22, resolve as resolve4 } from "path";
-import { access as access5, readdir as readdir4 } from "fs/promises";
+import { join as join23, resolve as resolve4 } from "path";
+import { access as access6, readdir as readdir4 } from "fs/promises";
 
 // src/commands/create-ui-module/append-ui-docker-compose.ts
-import { readFile as readFile10, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile11, writeFile as writeFile11 } from "fs/promises";
 async function appendUiToDockerCompose(dockerComposePath, platformName, applicationName, port, logger, uiNameOverride) {
   const uiName = uiNameOverride ?? `${platformName}-${applicationName}-ui`;
   const block = `
@@ -1374,8 +1482,8 @@ async function appendUiToDockerCompose(dockerComposePath, platformName, applicat
       - \${PWD}/:/app/out
 `;
   try {
-    const existing = await readFile10(dockerComposePath, "utf-8");
-    await writeFile9(dockerComposePath, existing + block, "utf-8");
+    const existing = await readFile11(dockerComposePath, "utf-8");
+    await writeFile11(dockerComposePath, existing + block, "utf-8");
     logger.log(`Updated docker-compose: ${dockerComposePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -1411,14 +1519,14 @@ async function createUiModule(params, logger) {
     logger.log(`Error: The specified application "${applicationName}" is not registered in the product manifest.`);
     return;
   }
-  const applicationDir = resolve4(join22(rootDir, coreDirName), appEntry.localPath);
+  const applicationDir = resolve4(join23(rootDir, coreDirName), appEntry.localPath);
   try {
-    await access5(applicationDir);
+    await access6(applicationDir);
   } catch {
     logger.log(`Error: The specified application "${applicationName}" does not exist in the platform.`);
     return;
   }
-  const uiDir = join22(applicationDir, "ui");
+  const uiDir = join23(applicationDir, "ui");
   try {
     const uiEntries = await readdir4(uiDir);
     const existingUiModules = uiEntries.filter((e) => e !== ".gitkeep");
@@ -1430,7 +1538,7 @@ async function createUiModule(params, logger) {
   }
   const uiSuffix = uiModuleSuffix === void 0 ? "ui" : uiModuleSuffix;
   const uiName = uiSuffix ? `${platformName}-${applicationName}-${uiSuffix}` : `${platformName}-${applicationName}`;
-  const uiOutputDir = join22(uiDir, uiName);
+  const uiOutputDir = join23(uiDir, uiName);
   const uiBaseDir = `${platformName}-${applicationName}/ui`;
   try {
     await scaffoldUiModule(uiOutputDir, organizationName, platformName, applicationName, applicationDisplayName, uiBaseDir, logger);
@@ -1438,25 +1546,27 @@ async function createUiModule(params, logger) {
     logger.log(`Error: Could not scaffold UI module \u2014 ${formatError(err)}`);
     return;
   }
-  const bootstrapServiceDir = join22(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
+  const bootstrapServiceDir = join23(applicationDir, "services", `${platformName}-${applicationName}-bootstrap-service`);
   const moduleEntry = buildUiModuleEntry(organizationName, platformName, applicationName, applicationDisplayName, uiName);
   await addModuleEntry(bootstrapServiceDir, applicationName, moduleEntry, logger);
-  const dockerComposePath = join22(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  const dockerComposePath = join23(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
   const port = await getNextAvailablePort(localDir);
   await appendUiToDockerCompose(dockerComposePath, platformName, applicationName, port, logger, uiName);
+  const azurePipelinePath = join23(applicationDir, ".azuredevops", "azure-pipeline.yml");
+  await addServiceToAzurePipeline(azurePipelinePath, uiName, `ui/${uiName}`, logger);
   logger.log(`Done! UI module "${uiName}" added to application "${applicationName}".`);
 }
 
 // src/commands/status/status-checks.ts
 import { spawn as spawn3 } from "child_process";
-import { access as access8 } from "fs/promises";
-import { join as join25, resolve as resolve7 } from "path";
+import { access as access9 } from "fs/promises";
+import { join as join26, resolve as resolve7 } from "path";
 import { fetch as undiciFetch2, Agent as Agent2 } from "undici";
 
 // src/commands/local-scripts/docker-compose-orchestrator.ts
 import { spawn } from "child_process";
-import { access as access6 } from "fs/promises";
-import { join as join23, resolve as resolve5 } from "path";
+import { access as access7, readFile as readFile12, writeFile as writeFile12 } from "fs/promises";
+import { dirname as dirname12, join as join24, resolve as resolve5 } from "path";
 function runDockerCompose(args2, logger, rootDir, signal) {
   return new Promise((resolvePromise) => {
     const child = spawn("docker", ["compose", ...args2], {
@@ -1519,25 +1629,38 @@ function captureDockerCompose(args2, rootDir) {
     child.on("error", (err) => reject(err));
   });
 }
+async function generateProxyAppCompose(appDir, localDir, platformName, applicationName) {
+  const appComposePath = join24(appDir, "docker-compose.yml");
+  const content = await readFile12(appComposePath, "utf-8");
+  const withAbsContexts = content.replace(
+    /^(\s+context:\s+)\.\/(.*)$/gm,
+    `$1${appDir}/$2`
+  );
+  const appParentDir = dirname12(appDir);
+  const rewritten = withAbsContexts.replace(/\$\{PWD\}/g, appParentDir);
+  const proxyPath = join24(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  await writeFile12(proxyPath, rewritten, "utf-8");
+  return proxyPath;
+}
 async function getAppComposePaths(localDir, coreDir, platformName, manifest, logger) {
   const results = [];
   for (const app of manifest.applications) {
-    const appDir = resolve5(join23(coreDir), app.localPath);
-    const newPath = join23(appDir, "docker-compose.yml");
-    const legacyPrefixedPath = join23(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const legacyUnprefixedPath = join23(localDir, `${app.name}-docker-compose.yml`);
+    const appDir = resolve5(join24(coreDir), app.localPath);
+    const newPath = join24(appDir, "docker-compose.yml");
+    const legacyPrefixedPath = join24(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const legacyUnprefixedPath = join24(localDir, `${app.name}-docker-compose.yml`);
     let resolved = null;
     try {
-      await access6(newPath);
-      resolved = newPath;
+      await access7(newPath);
+      resolved = await generateProxyAppCompose(appDir, localDir, platformName, app.name);
     } catch {
       try {
-        await access6(legacyPrefixedPath);
+        await access7(legacyPrefixedPath);
         resolved = legacyPrefixedPath;
         logger?.log(`Warning: docker-compose for "${app.name}" found in legacy location (core/local/). Consider moving it to the app monorepo root.`);
       } catch {
         try {
-          await access6(legacyUnprefixedPath);
+          await access7(legacyUnprefixedPath);
           resolved = legacyUnprefixedPath;
           logger?.log(`Warning: docker-compose for "${app.name}" found in legacy location (core/local/). Consider moving it to the app monorepo root.`);
         } catch {
@@ -1553,18 +1676,18 @@ async function getAppComposePaths(localDir, coreDir, platformName, manifest, log
 async function buildFullComposeArgs(layout, manifest, logger) {
   const { coreDirName, localDir, coreDir } = layout;
   const platformName = manifest.product.name;
-  const prefixedCoreCompose = join23(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCoreCompose = join23(localDir, "core-docker-compose.yml");
+  const prefixedCoreCompose = join24(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCoreCompose = join24(localDir, "core-docker-compose.yml");
   let coreComposePath;
   try {
-    await access6(prefixedCoreCompose);
+    await access7(prefixedCoreCompose);
     coreComposePath = prefixedCoreCompose;
   } catch {
     coreComposePath = unprefixedCoreCompose;
   }
   const fileArgs = [
     "-f",
-    join23(localDir, "platform-docker-compose.yml"),
+    join24(localDir, "platform-docker-compose.yml"),
     "-f",
     coreComposePath
   ];
@@ -1584,16 +1707,16 @@ async function buildSelectedComposeFiles(layout, selectedManifest, includeCore)
   const platformName = selectedManifest.product.name;
   const files = [];
   if (includeCore) {
-    const prefixedCoreCompose = join23(localDir, `${coreDirName}-docker-compose.yml`);
-    const unprefixedCoreCompose = join23(localDir, "core-docker-compose.yml");
+    const prefixedCoreCompose = join24(localDir, `${coreDirName}-docker-compose.yml`);
+    const unprefixedCoreCompose = join24(localDir, "core-docker-compose.yml");
     let coreComposePath;
     try {
-      await access6(prefixedCoreCompose);
+      await access7(prefixedCoreCompose);
       coreComposePath = prefixedCoreCompose;
     } catch {
       coreComposePath = unprefixedCoreCompose;
     }
-    files.push(join23(localDir, "platform-docker-compose.yml"), coreComposePath);
+    files.push(join24(localDir, "platform-docker-compose.yml"), coreComposePath);
   }
   const appEntries = await getAppComposePaths(localDir, coreDir, platformName, selectedManifest);
   for (const { composePath } of appEntries) {
@@ -1637,7 +1760,7 @@ async function getServicesFromComposeFiles(selectedFiles, allFiles, rootDir) {
 async function startEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1659,7 +1782,7 @@ async function startEnvironment(layout, manifest, logger, signal, includeCore =
 async function stopEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1681,7 +1804,7 @@ async function stopEnvironment(layout, manifest, logger, signal, includeCore = t
 async function resetEnvironment(layout, manifest, logger, signal) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const fileArgs = await buildFullComposeArgs(layout, manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
   await runDockerCompose([...projectArgs, ...fileArgs, "down", "-v"], logger, rootDir, signal);
@@ -1689,7 +1812,7 @@ async function resetEnvironment(layout, manifest, logger, signal) {
 async function destroyEnvironment(layout, manifest, logger, signal, includeCore = true, fullManifest, removeImages = true) {
   const { rootDir, localDir } = layout;
   const platformName = manifest.product.name;
-  const envFile = join23(localDir, ".env");
+  const envFile = join24(localDir, ".env");
   const isSelective = fullManifest !== void 0;
   const fileArgs = await buildFullComposeArgs(layout, isSelective ? fullManifest : manifest, logger);
   const projectArgs = ["-p", `${platformName}-platform`, "--project-directory", localDir, "--env-file", envFile];
@@ -1715,8 +1838,8 @@ async function destroyEnvironment(layout, manifest, logger, signal, includeCore
 
 // src/commands/local-scripts/npm-orchestrator.ts
 import { spawn as spawn2 } from "child_process";
-import { access as access7 } from "fs/promises";
-import { resolve as resolve6, join as join24 } from "path";
+import { access as access8 } from "fs/promises";
+import { resolve as resolve6, join as join25 } from "path";
 function runCommand(command, args2, workDir, logger, signal) {
   return new Promise((resolvePromise) => {
     const child = spawn2(command, args2, {
@@ -1763,7 +1886,7 @@ function runCommand(command, args2, workDir, logger, signal) {
 }
 async function dirExists(dirPath) {
   try {
-    await access7(dirPath);
+    await access8(dirPath);
     return true;
   } catch {
     return false;
@@ -1773,7 +1896,7 @@ async function installDependencies(layout, manifest, logger, signal, includeCore
   const { coreDir, coreDirName } = layout;
   const appDirs = [];
   for (const app of manifest.applications) {
-    const appDir = resolve6(join24(coreDir), app.localPath);
+    const appDir = resolve6(join25(coreDir), app.localPath);
     if (!await dirExists(appDir)) {
       logger.log(`Warning: Application directory "${app.name}" not found at ${appDir} \u2014 skipping install.`);
       continue;
@@ -1799,7 +1922,7 @@ async function buildAll(layout, manifest, logger, signal, includeCore = true) {
   }
   const appDirs = [];
   for (const app of manifest.applications) {
-    const appDir = resolve6(join24(coreDir), app.localPath);
+    const appDir = resolve6(join25(coreDir), app.localPath);
     if (!await dirExists(appDir)) {
       logger.log(`Warning: Application directory "${app.name}" not found at ${appDir} \u2014 skipping build.`);
       continue;
@@ -1936,7 +2059,7 @@ function spawnCapture(cmd, args2, cwd11) {
 }
 async function pathExists(p) {
   try {
-    await access8(p);
+    await access9(p);
     return true;
   } catch {
     return false;
@@ -1980,13 +2103,13 @@ async function checkInstalled(layout, manifest) {
   const results = [];
   const coreCheck = {
     name: layout.coreDirName,
-    path: join25(layout.coreDir, "node_modules"),
-    exists: await pathExists(join25(layout.coreDir, "node_modules"))
+    path: join26(layout.coreDir, "node_modules"),
+    exists: await pathExists(join26(layout.coreDir, "node_modules"))
   };
   results.push(coreCheck);
   for (const app of manifest.applications) {
     const appDir = resolve7(layout.coreDir, app.localPath);
-    const nodeModulesPath = join25(appDir, "node_modules");
+    const nodeModulesPath = join26(appDir, "node_modules");
     results.push({
       name: app.name,
       path: nodeModulesPath,
@@ -1997,7 +2120,7 @@ async function checkInstalled(layout, manifest) {
 }
 async function checkBuilt(layout, manifest) {
   const results = [];
-  const coreTurboPath = join25(layout.coreDir, ".turbo");
+  const coreTurboPath = join26(layout.coreDir, ".turbo");
   results.push({
     name: layout.coreDirName,
     path: coreTurboPath,
@@ -2005,7 +2128,7 @@ async function checkBuilt(layout, manifest) {
   });
   for (const app of manifest.applications) {
     const appDir = resolve7(layout.coreDir, app.localPath);
-    const appTurboPath = join25(appDir, ".turbo");
+    const appTurboPath = join26(appDir, ".turbo");
     results.push({
       name: app.name,
       path: appTurboPath,
@@ -2017,13 +2140,13 @@ async function checkBuilt(layout, manifest) {
 async function resolveComposeFiles(layout, manifest) {
   const { localDir, coreDirName } = layout;
   const platformName = manifest.product.name;
-  const files = [join25(localDir, "platform-docker-compose.yml")];
-  const prefixedCore = join25(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCore = join25(localDir, "core-docker-compose.yml");
+  const files = [join26(localDir, "platform-docker-compose.yml")];
+  const prefixedCore = join26(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCore = join26(localDir, "core-docker-compose.yml");
   files.push(await pathExists(prefixedCore) ? prefixedCore : unprefixedCore);
   for (const app of manifest.applications) {
-    const prefixed = join25(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const unprefixed = join25(localDir, `${app.name}-docker-compose.yml`);
+    const prefixed = join26(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const unprefixed = join26(localDir, `${app.name}-docker-compose.yml`);
     if (await pathExists(prefixed)) files.push(prefixed);
     else if (await pathExists(unprefixed)) files.push(unprefixed);
   }
@@ -2129,15 +2252,15 @@ async function getServicesForComposeFiles(selectedFiles, allFiles, rootDir) {
 async function checkContainersPerApp(layout, manifest, allContainers) {
   const { localDir, coreDirName, rootDir } = layout;
   const platformName = manifest.product.name;
-  const prefixedCore = join25(localDir, `${coreDirName}-docker-compose.yml`);
-  const unprefixedCore = join25(localDir, "core-docker-compose.yml");
+  const prefixedCore = join26(localDir, `${coreDirName}-docker-compose.yml`);
+  const unprefixedCore = join26(localDir, "core-docker-compose.yml");
   const coreComposePath = await pathExists(prefixedCore) ? prefixedCore : unprefixedCore;
-  const platformComposePath = join25(localDir, "platform-docker-compose.yml");
+  const platformComposePath = join26(localDir, "platform-docker-compose.yml");
   const allFiles = [platformComposePath, coreComposePath];
   const appComposeMap = /* @__PURE__ */ new Map();
   for (const app of manifest.applications) {
-    const prefixed = join25(localDir, `${platformName}-${app.name}-docker-compose.yml`);
-    const unprefixed = join25(localDir, `${app.name}-docker-compose.yml`);
+    const prefixed = join26(localDir, `${platformName}-${app.name}-docker-compose.yml`);
+    const unprefixed = join26(localDir, `${app.name}-docker-compose.yml`);
     if (await pathExists(prefixed)) {
       appComposeMap.set(app.name, prefixed);
       allFiles.push(prefixed);
@@ -2184,7 +2307,7 @@ async function checkContainersPerApp(layout, manifest, allContainers) {
   return groups;
 }
 async function checkIdpProviders(layout) {
-  const envPath = join25(layout.localDir, ".env");
+  const envPath = join26(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -2303,7 +2426,7 @@ var statusCommand = {
 };
 
 // src/commands/manage-platform-admins/manage-platform-admins.command.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { fetch as undiciFetch3, Agent as Agent3 } from "undici";
 var MANAGE_PLATFORM_ADMINS_COMMAND_NAME = "manage-platform-admins";
 var managePlatformAdminsCommand = {
@@ -2317,7 +2440,7 @@ async function getGatewayConfig(logger) {
     logger.log("Error: Cannot manage platform admins \u2014 no platform initialized in this directory.");
     return null;
   }
-  const envPath = join26(layout.localDir, ".env");
+  const envPath = join27(layout.localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -2439,59 +2562,59 @@ async function removePlatformAdmin(ruleId, logger) {
 var baPlatformPlugin = {
   name: "ba-platform-plugin",
   description: "Blue Alba Platform knowledge and CLI skills for AI assistants",
-  version: "1.1.0",
+  version: "1.2.0",
   skills: [
     {
       name: "platform",
-      description: "Comprehensive Blue Alba Platform architecture and concepts knowledge",
+      description: "Blue Alba Platform orchestrator \u2014 routes to the correct specialized skill or answers general architecture questions. Use this skill for ANY platform-related request.",
       type: "skill",
       sourceFile: "skills/ba-platform/platform.skill.md"
     },
     {
       name: "platform-cli",
-      description: "Blue Alba Platform CLI commands and usage knowledge",
+      description: "Blue Alba Platform CLI commands, usage, installation, and headless mode reference",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-cli.skill.md"
     },
     {
       name: "platform-add-operation",
-      description: "Defines a new authorization operation in the bootstrap service, assigns it to a role, and adds access guards in the React UI or NestJS backend",
+      description: "Adds an authorization operation (permission/RBAC guard) to a bootstrap service and enforces it in UI or backend routes",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-add-operation.skill.md"
     },
     {
       name: "platform-add-feature-flag",
-      description: "Declares a feature flag in the bootstrap service and adds its usage in a React UI component or NestJS service",
+      description: "Declares a feature flag in a bootstrap service and gates a React component or NestJS endpoint behind it",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-add-feature-flag.skill.md"
     },
     {
       name: "platform-add-scheduled-job",
-      description: "Adds a scheduled job to a Blue Alba Platform bootstrap service",
+      description: "Adds a cron-scheduled job to a bootstrap service to run a backend endpoint on a recurring schedule",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-add-scheduled-job.skill.md"
     },
     {
       name: "platform-add-menu-item",
-      description: "Adds a new page and menu item to a Blue Alba Platform single-spa UI module",
+      description: "Creates a new page component and wires it as a menu item/route in a single-spa UI module",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-add-menu-item.skill.md"
     },
     {
       name: "platform-extend-shell",
-      description: "Injects a custom component into a Blue Alba Platform shell extension point",
+      description: "Injects a custom component into a shell extension point (navbar, branding, user section)",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-extend-shell.skill.md"
     },
     {
       name: "platform-add-presence",
-      description: "Adds real-time user presence via the Rooms API to a Blue Alba Platform app",
+      description: "Adds real-time user presence (live avatars, who-is-viewing) to a component using the Rooms API",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-add-presence.skill.md"
     },
     {
       name: "platform-scaffold-module",
-      description: "Scaffolds a new UI module or service module using the platform CLI",
+      description: "Scaffolds a new UI module or NestJS service module in a platform monorepo using the CLI",
       type: "skill",
       sourceFile: "skills/ba-platform/platform-scaffold-module.skill.md"
     }
@@ -2602,6 +2725,132 @@ var standaloneConfigListCommand = {
   hidden: () => false
 };
 
+// src/commands/pipelines/generate-github-pipeline.ts
+import { fileURLToPath as fileURLToPath10 } from "url";
+import { dirname as dirname13, join as join28 } from "path";
+
+// src/commands/pipelines/github-secrets-checklist.ts
+var GITHUB_VARS_CHECKLIST = [
+  "DOCKER_PUSH_TO_ACR \u2014 (variable) true/false, push to Azure Container Registry",
+  "DOCKER_PUSH_TO_ECR \u2014 (variable) true/false, push to Amazon ECR",
+  "DOCKER_PUSH_TO_BA_ARTIFACTORY \u2014 (variable) true/false, push to Blue Alba Artifactory",
+  "DOCKER_REPOSITORY_URL \u2014 (variable) URL of the Docker registry",
+  "DOCKER_IMAGE_ARCHS \u2014 (variable) target architectures (e.g. linux/amd64,linux/arm64)"
+];
+var GITHUB_SECRETS_CHECKLIST = [
+  "DOCKER_USER \u2014 Docker registry username",
+  "DOCKER_PASSWORD \u2014 Docker registry password",
+  "NPM_AUTH_TOKEN \u2014 Blue Alba private npm registry token",
+  "NPMJS_AUTH_TOKEN \u2014 npmjs.org registry token",
+  "WORKFLOW_REPOSITORY_RO_SSH_KEY \u2014 read-only SSH key for Blue-Alba-Platform/workflows repo",
+  "WORKFLOWS_STATE_ID_PAT \u2014 PAT for reading artifacts (state file) between branches"
+];
+
+// src/commands/pipelines/generate-github-pipeline.ts
+var __dirname = dirname13(fileURLToPath10(import.meta.url));
+async function generateGithubPipeline(params, logger) {
+  const templateDir4 = join28(__dirname, "..", "templates", "github-pipeline-template");
+  await applyTemplate(
+    {
+      templateDir: templateDir4,
+      outputDir: params.rootDir,
+      variables: {
+        stateFile: params.stateFile,
+        codeFolderList: params.codeFolderList,
+        packagesFolderPattern: params.packagesFolderPattern
+      }
+    },
+    (message) => logger.log(message)
+  );
+  logger.log("");
+  logger.log("GitHub Actions pipeline generated: .github/workflows/build-platform.yml");
+  logger.log("");
+  logger.log("Action required \u2014 configure the following in your GitHub repo (Settings > Secrets and variables):");
+  logger.log("");
+  logger.log("Variables:");
+  for (const item of GITHUB_VARS_CHECKLIST) {
+    logger.log(`  \u2022 ${item}`);
+  }
+  logger.log("");
+  logger.log("Secrets:");
+  for (const item of GITHUB_SECRETS_CHECKLIST) {
+    logger.log(`  \u2022 ${item}`);
+  }
+}
+
+// src/commands/pipelines/generate-azure-pipeline.ts
+import { fileURLToPath as fileURLToPath11 } from "url";
+import { dirname as dirname14, join as join29 } from "path";
+var __dirname2 = dirname14(fileURLToPath11(import.meta.url));
+function buildServicesList(services) {
+  if (services.length === 0) return "";
+  return services.map((s) => `        - name: ${s.name}
+          folder: ${s.folder}
+`).join("");
+}
+async function generateAzurePipeline(params, logger) {
+  const templateDir4 = join29(__dirname2, "..", "templates", "azure-pipeline-template");
+  const servicesList = buildServicesList(params.services);
+  await applyTemplate(
+    {
+      templateDir: templateDir4,
+      outputDir: params.rootDir,
+      variables: {
+        azureServiceConnection: params.azureServiceConnection,
+        acrLoginServer: params.acrLoginServer,
+        nodeVersion: params.nodeVersion,
+        templatesRepoName: params.templatesRepoName,
+        gitopsRepoName: params.gitopsRepoName,
+        servicesList
+      }
+    },
+    (message) => logger.log(message)
+  );
+  logger.log("Azure DevOps pipeline generated: .azuredevops/azure-pipeline.yml");
+}
+
+// src/commands/pipelines/pipelines.command.ts
+var PIPELINES_COMMAND_NAME = "pipelines";
+var pipelinesCommand = {
+  name: PIPELINES_COMMAND_NAME,
+  description: "Generate CI/CD pipeline files for the platform monorepo",
+  hidden: (ctx) => !ctx.platformInitialized
+};
+async function generatePipelines(params, logger) {
+  for (const target of params.targets) {
+    logger.log(`
+Generating ${params.provider} pipeline for ${target.name}...`);
+    if (params.provider === "github") {
+      await generateGithubPipeline(
+        {
+          rootDir: target.dir,
+          stateFile: params.stateFile ?? target.name,
+          codeFolderList: params.codeFolderList ?? "apps/**,services/**",
+          packagesFolderPattern: params.packagesFolderPattern ?? "packages/**"
+        },
+        logger
+      );
+      continue;
+    }
+    if (params.provider === "azure") {
+      await generateAzurePipeline(
+        {
+          rootDir: target.dir,
+          azureServiceConnection: params.azureServiceConnection ?? "",
+          acrLoginServer: params.acrLoginServer ?? "",
+          nodeVersion: params.nodeVersion ?? "22.x",
+          templatesRepoName: params.templatesRepoName ?? "azure-pipeline-ba-template",
+          gitopsRepoName: params.gitopsRepoName ?? "portainer-deployments",
+          services: target.services ?? []
+        },
+        logger
+      );
+      continue;
+    }
+    logger.log(`Error: Unknown provider "${params.provider}". Use "github" or "azure".`);
+  }
+}
+
 // src/commands/registry.ts
 var CommandRegistry = class {
   commands = /* @__PURE__ */ new Map();
@@ -2649,6 +2898,7 @@ registry.register(standaloneConfigShowCommand);
 registry.register(standaloneConfigSetCommand);
 registry.register(standaloneConfigDeleteCommand);
 registry.register(standaloneConfigListCommand);
+registry.register(pipelinesCommand);
 
 // src/app-state.ts
 var APP_STATE = {
@@ -2711,6 +2961,145 @@ async function initService(params, logger) {
   await init(params, logger);
 }
 
+// src/services/pipelines.service.ts
+async function pipelinesService(params, logger) {
+  await generatePipelines(params, logger);
+}
+
+// src/commands/pipelines/build-target-list.ts
+import { resolve as resolve8, join as join30 } from "path";
+function buildTargetList(rootDir, coreDirName, manifest) {
+  const targets = [];
+  targets.push({ name: coreDirName, dir: join30(rootDir, coreDirName) });
+  for (const app of manifest.applications) {
+    const appDir = resolve8(join30(rootDir, coreDirName, app.localPath));
+    targets.push({ name: app.name, dir: appDir });
+  }
+  return targets;
+}
+
+// src/commands/pipelines/detect-services.ts
+import { readdir as readdir5, access as access10 } from "fs/promises";
+import { join as join31, relative, resolve as resolve9 } from "path";
+async function detectServicesInDir(targetDir) {
+  const detected = [];
+  for (const subDir of ["services", "ui"]) {
+    const scanDir = join31(targetDir, subDir);
+    try {
+      await access10(scanDir);
+    } catch {
+      continue;
+    }
+    let dirNames;
+    try {
+      const dirents = await readdir5(scanDir, { withFileTypes: true });
+      dirNames = dirents.filter((d) => d.isDirectory()).map((d) => d.name);
+    } catch {
+      continue;
+    }
+    for (const dirName of dirNames) {
+      const dockerfilePath = join31(scanDir, dirName, "Dockerfile");
+      try {
+        await access10(dockerfilePath);
+        const folder = relative(targetDir, join31(scanDir, dirName)).replace(/\\/g, "/");
+        detected.push({ name: dirName, folder });
+      } catch {
+      }
+    }
+  }
+  return detected;
+}
+
+// src/controllers/ui/pipelines.ui-controller.ts
+async function pipelinesUiController(ctx) {
+  if (!await isPlatformInitialized()) {
+    ctx.log("Error: Cannot configure pipelines \u2014 no platform initialized in this directory.");
+    return;
+  }
+  const layout = await findPlatformLayout();
+  if (!layout) return;
+  const { rootDir, coreDirName } = layout;
+  let manifest;
+  try {
+    manifest = await readManifest(rootDir, coreDirName);
+  } catch {
+    ctx.log("Error: Could not read product manifest.");
+    return;
+  }
+  const allTargets = buildTargetList(rootDir, coreDirName, manifest);
+  const targetOptions = allTargets.map((t) => ({
+    label: t.name === coreDirName ? `${t.name} (core)` : t.name,
+    value: t.name
+  }));
+  const selectedNames = await ctx.multiselect(
+    "Select repositories to generate pipelines for:",
+    targetOptions
+  );
+  if (selectedNames.length === 0) {
+    ctx.log("No targets selected. Nothing to do.");
+    return;
+  }
+  const selectedTargets = allTargets.filter((t) => selectedNames.includes(t.name));
+  const provider = await ctx.select("CI/CD provider:", [
+    { label: "GitHub Actions", value: "github" },
+    { label: "Azure DevOps", value: "azure" }
+  ]);
+  if (provider === "github") {
+    await pipelinesService(
+      {
+        provider: "github",
+        targets: selectedTargets,
+        codeFolderList: "apps/**,services/**",
+        packagesFolderPattern: "packages/**"
+      },
+      ctx
+    );
+    return;
+  }
+  const azureServiceConnection = await ctx.prompt("Azure Service Connection name:");
+  if (!azureServiceConnection.trim()) {
+    ctx.log("Error: Azure Service Connection name is required.");
+    return;
+  }
+  const acrLoginServer = await ctx.prompt("ACR Login Server (e.g. myregistry.azurecr.io):");
+  if (!acrLoginServer.trim()) {
+    ctx.log("Error: ACR Login Server is required.");
+    return;
+  }
+  const targetsWithServices = [];
+  for (const target of selectedTargets) {
+    const detected = await detectServicesInDir(target.dir);
+    let services;
+    if (detected.length === 0) {
+      ctx.log(`  No services with Dockerfile found in ${target.name} \u2014 pipeline will have an empty services list.`);
+      services = [];
+    } else {
+      const options = detected.map((s) => ({ label: `${s.name}  (${s.folder})`, value: s.folder }));
+      const selectedFolders = await ctx.multiselect(
+        `Services to include for ${target.name}:`,
+        options
+      );
+      services = selectedFolders.map((folder) => {
+        const svc = detected.find((d) => d.folder === folder);
+        return { name: svc.name, folder: svc.folder };
+      });
+    }
+    targetsWithServices.push({ ...target, services });
+  }
+  await pipelinesService(
+    {
+      provider: "azure",
+      targets: targetsWithServices,
+      azureServiceConnection,
+      acrLoginServer,
+      nodeVersion: "22.x",
+      templatesRepoName: "azure-pipeline-ba-template",
+      gitopsRepoName: "portainer-deployments"
+    },
+    ctx
+  );
+}
+
 // src/controllers/ui/init.ui-controller.ts
 async function initUiController(ctx) {
   if (await isPlatformInitialized()) {
@@ -2746,6 +3135,10 @@ async function initUiController(ctx) {
     { organizationName, platformName, platformDisplayName, bootstrapServiceSuffix, customizationUiSuffix },
     ctx
   );
+  const addPipelines = await ctx.confirm("Configure CI/CD pipelines?", false);
+  if (addPipelines) {
+    await pipelinesUiController(ctx);
+  }
 }
 
 // src/services/configure-idp.service.ts
@@ -3180,20 +3573,20 @@ async function installAiPluginService(params, context) {
 
 // src/commands/install-ai-plugin/providers/claude.provider.ts
 import { homedir as homedir3 } from "os";
-import { join as join27 } from "path";
-import { readFile as readFile11, writeFile as writeFile10, mkdir as mkdir4, rm } from "fs/promises";
+import { join as join32 } from "path";
+import { readFile as readFile13, writeFile as writeFile13, mkdir as mkdir4, rm } from "fs/promises";
 var ClaudeProvider = class {
   name = "claude";
-  baseDir = join27(homedir3(), ".claude");
+  baseDir = join32(homedir3(), ".claude");
   getInstallPath(skillName) {
-    return join27(this.baseDir, "skills", skillName, "SKILL.md");
+    return join32(this.baseDir, "skills", skillName, "SKILL.md");
   }
   manifestPath(pluginName) {
-    return join27(this.baseDir, `${pluginName}.manifest.json`);
+    return join32(this.baseDir, `${pluginName}.manifest.json`);
   }
   async readManifest(pluginName) {
     try {
-      const content = await readFile11(this.manifestPath(pluginName), "utf-8");
+      const content = await readFile13(this.manifestPath(pluginName), "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -3201,7 +3594,7 @@ var ClaudeProvider = class {
   }
   async writeManifest(manifest) {
     await mkdir4(this.baseDir, { recursive: true });
-    await writeFile10(
+    await writeFile13(
       this.manifestPath(manifest.plugin),
       JSON.stringify(manifest, null, 2),
       "utf-8"
@@ -3221,16 +3614,16 @@ var ClaudeProvider = class {
   }
   async installSkill(skill, docsSource, logger) {
     const sourcePath = docsSource.resolve(skill.sourceFile);
-    let content = await readFile11(sourcePath, "utf-8");
+    let content = await readFile13(sourcePath, "utf-8");
     const docsPath = docsSource.resolve("docs");
     content = content.replaceAll("{{docsPath}}", docsPath);
     const installPath = this.getInstallPath(skill.name);
-    await mkdir4(join27(installPath, ".."), { recursive: true });
-    await writeFile10(installPath, content, "utf-8");
+    await mkdir4(join32(installPath, ".."), { recursive: true });
+    await writeFile13(installPath, content, "utf-8");
     logger.log(`  Installed skill: ${installPath}`);
   }
   async removeSkill(skillName, logger) {
-    const skillDir = join27(this.baseDir, "skills", skillName);
+    const skillDir = join32(this.baseDir, "skills", skillName);
     try {
       await rm(skillDir, { recursive: true, force: true });
       logger.log(`  Removed skill: ${skillDir}`);
@@ -3238,11 +3631,11 @@ var ClaudeProvider = class {
     }
   }
   async updatePermissions(docsSource, logger) {
-    const settingsPath = join27(this.baseDir, "settings.json");
+    const settingsPath = join32(this.baseDir, "settings.json");
     const docsPath = docsSource.resolve("docs");
     let settings = {};
     try {
-      const content = await readFile11(settingsPath, "utf-8");
+      const content = await readFile13(settingsPath, "utf-8");
       settings = JSON.parse(content);
     } catch {
     }
@@ -3254,7 +3647,7 @@ var ClaudeProvider = class {
     permissions.additionalDirectories = [...additionalDirectories, docsPath];
     settings.permissions = permissions;
     await mkdir4(this.baseDir, { recursive: true });
-    await writeFile10(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
+    await writeFile13(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
     logger.log(`  Granted read access to docs: ${docsPath}`);
   }
 };
@@ -3273,12 +3666,12 @@ function getProvider(name) {
 }
 
 // src/commands/install-ai-plugin/docs-source/local.docs-source.ts
-import { fileURLToPath as fileURLToPath10 } from "url";
-import { join as join28, dirname as dirname12 } from "path";
-var packageRoot = join28(dirname12(fileURLToPath10(import.meta.url)), "..");
+import { fileURLToPath as fileURLToPath12 } from "url";
+import { join as join33, dirname as dirname15 } from "path";
+var packageRoot = join33(dirname15(fileURLToPath12(import.meta.url)), "..");
 var LocalDocsSource = class {
   resolve(relativePath) {
-    return join28(packageRoot, relativePath);
+    return join33(packageRoot, relativePath);
   }
 };
 
@@ -3322,20 +3715,20 @@ async function installAiPluginUiController(ctx) {
 
 // src/controllers/ui/standalone.ui-controller.ts
 import { rm as rm3 } from "fs/promises";
-import { join as join32 } from "path";
+import { join as join37 } from "path";
 import { cwd as cwd7 } from "process";
 import { exec } from "child_process";
 
 // src/commands/standalone/app-monorepo-check.ts
-import { access as access9, readdir as readdir5 } from "fs/promises";
-import { join as join29 } from "path";
+import { access as access11, readdir as readdir6 } from "fs/promises";
+import { join as join34 } from "path";
 import { cwd as cwd6 } from "process";
 async function findAppMonorepoLayout(startDir = cwd6()) {
-  const composePath = join29(startDir, "docker-compose.yml");
-  const packageJsonPath = join29(startDir, "package.json");
+  const composePath = join34(startDir, "docker-compose.yml");
+  const packageJsonPath = join34(startDir, "package.json");
   try {
-    await access9(composePath);
-    await access9(packageJsonPath);
+    await access11(composePath);
+    await access11(packageJsonPath);
   } catch {
     return null;
   }
@@ -3346,11 +3739,11 @@ async function findAppMonorepoLayout(startDir = cwd6()) {
 }
 async function hasCoreChildDir(dir) {
   try {
-    const entries = await readdir5(dir, { withFileTypes: true });
+    const entries = await readdir6(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && (entry.name.endsWith("-core") || entry.name === "core")) {
         try {
-          await access9(join29(dir, entry.name, "product.manifest.json"));
+          await access11(join34(dir, entry.name, "product.manifest.json"));
           return true;
         } catch {
         }
@@ -3365,36 +3758,36 @@ async function isInAppMonorepo() {
 }
 
 // src/commands/standalone/standalone-auto-detect.ts
-import { readdir as readdir6, readFile as readFile12 } from "fs/promises";
-import { join as join30, basename as basename2 } from "path";
+import { readdir as readdir7, readFile as readFile14 } from "fs/promises";
+import { join as join35, basename as basename2 } from "path";
 async function autoDetectAppIdentity(appDir) {
   const fromBootstrap = await detectFromBootstrap(appDir);
   if (fromBootstrap) return fromBootstrap;
   return detectFromPackageJson(appDir);
 }
 async function detectFromBootstrap(appDir) {
-  const servicesDir = join30(appDir, "services");
+  const servicesDir = join35(appDir, "services");
   let entries;
   try {
-    entries = await readdir6(servicesDir);
+    entries = await readdir7(servicesDir);
   } catch {
     return null;
   }
   const bootstrapDirs = entries.filter((e) => e.endsWith("-bootstrap-service"));
   if (bootstrapDirs.length === 0) return null;
   for (const bootstrapDirName of bootstrapDirs) {
-    const dataDir = join30(servicesDir, bootstrapDirName, "src", "data");
+    const dataDir = join35(servicesDir, bootstrapDirName, "src", "data");
     let dataDirEntries;
     try {
-      dataDirEntries = await readdir6(dataDir);
+      dataDirEntries = await readdir7(dataDir);
     } catch {
       continue;
     }
     for (const subDir of dataDirEntries) {
       if (subDir === "platform") continue;
-      const appJsonPath = join30(dataDir, subDir, "application.json");
+      const appJsonPath = join35(dataDir, subDir, "application.json");
       try {
-        const content = await readFile12(appJsonPath, "utf-8");
+        const content = await readFile14(appJsonPath, "utf-8");
         const appData = JSON.parse(content);
         if (!appData.name) continue;
         const applicationName = appData.name;
@@ -3412,7 +3805,7 @@ async function detectFromBootstrap(appDir) {
 }
 async function detectFromPackageJson(appDir) {
   try {
-    const content = await readFile12(join30(appDir, "package.json"), "utf-8");
+    const content = await readFile14(join35(appDir, "package.json"), "utf-8");
     const pkg = JSON.parse(content);
     const rawName = pkg.name ?? "";
     const applicationName = rawName.includes("/") ? rawName.split("/")[1] ?? rawName : rawName;
@@ -3435,23 +3828,24 @@ function inferPlatformNameFromAppDir(appDir, applicationName) {
 }
 
 // src/commands/standalone/standalone-orchestrator.ts
-import { join as join31, dirname as dirname13 } from "path";
-import { mkdir as mkdir5, rm as rm2, readdir as readdir7, access as access10, writeFile as writeFile11, readFile as readFile13 } from "fs/promises";
+import { join as join36, dirname as dirname16 } from "path";
+import { mkdir as mkdir5, rm as rm2, readdir as readdir8, access as access12, writeFile as writeFile14, readFile as readFile15, open } from "fs/promises";
+import { constants } from "fs";
 import { fetch as undiciFetch4, Agent as Agent4 } from "undici";
 var TMP_BASE = "/tmp";
 var STANDALONE_PREFIX = "platform-standalone-";
 var DETACH_MARKER = ".standalone-running";
 function getTmpDir(platformName) {
-  return join31(TMP_BASE, `${STANDALONE_PREFIX}${platformName}`);
+  return join36(TMP_BASE, `${STANDALONE_PREFIX}${platformName}`);
 }
 async function findRunningSingleton() {
   try {
-    const entries = await readdir7(TMP_BASE, { withFileTypes: true });
+    const entries = await readdir8(TMP_BASE, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name.startsWith(STANDALONE_PREFIX)) {
-        const candidateDir = join31(TMP_BASE, entry.name);
+        const candidateDir = join36(TMP_BASE, entry.name);
         try {
-          await access10(join31(candidateDir, DETACH_MARKER));
+          await access12(join36(candidateDir, DETACH_MARKER));
           return candidateDir;
         } catch {
         }
@@ -3495,7 +3889,7 @@ async function configureIdpFromConfig(config, localDir, logger) {
     logger.log("No IDP configured \u2014 run 'platform standalone-config set' to add an IDP. Skipping IDP setup.");
     return;
   }
-  const envPath = join31(localDir, ".env");
+  const envPath = join36(localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -3550,7 +3944,7 @@ async function configureAdminUsersFromConfig(config, localDir, logger) {
   if (!config.adminUsers || config.adminUsers.length === 0) {
     return;
   }
-  const envPath = join31(localDir, ".env");
+  const envPath = join36(localDir, ".env");
   let env;
   try {
     env = await readEnvFile(envPath);
@@ -3593,19 +3987,19 @@ async function configureAdminUsersFromConfig(config, localDir, logger) {
   }
 }
 function buildLayout(tmpDir, coreDirName) {
-  const coreDir = join31(tmpDir, coreDirName);
+  const coreDir = join36(tmpDir, coreDirName);
   return {
     rootDir: tmpDir,
     coreDir,
     coreDirName,
-    localDir: join31(coreDir, "local")
+    localDir: join36(coreDir, "local")
   };
 }
-async function generateProxyAppCompose(appDir, localDir, platformName, applicationName, logger) {
-  const appComposePath = join31(appDir, "docker-compose.yml");
+async function generateProxyAppCompose2(appDir, localDir, platformName, applicationName, logger) {
+  const appComposePath = join36(appDir, "docker-compose.yml");
   let content;
   try {
-    content = await readFile13(appComposePath, "utf-8");
+    content = await readFile15(appComposePath, "utf-8");
   } catch {
     logger.log(`Warning: No docker-compose.yml found at ${appComposePath} \u2014 app services won't start.`);
     return;
@@ -3614,10 +4008,10 @@ async function generateProxyAppCompose(appDir, localDir, platformName, applicati
     /^(\s+context:\s+)\.\/(.*)$/gm,
     `$1${appDir}/$2`
   );
-  const appParentDir = dirname13(appDir);
+  const appParentDir = dirname16(appDir);
   const rewritten = withAbsContexts.replace(/\$\{PWD\}/g, appParentDir);
-  const proxyPath = join31(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
-  await writeFile11(proxyPath, rewritten, "utf-8");
+  const proxyPath = join36(localDir, `${platformName}-${applicationName}-docker-compose.yml`);
+  await writeFile14(proxyPath, rewritten, "utf-8");
   logger.log(`Generated app compose with absolute build paths.`);
 }
 function buildComposeManifest(manifest) {
@@ -3643,7 +4037,23 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   }
   logger.log(`Starting standalone platform for "${applicationDisplayName}"...`);
   await mkdir5(tmpDir, { recursive: true });
-  await writeFile11(join31(tmpDir, DETACH_MARKER), platformName, "utf-8");
+  let markerFd;
+  try {
+    markerFd = await open(
+      join36(tmpDir, DETACH_MARKER),
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY
+    );
+    await markerFd.writeFile(platformName, "utf-8");
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      logger.log(`Error: A standalone platform is already starting at ${tmpDir}.`);
+      logger.log(`Run "platform standalone-stop" to stop it before starting a new one.`);
+      return;
+    }
+    throw err;
+  } finally {
+    await markerFd?.close();
+  }
   const variables = {
     organizationName,
     platformName,
@@ -3668,9 +4078,9 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
     }
   );
   await writeManifest(npmManifest, tmpDir, coreDirName);
-  const bootstrapServiceDir = join31(tmpDir, coreDirName, "services", bootstrapServiceName);
+  const bootstrapServiceDir = join36(tmpDir, coreDirName, "services", bootstrapServiceName);
   await scaffoldPlatformBootstrap(bootstrapServiceDir, variables, logger);
-  const customizationUiDir = join31(tmpDir, coreDirName, "ui", customizationUiName);
+  const customizationUiDir = join36(tmpDir, coreDirName, "ui", customizationUiName);
   await scaffoldCustomizationUi(customizationUiDir, variables, logger);
   await registerCustomizationModule(bootstrapServiceDir, organizationName, logger, platformName);
   const layout = buildLayout(tmpDir, coreDirName);
@@ -3680,7 +4090,7 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   logger.log("Building...");
   await buildAll(layout, npmManifest, logger, signal, true);
   if (signal?.aborted) return;
-  await generateProxyAppCompose(appDir, layout.localDir, platformName, applicationName, logger);
+  await generateProxyAppCompose2(appDir, layout.localDir, platformName, applicationName, logger);
   const composeManifest = buildComposeManifest(npmManifest);
   await writeManifest(composeManifest, tmpDir, coreDirName);
   logger.log("Resetting previous environment (removing stale containers and volumes)...");
@@ -3689,7 +4099,7 @@ async function startStandalone(config, appDir, logger, signal, detach = false) {
   logger.log("Starting containers...");
   await startEnvironment(layout, composeManifest, logger, signal);
   if (signal?.aborted) return;
-  const env = await readEnvFile(join31(layout.localDir, ".env")).catch(() => /* @__PURE__ */ new Map());
+  const env = await readEnvFile(join36(layout.localDir, ".env")).catch(() => /* @__PURE__ */ new Map());
   const gatewayUrl = env.get("PAE_GATEWAY_HOST_URL") ?? "https://localhost:443";
   const gatewayReady = await waitForGateway(gatewayUrl, logger);
   if (!gatewayReady) {
@@ -3709,16 +4119,27 @@ Standalone platform is running in the background.`);
   logger.log("\nPlatform is running. Press Ctrl+C to stop and clean up.");
   const keepAlive = setInterval(() => {
   }, 60 * 6e4);
+  let cleanupInProgress = false;
   const shutdown = () => {
+    if (cleanupInProgress) {
+      logger.log("\nForce exiting. Containers may need manual cleanup:");
+      logger.log(`  docker compose -p ${platformName}-platform down -v --remove-orphans`);
+      process.exit(1);
+    }
+    cleanupInProgress = true;
     clearInterval(keepAlive);
-    void (async () => {
+    (async () => {
       logger.log("\nShutting down standalone platform...");
       await destroyEnvironment(layout, composeManifest, logger);
       await cleanupTmpDir(tmpDir, logger);
-    })();
+      process.exit(0);
+    })().catch((err) => {
+      logger.log(`Error during cleanup: ${err.message}`);
+      process.exit(1);
+    });
   };
-  process.once("SIGINT", shutdown);
-  process.once("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
 }
 async function stopStandalone(logger) {
   const runningDir = await findRunningSingleton();
@@ -3728,11 +4149,11 @@ async function stopStandalone(logger) {
   }
   let coreDirName = null;
   try {
-    const entries = await readdir7(runningDir, { withFileTypes: true });
+    const entries = await readdir8(runningDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name.endsWith("-core")) {
         try {
-          await access10(join31(runningDir, entry.name, "product.manifest.json"));
+          await access12(join36(runningDir, entry.name, "product.manifest.json"));
           coreDirName = entry.name;
           break;
         } catch {
@@ -3769,9 +4190,9 @@ async function stopStandalone(logger) {
 
 // src/controllers/ui/standalone.ui-controller.ts
 function getGitEmail() {
-  return new Promise((resolve9) => {
+  return new Promise((resolve11) => {
     exec("git config user.email", (err, stdout) => {
-      resolve9(err ? "" : stdout.trim());
+      resolve11(err ? "" : stdout.trim());
     });
   });
 }
@@ -3847,7 +4268,7 @@ async function standaloneUiController(ctx) {
       const deleteLegacy = await ctx.confirm("Delete the local standalone.json?", true);
       if (deleteLegacy) {
         try {
-          await rm3(join32(appDir, "standalone.json"));
+          await rm3(join37(appDir, "standalone.json"));
           ctx.log("Deleted standalone.json.");
         } catch {
           ctx.log("Warning: Could not delete standalone.json.");
@@ -3979,7 +4400,7 @@ async function standaloneConfigShowUiController(ctx) {
     if (config) {
       ctx.log(`Standalone config for ${detected.platformName}/${detected.applicationName}:
 `);
-      ctx.log(JSON.stringify(config, null, 2));
+      ctx.log(JSON.stringify(maskSensitiveFields(config), null, 2));
     } else {
       ctx.log(`No config found for ${detected.platformName}/${detected.applicationName}.`);
       ctx.log(`Run 'platform standalone' or 'platform standalone-config set' to configure.`);
@@ -3998,7 +4419,7 @@ async function showAll(ctx) {
   if (Object.keys(defaults).length === 0) {
     ctx.log("(none)");
   } else {
-    ctx.log(JSON.stringify(defaults, null, 2));
+    ctx.log(JSON.stringify(maskSensitiveFields(defaults), null, 2));
   }
   ctx.log("\n--- Apps ---");
   if (apps.length === 0) {
@@ -4130,9 +4551,9 @@ async function collectIdpConfig2(ctx, current) {
   return { provider: providerType, name, issuer, clientId, clientSecret, extras };
 }
 function getGitEmail2() {
-  return new Promise((resolve9) => {
+  return new Promise((resolve11) => {
     exec2("git config user.email", (err, stdout) => {
-      resolve9(err ? "" : stdout.trim());
+      resolve11(err ? "" : stdout.trim());
     });
   });
 }
@@ -4171,7 +4592,8 @@ var uiControllers = /* @__PURE__ */ new Map([
   [STANDALONE_CONFIG_SHOW_COMMAND_NAME, standaloneConfigShowUiController],
   [STANDALONE_CONFIG_SET_COMMAND_NAME, standaloneConfigSetUiController],
   [STANDALONE_CONFIG_DELETE_COMMAND_NAME, standaloneConfigDeleteUiController],
-  [STANDALONE_CONFIG_LIST_COMMAND_NAME, standaloneConfigListUiController]
+  [STANDALONE_CONFIG_LIST_COMMAND_NAME, standaloneConfigListUiController],
+  [PIPELINES_COMMAND_NAME, pipelinesUiController]
 ]);
 
 // src/hooks/use-command-runner.ts
@@ -4205,7 +4627,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
           }
         },
         prompt(message, defaultValue) {
-          return new Promise((resolve9, reject) => {
+          return new Promise((resolve11, reject) => {
             if (controller.signal.aborted) {
               reject(new DOMException("Aborted", "AbortError"));
               return;
@@ -4213,7 +4635,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
             setPromptMessage(message);
             setPromptValue(defaultValue ?? "");
             setPromptMode({ kind: "text" });
-            promptResolveRef.current = resolve9;
+            promptResolveRef.current = resolve11;
             setState(APP_STATE.PROMPTING);
             controller.signal.addEventListener(
               "abort",
@@ -4223,7 +4645,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
           });
         },
         select(message, options) {
-          return new Promise((resolve9, reject) => {
+          return new Promise((resolve11, reject) => {
             if (controller.signal.aborted) {
               reject(new DOMException("Aborted", "AbortError"));
               return;
@@ -4231,7 +4653,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
             setPromptMessage(message);
             setPromptMode({ kind: "select", options });
             setSelectIndex(0);
-            promptResolveRef.current = resolve9;
+            promptResolveRef.current = resolve11;
             setState(APP_STATE.PROMPTING);
             controller.signal.addEventListener(
               "abort",
@@ -4241,7 +4663,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
           });
         },
         multiselect(message, options) {
-          return new Promise((resolve9, reject) => {
+          return new Promise((resolve11, reject) => {
             if (controller.signal.aborted) {
               reject(new DOMException("Aborted", "AbortError"));
               return;
@@ -4251,7 +4673,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
             setSelectIndex(0);
             setMultiselectChecked(new Set(options.map((_, i) => i)));
             promptResolveRef.current = (value) => {
-              resolve9(value ? value.split(",") : []);
+              resolve11(value ? value.split(",") : []);
             };
             setState(APP_STATE.PROMPTING);
             controller.signal.addEventListener(
@@ -4262,7 +4684,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
           });
         },
         confirm(message, defaultValue) {
-          return new Promise((resolve9, reject) => {
+          return new Promise((resolve11, reject) => {
             if (controller.signal.aborted) {
               reject(new DOMException("Aborted", "AbortError"));
               return;
@@ -4270,7 +4692,7 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
             setPromptMessage(message);
             setPromptMode({ kind: "confirm" });
             setConfirmValue(defaultValue ?? true);
-            promptResolveRef.current = (value) => resolve9(value === "true");
+            promptResolveRef.current = (value) => resolve11(value === "true");
             setState(APP_STATE.PROMPTING);
             controller.signal.addEventListener(
               "abort",
@@ -4304,11 +4726,11 @@ function useCommandRunner({ appendStaticItem, setState, onCommandComplete }) {
   );
   const handlePromptSubmit = useCallback(
     (value) => {
-      const resolve9 = promptResolveRef.current;
+      const resolve11 = promptResolveRef.current;
       promptResolveRef.current = null;
       setPromptMode({ kind: "text" });
       setState(APP_STATE.EXECUTING);
-      resolve9?.(value);
+      resolve11?.(value);
     },
     [setState]
   );
@@ -4904,7 +5326,7 @@ async function standaloneConfigShowCliController(args2) {
     const [pn, an] = parts;
     const config = await resolveAppConfig(pn, an);
     if (config) {
-      console.log(JSON.stringify(config, null, 2));
+      console.log(JSON.stringify(maskSensitiveFields(config), null, 2));
     } else {
       console.error(`No config found for ${appArg}.`);
       process.exit(1);
@@ -4915,12 +5337,12 @@ async function standaloneConfigShowCliController(args2) {
   if (detected) {
     const config = await resolveAppConfig(detected.platformName, detected.applicationName);
     if (config) {
-      console.log(JSON.stringify(config, null, 2));
+      console.log(JSON.stringify(maskSensitiveFields(config), null, 2));
       return;
     }
   }
   const cache = await readCacheFile();
-  console.log(JSON.stringify(cache, null, 2));
+  console.log(JSON.stringify(maskSensitiveFields(cache), null, 2));
 }
 async function standaloneConfigSetCliController(args2) {
   if (args2["defaults"] === "true") {
@@ -4994,6 +5416,102 @@ async function standaloneConfigListCliController(_args) {
   }
 }
 
+// src/controllers/cli/pipelines.cli-controller.ts
+async function pipelinesCliController(args2) {
+  const {
+    provider,
+    targets: targetsArg,
+    stateFile,
+    codeFolderList,
+    packagesFolderPattern,
+    azureServiceConnection,
+    acrLoginServer,
+    nodeVersion,
+    templatesRepoName,
+    gitopsRepoName,
+    services: servicesJson
+  } = args2;
+  if (!provider) {
+    console.error("Error: --provider is required (github or azure)");
+    process.exit(1);
+  }
+  if (provider !== "github" && provider !== "azure") {
+    console.error('Error: --provider must be "github" or "azure"');
+    process.exit(1);
+  }
+  if (provider === "azure") {
+    if (!azureServiceConnection) {
+      console.error("Error: --azureServiceConnection is required for Azure DevOps");
+      process.exit(1);
+    }
+    if (!acrLoginServer) {
+      console.error("Error: --acrLoginServer is required for Azure DevOps");
+      process.exit(1);
+    }
+  }
+  const layout = await findPlatformLayout();
+  if (!layout) {
+    console.error("Error: Cannot generate pipelines \u2014 no platform initialized in this directory.");
+    process.exit(1);
+  }
+  const { rootDir, coreDirName } = layout;
+  let manifest;
+  try {
+    manifest = await readManifest(rootDir, coreDirName);
+  } catch {
+    console.error("Error: Could not read product manifest.");
+    process.exit(1);
+  }
+  const allTargets = buildTargetList(rootDir, coreDirName, manifest);
+  let selectedTargets;
+  if (!targetsArg || targetsArg === "all") {
+    selectedTargets = allTargets;
+  } else {
+    const names = targetsArg.split(",").map((n) => n.trim());
+    selectedTargets = allTargets.filter((t) => names.includes(t.name));
+    if (selectedTargets.length === 0) {
+      console.error(`Error: None of the specified targets found. Available: ${allTargets.map((t) => t.name).join(", ")}`);
+      process.exit(1);
+    }
+  }
+  let servicesMap = {};
+  if (servicesJson) {
+    try {
+      servicesMap = JSON.parse(servicesJson);
+    } catch {
+      console.error(`Error: --services must be valid JSON map keyed by target name (e.g. '{"myapp":[{"name":"svc","folder":"services/svc"}]}')`);
+      process.exit(1);
+    }
+  }
+  const targetsWithServices = [];
+  for (const target of selectedTargets) {
+    let services;
+    if (servicesMap[target.name]) {
+      services = servicesMap[target.name];
+    } else if (provider === "azure") {
+      services = await detectServicesInDir(target.dir);
+    } else {
+      services = [];
+    }
+    targetsWithServices.push({ ...target, services });
+  }
+  await pipelinesService(
+    {
+      provider,
+      targets: targetsWithServices,
+      stateFile,
+      codeFolderList,
+      packagesFolderPattern,
+      azureServiceConnection,
+      acrLoginServer,
+      nodeVersion,
+      templatesRepoName,
+      gitopsRepoName
+    },
+    { log: console.log }
+  );
+}
+
 // src/controllers/cli/registry.ts
 var cliControllers = /* @__PURE__ */ new Map([
   [CREATE_APPLICATION_COMMAND_NAME, createApplicationCliController],
@@ -5014,7 +5532,8 @@ var cliControllers = /* @__PURE__ */ new Map([
   [STANDALONE_CONFIG_SHOW_COMMAND_NAME, standaloneConfigShowCliController],
   [STANDALONE_CONFIG_SET_COMMAND_NAME, standaloneConfigSetCliController],
   [STANDALONE_CONFIG_DELETE_COMMAND_NAME, standaloneConfigDeleteCliController],
-  [STANDALONE_CONFIG_LIST_COMMAND_NAME, standaloneConfigListCliController]
+  [STANDALONE_CONFIG_LIST_COMMAND_NAME, standaloneConfigListCliController],
+  [PIPELINES_COMMAND_NAME, pipelinesCliController]
 ]);
 
 // src/utils/parse-args.ts