@rashidee/co2 1.3.5 → 1.3.6

package/drizzle/0017_git_remote_url.sql

@@ -0,0 +1,3 @@
+-- v2.2.0: Per-project git remote URL (push destination). Nullable; auto-seeded from an
+-- imported repo's origin, editable in project detail. Contains no embedded credentials.
+ALTER TABLE `projects` ADD `git_remote_url` text;

package/drizzle/0018_default_branch.sql

@@ -0,0 +1,3 @@
+-- v2.3.0: Per-project default (trunk) branch — the branch release branches merge back into on a
+-- version cut (runVersionCutGit). Defaults to `main`; existing rows backfill to `main`.
+ALTER TABLE `projects` ADD `default_branch` text DEFAULT 'main' NOT NULL;

package/drizzle/0019_git_provider.sql

@@ -0,0 +1,3 @@
+-- v2.3.0: Per-project git hosting provider — drives the PAT auth-username convention (GitHub
+-- `x-access-token` vs GitLab `oauth2`). Defaults to `github`; existing rows backfill to `github`.
+ALTER TABLE `projects` ADD `git_provider` text DEFAULT 'github' NOT NULL;

package/drizzle/meta/_journal.json

@@ -120,6 +120,27 @@
       "when": 1784700000000,
       "tag": "0016_cicd_v2100",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1784800000000,
+      "tag": "0017_git_remote_url",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "6",
+      "when": 1784900000000,
+      "tag": "0018_default_branch",
+      "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "6",
+      "when": 1785000000000,
+      "tag": "0019_git_provider",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -8,10 +8,15 @@ description: >
   `**Approved**:` line (stamped by Compound Context Studio's Approve button). Produces
   cicd/app/ — a zero-npm-dependency node:http app (server.js + cicd.config.json) rendering a
   bare light-themed page (no header/sidebar/footer, iframe-embeddable) with one nav tab per
-  application: a controls bar (status badge, clickable app URL opening a new tab, Build /
-  Start / Stop / Deploy buttons) above that application's log streamed live over a built-in
-  zero-dependency WebSocket (bounded tail + backpressure drop server-side, trimmed DOM buffer
-  client-side — no leaks/OOM). Build and Deploy commands come from the approved plan (inferred
+  application: a controls bar (status badge, clickable app URL opening a new tab, a Config
+  button, and Build / Start / Stop / Deploy buttons) above that application's log streamed live
+  over a built-in zero-dependency WebSocket (bounded tail + backpressure drop server-side, trimmed
+  DOM buffer client-side — no leaks/OOM). The Config button opens a modal listing the application's
+  runtime config files (from the plan's `## Application Configs`) — each with its source
+  (ENVIRONMENT.md-derived vs an existing .env/.env-* file), present/MISSING status, required keys
+  and full live content — for troubleshooting; and before Build/Start the app materializes any
+  missing plan-managed config file into the application folder so it always starts with complete
+  configuration. Build and Deploy commands come from the approved plan (inferred
   from ENVIRONMENT.md/DEVTOOL.md — e.g. Spring Boot jar vs Docker image; deploy via web-server
   copy, docker run or kubectl apply, or none). Controls are disabled for any application that
   has never completed a conductor-develop workflow run (checked against the studio's
@@ -58,12 +63,22 @@ Read `references/cicd-app-template.md` for the complete file templates. Produce:
 
 1. `cicd/app/cicd.config.json` — from the plan's tables:
    `{ "port": <CI/CD app port>, "apps": [{ "name", "folder", "method", "port", "build",
-   "start", "stop", "deployMethod", "deploy", "health" }], "infra": [{ "id", "name", "host",
-   "port", "url", "description" }] }` — `deployMethod` is the plan's Deploy Method column
+   "start", "stop", "deployMethod", "deploy", "health", "configs" }], "infra": [{ "id", "name",
+   "host", "port", "url", "description" }] }` — `deployMethod` is the plan's Deploy Method column
    (`none|web-server|docker|kubernetes`) and `deploy` its command (`null` when the method is
    `none`). The `infra` array comes from the plan's `## Infrastructure` table (one entry per
    row); `url` is `null` when the Console URL cell is `-`. Emit `"infra": []` when the plan's
    Infrastructure table is empty — never invent services the plan does not list.
+   - `configs` — the runtime config files each application reads at start, from the plan's
+     `## Application Configs` section (one entry per file):
+     `{ "path", "label", "source", "managed", "keys", "note", "content" }`. `source` is
+     `environment` | `env-file` | `derived`; `path` is relative to the application folder. When
+     `managed` is `true`, `content` is the plan's resolved file body (verbatim, credentials
+     included per the dev-plaintext rule) — the generated app writes it into the application folder
+     before Build/Start if the file is missing, so the app always starts with COMPLETE config. For
+     an `env-file` used as-is on disk, set `managed:false` and `content:null`. Copy the plan's
+     resolved `content` blocks verbatim — NEVER drop a managed file's content (that body is what
+     guarantees the app boots). Emit `"configs": []` for an app the plan lists no config files for.
 2. `cicd/app/server.js` — the template verbatim (it is generic; all project specifics live in
    cicd.config.json). Zero npm dependencies.
 3. Ensure `cicd/logs/` and `cicd/state.json` are ignored: append `cicd/logs/` and
@@ -97,6 +112,13 @@ port, application count) and STOP — the studio starts/embeds the app.
 - Develop gate: controls stay disabled for an application that never completed a
   conductor-develop run — checked via `${CO2_STUDIO_URL}/api/cicd-guard/${CO2_PROJECT_ID}`
   with the CO2_GUARD_TOKEN from the spawn env (refreshed every 30 s, last answer cached).
+- Application config (troubleshooting + completeness): every application tab has a **Config**
+  button opening a modal that lists the app's runtime config files (from `configs`) — each with its
+  source badge (`environment`/`env-file`/`derived`), present/MISSING status, required keys and full
+  live on-disk content. The Config button is ALWAYS enabled (independent of the develop gate) so a
+  failed start-up can always be inspected. Before Build and before Start the server materializes any
+  `managed` config file whose `content` is set into the application folder when it is missing (never
+  overwriting a file already on disk), so an application never fails to come up for want of config.
 - Log streaming must stay bounded: per-app log file on disk, bounded tail on connect, live
   append broadcast only, slow subscribers dropped on backpressure, client DOM buffer trimmed.
 - Already-running detection: `/api/state` decides "is it running?" by a raw TCP connect to the

package/plugin/skills/util-gencicdscript/references/cicd-app-template.md

@@ -148,6 +148,48 @@ function runLogged(app, command, onExit) {
   return child
 }
 
+// ---- Application config (runtime .env etc.) --------------------------------------------
+// Each app declares the config files its start command reads (inferred by util-plancicd from
+// ENVIRONMENT.md or an existing .env/.env-* file). A `managed` file carries the plan's resolved
+// content and is materialized into the application folder before Build/Start when it is missing —
+// so an application always starts with COMPLETE configuration. The Config modal shows every file's
+// live on-disk content for troubleshooting. Paths are relative to the application folder.
+const MAX_CONFIG_BYTES = 200_000
+function configAbsPath(app, cfg) { return join(PROJECT_DIR, app.folder, cfg.path) }
+function ensureConfigs(app) {
+  for (const cfg of app.configs || []) {
+    if (!cfg.managed || cfg.content == null) continue // env-file configs are used as-is on disk
+    const abs = configAbsPath(app, cfg)
+    if (existsSync(abs)) continue // never overwrite a config already on disk
+    try {
+      mkdirSync(join(abs, '..'), { recursive: true })
+      writeFileSync(abs, cfg.content)
+      logLine(app, `config: wrote ${cfg.path} from the plan (was missing)`)
+    } catch (e) {
+      logLine(app, `config: FAILED to write ${cfg.path} — ${e.message}`)
+    }
+  }
+}
+function readConfig(app, cfg) {
+  const abs = configAbsPath(app, cfg)
+  let exists = false, content = ''
+  try {
+    if (existsSync(abs)) {
+      exists = true
+      const buf = readFileSync(abs)
+      content = buf.length > MAX_CONFIG_BYTES
+        ? buf.slice(0, MAX_CONFIG_BYTES).toString('utf8') + '\n… (truncated)'
+        : buf.toString('utf8')
+    } else if (cfg.managed && cfg.content != null) {
+      content = cfg.content // planned content — not yet written to disk
+    }
+  } catch (e) { content = `(unreadable: ${e.message})` }
+  return {
+    path: cfg.path, label: cfg.label || cfg.path, source: cfg.source || 'env-file',
+    managed: !!cfg.managed, keys: cfg.keys || [], note: cfg.note || '', exists, content,
+  }
+}
+
 // ---- App lifecycle ---------------------------------------------------------------------
 // Candidate loopback hosts to check for liveness: IPv4 (127.0.0.1) AND IPv6 (::1) loopback
 // always, plus whatever host the plan's health URL names. Frameworks bind different families —
@@ -187,6 +229,7 @@ function tcpProbe(host, port, timeout = 1000) {
 function buildApp(app) {
   if (activity.has(app.name)) return
   activity.set(app.name, 'building'); lastError.delete(app.name)
+  ensureConfigs(app)
   runLogged(app, app.build, (code) => {
     activity.delete(app.name)
     if (code !== 0) lastError.set(app.name, `build exited ${code} — see log`)
@@ -207,6 +250,7 @@ function deployApp(app) {
 function startApp(app) {
   if (running.get(app.name) || activity.has(app.name)) return
   failed.delete(app.name); lastError.delete(app.name)
+  ensureConfigs(app)
   if (app.method === 'container') {
     runLogged(app, app.start, () => {})
     saveState(); return
@@ -303,6 +347,19 @@ button:disabled{opacity:.4;cursor:default}
 .notice{padding:4px 12px;font-size:11px;color:#8a5a00;background:#fff7e6;display:none}
 .err{padding:4px 12px;font-size:11px;color:#c23b3b;display:none;white-space:pre-wrap}
 #log{flex:1;margin:0;padding:10px 12px;background:#0f1216;color:#d7dde4;font-size:11px;line-height:1.5;overflow:auto;white-space:pre-wrap}
+.muted{color:#5b6572;font-size:12px}
+.modal{position:fixed;inset:0;background:rgba(0,0,0,.45);display:none;align-items:center;justify-content:center;padding:24px;z-index:20}
+.modal.open{display:flex}
+.modal-panel{background:#fff;border-radius:10px;max-width:920px;width:100%;max-height:85vh;display:flex;flex-direction:column;overflow:hidden;box-shadow:0 10px 40px rgba(0,0,0,.3)}
+.modal-head{display:flex;align-items:center;gap:8px;padding:10px 14px;border-bottom:1px solid #e1e5ea;font-size:13px}
+.modal-body{padding:12px 14px;overflow:auto}
+.cfg{margin-bottom:16px}
+.cfg h3{font-size:13px;margin:0 0 4px;display:flex;gap:8px;align-items:center}
+.cfg .src{font-size:10px;text-transform:uppercase;border-radius:99px;padding:2px 8px;background:#eef1f5;color:#5b6572}
+.cfg .miss{color:#c23b3b;font-weight:600}
+.cfg .ok{color:#1c8a4a;font-weight:600}
+.cfg .keys{font-size:11px;color:#5b6572;margin:2px 0}
+.cfg pre{background:#0f1216;color:#d7dde4;font-size:11px;padding:8px 10px;border-radius:6px;overflow:auto;max-height:320px;white-space:pre-wrap;margin:4px 0 0}
 </style></head><body>
 <div class="top"><strong>CI/CD</strong><span id="branch" class="meta"></span><span style="flex:1"></span><a id="infralink" class="url" href="/infra" target="_blank" rel="noreferrer" style="display:none">Infrastructure ↗</a></div>
 <div class="tabs" id="tabs"></div>
@@ -310,7 +367,14 @@ button:disabled{opacity:.4;cursor:default}
 <div class="notice" id="notice"></div>
 <div class="err" id="err"></div>
 <pre id="log"></pre>
+<div class="modal" id="cfgModal" onclick="if(event.target===this)closeConfig()">
+  <div class="modal-panel">
+    <div class="modal-head"><strong id="cfgTitle">Configuration</strong><span style="flex:1"></span><button onclick="closeConfig()">Close</button></div>
+    <div class="modal-body" id="cfgBody"></div>
+  </div>
+</div>
 <script>
+function esc(s){ return String(s==null?'':s).replace(/[&<>"]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])) }
 let state = { apps: [] }
 let active = null
 let ws = null, wsTimer = null
@@ -334,6 +398,7 @@ function renderBar(){
     <span class="meta">\${a.method} · port \${a.port}</span>
     <a class="url" href="\${url}" target="_blank" rel="noreferrer">\${url}</a>
     <span style="flex:1"></span>
+    <button onclick="openConfig()" title="Show this application's runtime configuration files">Config</button>
     <button onclick="act('build')" \${!gate||busy||a.phase==='running'?'disabled':''}>Build</button>
     <button onclick="act('start')" \${!gate||busy||a.phase==='running'?'disabled':''}>Start</button>
     <button onclick="act('stop')" \${a.phase!=='running'?'disabled':''}>Stop</button>
@@ -378,6 +443,30 @@ function appendLog(text){
   if (atBottom) el.scrollTop = el.scrollHeight
 }
 
+// Config modal — the runtime config files this application needs to start (from the plan). Shows
+// each file's live on-disk content (or the planned content when a managed file is not yet written),
+// its source (environment / env-file / derived), required keys and present/MISSING status — so the
+// user can troubleshoot a start-up that is failing for want of complete configuration.
+async function openConfig(){
+  if (!active) return
+  const modal = document.getElementById('cfgModal')
+  document.getElementById('cfgTitle').textContent = 'Configuration — '+active
+  document.getElementById('cfgBody').innerHTML = '<div class="muted">Loading…</div>'
+  modal.classList.add('open')
+  const s = await fetch('/api/apps/'+encodeURIComponent(active)+'/config').then(r=>r.json()).catch(()=>null)
+  const configs = (s && s.configs) || []
+  document.getElementById('cfgBody').innerHTML = configs.length ? configs.map(c => \`
+    <div class="cfg">
+      <h3>\${esc(c.label)} <span class="src">\${esc(c.source)}</span>
+        \${c.exists ? '<span class="ok">present</span>' : '<span class="miss">MISSING'+(c.managed&&c.content?' — created on Build/Start':'')+'</span>'}</h3>
+      \${c.keys&&c.keys.length ? '<div class="keys">Required keys: '+c.keys.map(esc).join(', ')+'</div>' : ''}
+      \${c.note ? '<div class="keys">'+esc(c.note)+'</div>' : ''}
+      <pre>\${esc(c.content) || '(empty)'}</pre>
+    </div>\`).join('') : '<div class="muted">No runtime configuration declared for this application.</div>'
+}
+function closeConfig(){ document.getElementById('cfgModal').classList.remove('open') }
+document.addEventListener('keydown', e => { if (e.key === 'Escape') closeConfig() })
+
 async function refresh(){
   const s = await fetch('/api/state').then(r => r.json()).catch(() => null)
   if (!s) return
@@ -471,6 +560,12 @@ const server = http.createServer(async (req, res) => {
     }))
     return json(res, 200, { currentBranch: currentBranch(), hasInfra: (loadConfig().infra || []).length > 0, apps })
   }
+  const cfgm = req.url && req.url.match(/^\/api\/apps\/([^/]+)\/config$/)
+  if (cfgm && req.method === 'GET') {
+    const app = loadConfig().apps.find((a) => a.name === decodeURIComponent(cfgm[1]))
+    if (!app) return json(res, 404, { error: 'unknown app' })
+    return json(res, 200, { configs: (app.configs || []).map((c) => readConfig(app, c)) })
+  }
   const m = req.url && req.url.match(/^\/api\/apps\/([^/]+)\/(build|start|stop|deploy)$/)
   if (m && req.method === 'POST') {
     const app = loadConfig().apps.find((a) => a.name === decodeURIComponent(m[1]))
@@ -522,7 +617,18 @@ server.listen(PORT, () => console.log(`cicd app on :${PORT}`))
 Decisions table, one `infra` entry per row of the plan's `## Infrastructure` table.
 `deployMethod`/`deploy` come from the plan's Deploy columns (`deploy` is `null` when the method
 is `none`). `infra[].url` is `null` for a headless service (Console URL cell `-`); emit
-`"infra": []` when the plan declares no supporting services:
+`"infra": []` when the plan declares no supporting services.
+
+Each app also carries a `configs` array — the runtime config files the application reads at start,
+from the plan's `## Application Configs` section (one entry per file). Fields:
+`path` (relative to the application folder), `label`, `source` (`environment` | `env-file` |
+`derived`), `managed` (when `true` the server writes `content` to `path` before Build/Start if the
+file is missing, so start-up always has complete config), `keys` (the required keys the app needs
+to boot), `note`, and `content` (the plan's resolved file body when `managed`; `null`/omitted for an
+`env-file` used as-is on disk). Emit `"configs": []` when an application needs no runtime config
+file. NEVER omit a `managed.content` that the plan resolved — that body is what guarantees the app
+starts configured. Per the dev-environment plaintext rule, `content` may include credentials
+verbatim (this is a local dev CI/CD app).
 
 ```json
 {
@@ -538,7 +644,27 @@ is `none`). `infra[].url` is `null` for a headless service (Console URL cell `-`
       "stop": "process-kill",
       "deployMethod": "kubernetes",
       "deploy": "kubectl apply -f my-app/k8s/",
-      "health": "http://127.0.0.1:3000/"
+      "health": "http://127.0.0.1:3000/",
+      "configs": [
+        {
+          "path": ".env",
+          "label": ".env (runtime)",
+          "source": "environment",
+          "managed": true,
+          "keys": ["DATABASE_URL", "REDIS_HOST", "PORT"],
+          "note": "Resolved from ENVIRONMENT.md → my-app section",
+          "content": "DATABASE_URL=postgres://app:app@127.0.0.1:5432/appdb\nREDIS_HOST=127.0.0.1\nPORT=3000\n"
+        },
+        {
+          "path": ".env-uat",
+          "label": ".env-uat (existing)",
+          "source": "env-file",
+          "managed": false,
+          "keys": ["DATABASE_URL", "REDIS_HOST"],
+          "note": "Existing env file in the app folder — used as-is",
+          "content": null
+        }
+      ]
     }
   ],
   "infra": [

package/plugin/skills/util-plancicd/SKILL.md

@@ -10,7 +10,12 @@ description: >
   method (container vs bare process), build command (e.g. Spring Boot jar vs Docker image),
   start command, stop mechanism, deploy method + command (none / web-server copy / docker run /
   kubectl apply — only when the environment calls for one), port and health-check URL, plus a
-  port for the generated CI/CD app itself. It also enumerates the project's supporting
+  port for the generated CI/CD app itself. It also infers each application's RUNTIME CONFIG — the
+  config files its start command reads (e.g. `.env`), deciding per file whether the values come
+  from ENVIRONMENT.md or from an existing `.env` / `.env-*` file already in the app folder, listing
+  the required keys and, for ENVIRONMENT.md-sourced files, the resolved content — so the generated
+  CI/CD app can complete the config before start (guaranteeing the app comes up) and show it in a
+  per-application Config modal for troubleshooting. It also enumerates the project's supporting
   infrastructure (3rd-party services from CLAUDE.md's `# Supporting 3rd Party Applications` and
   ENVIRONMENT.md — host, port and optional console URL) into an `## Infrastructure` section so
   the generated CI/CD app can surface a status-only Infrastructure page. The plan carries a
@@ -47,6 +52,7 @@ If the argument is missing or the file does not exist, STOP and tell the user to
 | Dev tools | `DEVTOOL.md` (project root) |
 | Project context | `CLAUDE.md` (project root; `source/CLAUDE.md` fallback) |
 | App specification | `<app_folder>/context/specification/SPECIFICATION.md` |
+| App config files | `<app_folder>/.env`, `<app_folder>/.env-*` (and stack-conventional config files) |
 | Infrastructure | `CLAUDE.md` `# Supporting 3rd Party Applications` + `ENVIRONMENT.md` |
 | Output plan | `cicd/CICD_PLAN.md` |
 
@@ -61,6 +67,13 @@ If the argument is missing or the file does not exist, STOP and tell the user to
 4. For each application, read its SPECIFICATION.md tech-stack section if present; otherwise
    infer the stack from build files (`package.json` → node, `pom.xml` → spring-boot,
    `composer.json` → laravel).
+4a. For each application, discover its RUNTIME CONFIG files: list any existing `.env` / `.env-*`
+   in the application folder AND the stack-conventional config the start command reads (node/
+   laravel → `.env`; Spring Boot → `application.properties` / `application-<profile>.yml` or a
+   `.env` when the app loads one). Read the content of each existing file (values may be reused).
+   Cross-reference ENVIRONMENT.md for the per-application config values (DB/cache/broker hosts and
+   ports, external-service URLs, credentials, secrets, the app's own PORT) and the Infrastructure
+   list from step 5 for the hosts/ports the app must point at.
 5. Build the **infrastructure list**: one entry per supporting 3rd-party service the project
    declares. For each, resolve `host` (default `127.0.0.1`), `port` and — when it exposes a web
    console/UI — a `url`, cross-referencing ENVIRONMENT.md for the actual host/port/endpoint. A
@@ -108,6 +121,35 @@ If the argument is missing or the file does not exist, STOP and tell the user to
   path is informational — detection keys on the port, not the path).
 - **CI/CD app port**: 4100 unless taken in `# Port Allocation`; record it in the plan.
 
+### Application config (per application)
+
+Decide the runtime config the application needs so it STARTS SUCCESSFULLY, and where each value
+comes from. For every config file the start command reads (`path`, relative to the application
+folder):
+
+- **source** — classify each file:
+  - `env-file` — an existing `.env` / `.env-*` in the app folder already holds the runtime values;
+    use it as-is on disk (do NOT re-materialize it). Set `managed: no`, no resolved content.
+  - `environment` — there is no complete runtime file; resolve the required values from
+    ENVIRONMENT.md (and the Infrastructure hosts/ports) and record the fully-resolved file content.
+    Set `managed: yes` so the CI/CD app writes it before Build/Start when missing.
+  - `derived` — the runtime file is chosen/combined from existing material (e.g. copy the target
+    env's `.env-<env>` to the canonical `.env` the start command reads, or merge an existing
+    `.env-*` with ENVIRONMENT.md values). Set `managed: yes` and record the resolved content.
+- **required keys** — enumerate every key the app must have to boot: its own PORT, datastore/cache/
+  broker connection strings, external-service URLs, credentials/secrets. Cross-check them against
+  ENVIRONMENT.md and the Infrastructure list.
+- **completeness (the point of this)** — every required key MUST be satisfiable from ENVIRONMENT.md
+  or an existing env file. If a required key cannot be resolved, still emit the config entry but
+  call out the unresolved key in that application's Rationale as a GAP (so the human fixes
+  ENVIRONMENT.md before approving) — never silently drop it.
+- **managed content** — for a `managed: yes` file, write the resolved body verbatim into the plan
+  as a fenced block (`path=<file>`). Values (including credentials) are emitted verbatim under the
+  dev-environment plaintext rule; they must never appear in the Rationale narrative.
+
+Only list files the app actually reads at runtime — do not invent config files. An app that needs
+no config file gets an empty config list.
+
 ### Infrastructure (status-only)
 
 Supporting 3rd-party services are **not** built/started/deployed by the CI/CD app — they are
@@ -125,9 +167,10 @@ Never emit credentials into the infrastructure entries — status and links only
 
 ## Phase 3 — Write the plan
 
-Create `cicd/` if missing and write `cicd/CICD_PLAN.md`:
+Create `cicd/` if missing and write `cicd/CICD_PLAN.md` (shown here in a 4-backtick fence so the
+inner ```env config block renders — the plan file itself uses a normal 3-backtick env fence):
 
-```markdown
+````markdown
 # CI/CD Deployment Plan — <Project Name>
 
 **Generated**: <ISO date>
@@ -149,6 +192,32 @@ Create `cicd/` if missing and write `cicd/CICD_PLAN.md`:
 > **Health** host — so an app is detected whichever family it binds. Use a `localhost` Health host
 > for Node/Vite/Next apps (they bind IPv6 `::1`) and `127.0.0.1` for JVM apps.
 
+## Application Configs
+
+The runtime config each application needs to START SUCCESSFULLY. The generated CI/CD app writes any
+`managed=yes` file into the application folder before Build/Start when it is missing, and shows
+every file (source, status, required keys, live content) in the per-application Config modal for
+troubleshooting. One table per application; `Path` is relative to the application folder.
+
+### <App Name> (<folder>)
+
+| Path | Source | Managed | Required Keys |
+|---|---|---|---|
+| .env | environment | yes | DATABASE_URL, REDIS_HOST, PORT |
+| .env-uat | env-file | no | DATABASE_URL, REDIS_HOST |
+
+For each `Managed=yes` row, follow it with the resolved file body (verbatim — credentials allowed
+under the dev-plaintext rule):
+
+```env path=.env
+DATABASE_URL=postgres://app:app@127.0.0.1:5432/appdb
+REDIS_HOST=127.0.0.1
+PORT=3000
+```
+
+Omit the fenced block for `env-file` rows (the file is used as-is on disk). If an application needs
+no config file, write `_No runtime config files._` under its heading.
+
 ## Infrastructure
 
 Supporting 3rd-party services shown status-only (TCP reachability) on the CI/CD app's
@@ -161,7 +230,7 @@ Infrastructure page. Leave the table body empty when the project declares no sup
 ## Rationale
 
 - <per-application: why this method/commands, citing ENVIRONMENT.md/DEVTOOL.md evidence>
-```
+````
 
 Then flip `**Status**: IN PROGRESS` to `**Status**: COMPLETED`. The studio watcher advances
 only on COMPLETED.

package/static/assets/{abnfDiagram-VRR7QNED-DPeOXHkD.js → abnfDiagram-VRR7QNED-CzKpxD9q.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-Do9cetyI.js";import{p as f}from"./chunk-JWPE2WC7-DbWRh-D_.js";import{_ as n,l as o}from"./index-BeEg-X0n.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-DJsuSCkt.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-DCSpai7w.js";import{p as f}from"./chunk-JWPE2WC7-sOygQj_B.js";import{_ as n,l as o}from"./index-CCC4-Ibh.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-CzQkWtdY.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};

package/static/assets/{arc-Bb2ZEtXe.js → arc-0jj0p8Qe.js}

@@ -1 +1 @@
-import{Y as ln,$ as an,a0 as y,a1 as tn,a2 as F,a3 as q,a4 as _,a5 as un,a6 as rn,a7 as J,a8 as o,a9 as j,aa as sn,ab as on,ac as fn}from"./index-BeEg-X0n.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(fn(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,B=un(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(un(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<rn)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(on((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{Y as ln,$ as an,a0 as y,a1 as tn,a2 as F,a3 as q,a4 as _,a5 as un,a6 as rn,a7 as J,a8 as o,a9 as j,aa as sn,ab as on,ac as fn}from"./index-CCC4-Ibh.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(fn(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,B=un(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(un(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<rn)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(on((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};