@zaaxch/tailframe 3.0.0 → 4.0.0

package/src/owned-guidance.mjs

@@ -1,15 +1,27 @@
 export const OWNED_GUIDANCE_START = "<!-- tailframe:owned:start -->";
 export const OWNED_GUIDANCE_END = "<!-- tailframe:owned:end -->";
 
-export function ownedGuidance(config) {
-	const profileList = config.profiles.length ? config.profiles.join(", ") : "none";
-	const client = config.kind !== "service";
+export function productGuidance(config) {
+	const apps = config.apps.map((app) => `\`${app.kind}\` at \`${app.path}\` (${app.profiles.join(", ") || "no optional profiles"})`).join("; ");
 	return `${OWNED_GUIDANCE_START}
-## Tailframe-owned contract
+## Tailframe-owned product contract
 
-- Contract: \`${config.contractVersion}\`; kind: \`${config.kind}\`; profiles: ${profileList}.
-- Run \`npm run sync:architecture\` and \`npm run validate:architecture\` after architectural changes.
+- Contract: \`${config.contractVersion}\`; kind: \`product\`.
+- Applications: ${apps}.
+- Run \`pnpm sync:architecture\` and \`pnpm validate:architecture\` from the product root after architectural changes.
+- The product root is the only Git, package-manager, lockfile, Tailframe-manifest, and agent-context boundary.
 - Files written by \`tailframe sync --write\` are generated sources. Change their canonical templates in Tailframe, not in this product.
-- Keep product capabilities under ${client ? "`src/modules/<module>` (or `lib/modules/<module>` for Flutter)" : "`src/modules/<module>`"}; keep application assembly, technology-neutral contracts, and provider adapters in their canonical app/core/platform roots.
-${client ? "- Notifications use the Tailframe-owned application-shell queue and host. Product copy remains in the owning capability module.\n" : "- Every use case exposes `execute(context, input)`. Entry points construct a request or system context and pass an explicit input object.\n- Resident processes perform no DDL. `schema:apply` is the only schema lifecycle entry point.\n- RPC operations use `<owning-module>.<operation>` with no compatibility aliases.\n"}${OWNED_GUIDANCE_END}`;
+${OWNED_GUIDANCE_END}`;
+}
+
+export function appGuidance(productConfig, app) {
+	const profileList = app.profiles.length ? app.profiles.join(", ") : "none";
+	const client = app.kind !== "service";
+	return `${OWNED_GUIDANCE_START}
+## Tailframe-owned application contract
+
+- Product contract: \`${productConfig.contractVersion}\`; kind: \`${app.kind}\`; path: \`${app.path}\`; profiles: ${profileList}.
+- Run product-level validation and sync from the repository root; use \`tailframe validate --app ${app.kind}\` for a focused architecture check.
+- Keep product capabilities under \`src/modules/<module>\`; keep application assembly, technology-neutral contracts, and provider adapters in their canonical app/core/platform roots.
+${client ? "- Notifications use the Tailframe-owned application-shell queue and host. Product copy remains in the owning capability module.\n" : "- Every use case exposes \`execute(context, input)\`. Entry points construct a request or system context and pass an explicit input object.\n- Resident processes perform no DDL. \`schema:apply\` is the only schema lifecycle entry point.\n- RPC operations use \`<owning-module>.<operation>\` with no compatibility aliases.\n"}${OWNED_GUIDANCE_END}`;
 }

package/src/owned-sources.mjs

@@ -15,7 +15,6 @@ import {
 	useCaseSource
 } from "./service-templates.mjs";
 import {
-	extensionAuthStoreSource,
 	notificationHostSource,
 	notificationStoreSource,
 	uiErrorMessagesSource,
@@ -179,247 +178,8 @@ describe("notification shell", () => {
 });
 `;
 
-const flutterErrorsSource = `enum FailureKind {
-  invalid,
-  unauthenticated,
-  forbidden,
-  notFound,
-  conflict,
-  unprocessable,
-  rateLimited,
-  unavailable,
-  internal,
-  network,
-}
-
-class ServiceException implements Exception {
-  const ServiceException({
-    required this.code,
-    required this.message,
-    required this.kind,
-    this.statusCode,
-    this.details,
-  });
-
-  final String code;
-  final String message;
-  final FailureKind kind;
-  final int? statusCode;
-  final Object? details;
-
-  @override
-  String toString() => message;
-}
-
-FailureKind failureKindForStatus(int? statusCode) {
-  if (statusCode == null) return FailureKind.network;
-  if (statusCode == 401) return FailureKind.unauthenticated;
-  if (statusCode == 403) return FailureKind.forbidden;
-  if (statusCode == 404) return FailureKind.notFound;
-  if (statusCode == 409) return FailureKind.conflict;
-  if (statusCode == 422) return FailureKind.unprocessable;
-  if (statusCode == 429) return FailureKind.rateLimited;
-  if (statusCode == 503) return FailureKind.unavailable;
-  if (statusCode >= 500) return FailureKind.internal;
-  return FailureKind.invalid;
-}
-`;
-
-const flutterRpcSource = `typedef JsonObject = Map<String, dynamic>;
-
-JsonObject? rpcErrorFrom(Object? value) {
-  if (value is! JsonObject) return null;
-  final error = value['error'];
-  return error is JsonObject ? error : null;
-}
-
-T rpcResult<T>(Object? value) {
-  if (value is! JsonObject || !value.containsKey('result')) {
-    throw const FormatException('The server returned an invalid response.');
-  }
-  return value['result'] as T;
-}
-`;
-
-const flutterNotificationSource = `import 'dart:async';
-
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-
-enum NotificationKind { info, success, warning, error }
-
-class AppNotification {
-  const AppNotification({
-    required this.id,
-    required this.message,
-    required this.kind,
-    required this.duration,
-  });
-
-  final int id;
-  final String message;
-  final NotificationKind kind;
-  final Duration duration;
-}
-
-class NotificationState {
-  const NotificationState(this.queue);
-
-  final List<AppNotification> queue;
-  AppNotification? get active => queue.isEmpty ? null : queue.first;
-}
-
-class NotificationNotifier extends Notifier<NotificationState> {
-  Timer? _timer;
-  int _nextId = 1;
-
-  @override
-  NotificationState build() => const NotificationState([]);
-
-  void notify(
-    String message, {
-    NotificationKind kind = NotificationKind.info,
-    Duration duration = const Duration(seconds: 4),
-  }) {
-    final notification = AppNotification(
-      id: _nextId++,
-      message: message,
-      kind: kind,
-      duration: duration,
-    );
-    final wasEmpty = state.queue.isEmpty;
-    state = NotificationState([...state.queue, notification]);
-    if (wasEmpty) _scheduleActive();
-  }
-
-  void dismiss(int id) {
-    final wasActive = state.active?.id == id;
-    state = NotificationState(
-      state.queue.where((notification) => notification.id != id).toList(),
-    );
-    if (wasActive) _scheduleActive();
-  }
-
-  void clear() {
-    _timer?.cancel();
-    _timer = null;
-    state = const NotificationState([]);
-  }
-
-  void _scheduleActive() {
-    _timer?.cancel();
-    _timer = null;
-    final notification = state.active;
-    if (notification != null && notification.duration > Duration.zero) {
-      _timer = Timer(notification.duration, () => dismiss(notification.id));
-    }
-  }
-}
-
-final notificationProvider =
-    NotifierProvider<NotificationNotifier, NotificationState>(
-      NotificationNotifier.new,
-    );
-`;
-
-const flutterNotificationHostSource = `import 'package:flutter/material.dart';
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-
-import '../state/notification_notifier.dart';
-
-class NotificationHost extends ConsumerWidget {
-  const NotificationHost({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final notification = ref.watch(notificationProvider).active;
-    if (notification == null) return const SizedBox.shrink();
-    final colors = Theme.of(context).colorScheme;
-    final background = switch (notification.kind) {
-      NotificationKind.info => colors.primary,
-      NotificationKind.success => Colors.green.shade800,
-      NotificationKind.warning => Colors.orange.shade900,
-      NotificationKind.error => colors.error,
-    };
-    return Semantics(
-      liveRegion: true,
-      child: Material(
-        color: background,
-        borderRadius: BorderRadius.circular(12),
-        elevation: 6,
-        child: Padding(
-          padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 12),
-          child: Row(
-            mainAxisSize: MainAxisSize.min,
-            children: [
-              Flexible(
-                child: Text(
-                  notification.message,
-                  style: const TextStyle(color: Colors.white),
-                ),
-              ),
-              IconButton(
-                tooltip: 'Dismiss notification',
-                color: Colors.white,
-                onPressed: () => ref
-                    .read(notificationProvider.notifier)
-                    .dismiss(notification.id),
-                icon: const Icon(Icons.close),
-              ),
-            ],
-          ),
-        ),
-      ),
-    );
-  }
-}
-`;
-
-const flutterNotificationsPublicSource = `export '../state/notification_notifier.dart'
-    show
-        NotificationKind,
-        NotificationNotifier,
-        NotificationState,
-        notificationProvider;
-`;
-
-const flutterNotificationTestSource = (packageName) => `import 'package:${packageName}/app/public/notifications.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-
-void main() {
-  testWidgets('orders, dismisses, times, and clears notifications', (
-    tester,
-  ) async {
-    final container = ProviderContainer();
-    addTearDown(container.dispose);
-    final notifier = container.read(notificationProvider.notifier);
-
-    notifier.notify(
-      'first',
-      kind: NotificationKind.warning,
-      duration: const Duration(milliseconds: 10),
-    );
-    notifier.notify(
-      'second',
-      kind: NotificationKind.success,
-      duration: Duration.zero,
-    );
-    expect(container.read(notificationProvider).active?.message, 'first');
-
-    await tester.pump(const Duration(milliseconds: 11));
-    expect(container.read(notificationProvider).active?.message, 'second');
-    final second = container.read(notificationProvider).active!;
-    notifier.dismiss(second.id);
-    expect(container.read(notificationProvider).active, isNull);
-
-    notifier.notify('third', duration: Duration.zero);
-    notifier.clear();
-    expect(container.read(notificationProvider).queue, isEmpty);
-  });
-}
-`;
-
-export function ownedSources(config, { flutterPackageName } = {}) {
+export function ownedSources(config) {
+	if (!["service", "ui"].includes(config.kind)) throw new Error("Tailframe 4 owns only service and UI sources");
 	const profiles = new Set(config.profiles);
 	if (config.kind === "service") {
 		const files = {
@@ -447,33 +207,16 @@ export function ownedSources(config, { flutterPackageName } = {}) {
 		if (profiles.has("mongo")) files["deploy/mongo/10-create-users.js"] = mongoUsersSource;
 		return files;
 	}
-	if (config.kind === "ui" || config.kind === "extension") {
-		const files = {
-			"src/core/errors.ts": uiErrorsSource,
-			"src/core/rpc.ts": uiRpcSource,
-			"src/platform/errors.ts": uiErrorMessagesSource,
-			"src/platform/http.ts": uiHttpSource
-		};
-		if (config.kind === "extension" && profiles.has("firebase")) {
-			files["src/app/stores/auth.store.ts"] = extensionAuthStoreSource;
-		}
-		if (profiles.has("notifications")) {
-			files["src/app/stores/notification.store.ts"] = notificationStoreSource;
-			files["src/app/components/NotificationHost.vue"] = notificationHostSource;
-			files["src/app/__tests__/notificationStore.test.ts"] = notificationTestSource;
-		}
-		return files;
-	}
 	const files = {
-		"lib/core/errors.dart": flutterErrorsSource,
-		"lib/core/rpc.dart": flutterRpcSource
+		"src/core/errors.ts": uiErrorsSource,
+		"src/core/rpc.ts": uiRpcSource,
+		"src/platform/errors.ts": uiErrorMessagesSource,
+		"src/platform/http.ts": uiHttpSource
 	};
 	if (profiles.has("notifications")) {
-		if (!flutterPackageName) throw new Error("Flutter notification sources require a package name");
-		files["lib/app/state/notification_notifier.dart"] = flutterNotificationSource;
-		files["lib/app/components/notification_host.dart"] = flutterNotificationHostSource;
-		files["lib/app/public/notifications.dart"] = flutterNotificationsPublicSource;
-		files["test/notification_notifier_test.dart"] = flutterNotificationTestSource(flutterPackageName);
+		files["src/app/stores/notification.store.ts"] = notificationStoreSource;
+		files["src/app/components/NotificationHost.vue"] = notificationHostSource;
+		files["src/app/__tests__/notificationStore.test.ts"] = notificationTestSource;
 	}
 	return files;
 }

package/src/sync.mjs

@@ -1,26 +1,11 @@
 import fs from "node:fs";
 import path from "node:path";
-import { loadConfig } from "./config.mjs";
-import { readFlutterPackageName } from "./flutter.mjs";
-import { OWNED_GUIDANCE_END, OWNED_GUIDANCE_START, ownedGuidance } from "./owned-guidance.mjs";
+import { appRoot, loadConfig } from "./config.mjs";
+import { appGuidance, OWNED_GUIDANCE_END, OWNED_GUIDANCE_START, productGuidance } from "./owned-guidance.mjs";
 import { ownedSources } from "./owned-sources.mjs";
 
-export function runSync(rootArgument, mode, runningVersion) {
-	const loaded = loadConfig(rootArgument);
-	if (loaded.errors.length) return { changed: [], errors: loaded.errors };
-	if (loaded.config.contractVersion !== runningVersion) {
-		return { changed: [], errors: [`tailframe.json requires ${loaded.config.contractVersion}, but this CLI is ${runningVersion}`] };
-	}
-	const changed = [];
-	const errors = [];
-	const sourceOptions = {};
-	if (loaded.config.kind === "flutter") {
-		const packageName = readFlutterPackageName(loaded.root);
-		if (!packageName) return { changed, errors: ["pubspec.yaml must declare a package name"] };
-		sourceOptions.flutterPackageName = packageName;
-	}
-	const guidanceFile = path.join(loaded.root, "AGENTS.md");
-	const guidance = ownedGuidance(loaded.config);
+function syncGuidance(productRoot, root, guidance, mode, changed, errors, label) {
+	const guidanceFile = path.join(root, "AGENTS.md");
 	const existingGuidance = fs.existsSync(guidanceFile) ? fs.readFileSync(guidanceFile, "utf8") : "";
 	const start = existingGuidance.indexOf(OWNED_GUIDANCE_START);
 	const end = existingGuidance.indexOf(OWNED_GUIDANCE_END);
@@ -28,29 +13,51 @@ export function runSync(rootArgument, mode, runningVersion) {
 	const currentSection = validSentinels
 		? existingGuidance.slice(start, end + OWNED_GUIDANCE_END.length)
 		: undefined;
-	if (currentSection !== guidance) {
-		if (mode === "check") errors.push("AGENTS.md Tailframe-owned section differs from the canonical guidance");
-		else {
-			let appendix = validSentinels
-				? `${existingGuidance.slice(0, start)}${existingGuidance.slice(end + OWNED_GUIDANCE_END.length)}`.trim()
-				: existingGuidance.trim();
-			appendix = appendix.replace(/^## Product-specific appendix\s*/u, "");
-			const next = appendix
-				? `${guidance}\n\n## Product-specific appendix\n\n${appendix}\n`
-				: `${guidance}\n`;
-			fs.writeFileSync(guidanceFile, next);
-			changed.push("AGENTS.md");
-		}
+	if (currentSection === guidance) return;
+	if (mode === "check") {
+		errors.push(`${label} AGENTS.md Tailframe-owned section differs from the canonical guidance`);
+		return;
+	}
+	let appendix = validSentinels
+		? `${existingGuidance.slice(0, start)}${existingGuidance.slice(end + OWNED_GUIDANCE_END.length)}`.trim()
+		: existingGuidance.trim();
+	appendix = appendix.replace(/^## Product-specific appendix\s*/u, "");
+	const next = appendix
+		? `${guidance}\n\n## Product-specific appendix\n\n${appendix}\n`
+		: `${guidance}\n`;
+	fs.mkdirSync(root, { recursive: true });
+	fs.writeFileSync(guidanceFile, next);
+	changed.push(path.relative(productRoot, guidanceFile));
+}
+
+export function runSync(rootArgument, mode, runningVersion, selectedKind) {
+	const loaded = loadConfig(rootArgument);
+	if (loaded.errors.length) return { changed: [], errors: loaded.errors };
+	if (loaded.config.contractVersion !== runningVersion) {
+		return { changed: [], errors: [`tailframe.json requires ${loaded.config.contractVersion}, but this CLI is ${runningVersion}`] };
 	}
-	for (const [relative, expected] of Object.entries(ownedSources(loaded.config, sourceOptions))) {
-		const absolute = path.join(loaded.root, relative);
-		const actual = fs.existsSync(absolute) ? fs.readFileSync(absolute, "utf8") : undefined;
-		if (actual === expected) continue;
-		if (mode === "check") errors.push(`${relative} differs from the Tailframe ${runningVersion} canonical source`);
-		else {
-			fs.mkdirSync(path.dirname(absolute), { recursive: true });
-			fs.writeFileSync(absolute, expected);
-			changed.push(relative);
+	const changed = [];
+	const errors = [];
+	syncGuidance(loaded.root, loaded.root, productGuidance(loaded.config), mode, changed, errors, "root");
+
+	for (const app of loaded.config.apps.filter((candidate) => !selectedKind || candidate.kind === selectedKind)) {
+		const root = appRoot(loaded.root, app);
+		if (!fs.existsSync(root)) {
+			errors.push(`Missing configured application root: ${app.path}`);
+			continue;
+		}
+		syncGuidance(loaded.root, root, appGuidance(loaded.config, app), mode, changed, errors, app.path);
+		for (const [relative, expected] of Object.entries(ownedSources(app))) {
+			const absolute = path.join(root, relative);
+			const productRelative = path.join(app.path, relative);
+			const actual = fs.existsSync(absolute) ? fs.readFileSync(absolute, "utf8") : undefined;
+			if (actual === expected) continue;
+			if (mode === "check") errors.push(`${productRelative} differs from the Tailframe ${runningVersion} canonical source`);
+			else {
+				fs.mkdirSync(path.dirname(absolute), { recursive: true });
+				fs.writeFileSync(absolute, expected);
+				changed.push(productRelative);
+			}
 		}
 	}
 	return { changed, errors };

package/src/ui-templates.mjs

@@ -232,51 +232,6 @@ onBeforeUnmount(() => {
 </style>
 `;
 
-export const extensionAuthStoreSource = `import { auth, signInWithGoogleAccessToken } from "@/platform/firebase";
-import { invalidateGoogleAccessToken, requestGoogleAccessToken, signOutGoogleSession } from "@/platform/extensionAuth";
-import { onIdTokenChanged, signOut, type User } from "firebase/auth/web-extension";
-import { defineStore } from "pinia";
-import { ref } from "vue";
-
-export const useAuthStore = defineStore("auth", () => {
-	const firebaseUser = ref<User | null>(null);
-	const ready = ref(false);
-
-	onIdTokenChanged(auth, (value) => {
-		firebaseUser.value = value;
-		ready.value = true;
-	});
-
-	async function signInWithGoogle(interactive = true) {
-		let accessToken = await requestGoogleAccessToken(interactive);
-		try {
-			return await signInWithGoogleAccessToken(accessToken);
-		} catch (reason: unknown) {
-			if (
-				!interactive ||
-				typeof reason !== "object" ||
-				reason === null ||
-				!("code" in reason) ||
-				reason.code !== "auth/invalid-credential"
-			)
-				throw reason;
-			await invalidateGoogleAccessToken(accessToken);
-			accessToken = await requestGoogleAccessToken(true);
-			return signInWithGoogleAccessToken(accessToken);
-		}
-	}
-
-	async function logout() {
-		await signOut(auth);
-		await signOutGoogleSession();
-	}
-
-	const getIdToken = () => firebaseUser.value?.getIdToken();
-
-	return { firebaseUser, ready, signInWithGoogle, logout, getIdToken };
-});
-`;
-
 export const configureHttpSource = `import type { Pinia } from "pinia";
 import router from "@/app/router";
 import { useAuthStore } from "@/app/stores/auth.store";

package/src/validate.mjs

@@ -1,16 +1,15 @@
 import fs from "node:fs";
 import path from "node:path";
 import { validateArchitecture } from "./architecture.mjs";
+import { appRoot, loadConfig } from "./config.mjs";
 import { validateConventions } from "./conventions.mjs";
-import { loadConfig } from "./config.mjs";
 import { isExcepted, loadExceptions } from "./exceptions.mjs";
-import { validateFlutter } from "./flutter.mjs";
 import { runSync } from "./sync.mjs";
 
 const NON_EXCEPTABLE_RULES = new Set(["S8", "S9", "U5", "U6", "U7"]);
+const PNPM_VERSION = "11.22.0";
 
 export function runValidate(root, kind) {
-	if (kind === "flutter") return validateFlutter(root);
 	const structural = validateArchitecture(root, kind);
 	if (structural.some((error) => error.startsWith("Architecture root") || error.startsWith("Architecture kind"))) {
 		return structural;
@@ -22,40 +21,87 @@ export function runValidate(root, kind) {
 	return [...structural, ...conventions];
 }
 
+function escapeRegex(value) {
+	return value.replace(/[.*+?^$()|[\]\\{}]/g, "\\$&");
+}
+
 function validateVersionMetadata(root, runningVersion) {
 	const errors = [];
 	const packageFile = path.join(root, "package.json");
-	const lockFile = path.join(root, "package-lock.json");
-	if (!fs.existsSync(packageFile)) return ["package.json is required to pin the Tailframe build-time contract"];
+	const lockFile = path.join(root, "pnpm-lock.yaml");
+	const workspaceFile = path.join(root, "pnpm-workspace.yaml");
+	if (!fs.existsSync(packageFile)) return ["root package.json is required to pin the Tailframe build-time contract"];
 	let manifest;
 	try { manifest = JSON.parse(fs.readFileSync(packageFile, "utf8")); }
-	catch { return ["package.json is not valid JSON"]; }
+	catch { return ["root package.json is not valid JSON"]; }
+	if (manifest.private !== true) errors.push("root package.json must be private");
+	if (manifest.packageManager !== `pnpm@${PNPM_VERSION}`) {
+		errors.push(`root package.json packageManager must be pnpm@${PNPM_VERSION}`);
+	}
 	if (manifest.devDependencies?.["@zaaxch/tailframe"] !== runningVersion) {
-		errors.push(`package.json must pin @zaaxch/tailframe exactly to ${runningVersion}`);
-	}
-	if (!fs.existsSync(lockFile)) return [...errors, "package-lock.json is required to lock the Tailframe contract"];
-	try {
-		const lock = JSON.parse(fs.readFileSync(lockFile, "utf8"));
-		const rootPin = lock.packages?.[""]?.devDependencies?.["@zaaxch/tailframe"];
-		const installed = lock.packages?.["node_modules/@zaaxch/tailframe"]?.version;
-		if (rootPin !== runningVersion) errors.push(`package-lock.json root must pin @zaaxch/tailframe exactly to ${runningVersion}`);
-		if (installed !== runningVersion) errors.push(`package-lock.json resolves @zaaxch/tailframe ${installed ?? "nowhere"}, expected ${runningVersion}`);
-	} catch {
-		errors.push("package-lock.json is not valid JSON");
+		errors.push(`root package.json must pin @zaaxch/tailframe exactly to ${runningVersion}`);
+	}
+	if (!fs.existsSync(workspaceFile)) errors.push("pnpm-workspace.yaml is required at the product root");
+	else {
+		const workspace = fs.readFileSync(workspaceFile, "utf8");
+		if (!/^\s*-\s*["']?apps\/\*["']?\s*$/mu.test(workspace)) {
+			errors.push("pnpm-workspace.yaml must include apps/*");
+		}
+		if (!/^injectWorkspacePackages:\s*true\s*$/mu.test(workspace)) {
+			errors.push("pnpm-workspace.yaml must enable injectWorkspacePackages");
+		}
 	}
+	if (!fs.existsSync(lockFile)) return [...errors, "pnpm-lock.yaml is required to lock the Tailframe contract"];
+	const lock = fs.readFileSync(lockFile, "utf8");
+	const version = escapeRegex(runningVersion);
+	const pin = new RegExp(`['"]?@zaaxch/tailframe['"]?:\\s*\\n\\s*specifier:\\s*['"]?${version}['"]?\\s*\\n\\s*version:\\s*['"]?${version}['"]?`, "u");
+	const resolution = new RegExp(`['"]?@zaaxch/tailframe@${version}['"]?:`, "u");
+	if (!pin.test(lock)) errors.push(`pnpm-lock.yaml root importer must pin @zaaxch/tailframe exactly to ${runningVersion}`);
+	if (!resolution.test(lock)) errors.push(`pnpm-lock.yaml does not resolve @zaaxch/tailframe ${runningVersion}`);
 	return errors;
 }
 
-export function runConfiguredValidate(rootArgument, runningVersion) {
+function validateAppMetadata(productRoot, app) {
+	const errors = [];
+	const root = appRoot(productRoot, app);
+	if (!fs.existsSync(root)) return [`Missing configured application root: ${app.path}`];
+	if (fs.existsSync(path.join(root, "tailframe.json"))) {
+		errors.push(`${app.path}/tailframe.json is forbidden; the product root owns Tailframe metadata`);
+	}
+	if (fs.existsSync(path.join(root, "package-lock.json")) || fs.existsSync(path.join(root, "pnpm-lock.yaml"))) {
+		errors.push(`${app.path} must not contain an application lockfile`);
+	}
+	const packageFile = path.join(root, "package.json");
+	if (!fs.existsSync(packageFile)) errors.push(`${app.path}/package.json is required`);
+	else {
+		try {
+			const manifest = JSON.parse(fs.readFileSync(packageFile, "utf8"));
+			if (manifest.devDependencies?.["@zaaxch/tailframe"] || manifest.dependencies?.["@zaaxch/tailframe"]) {
+				errors.push(`${app.path}/package.json must not depend on @zaaxch/tailframe; pin it at the product root`);
+			}
+		} catch {
+			errors.push(`${app.path}/package.json is not valid JSON`);
+		}
+	}
+	return errors;
+}
+export function runConfiguredValidate(rootArgument, runningVersion, selectedKind) {
 	const loaded = loadConfig(rootArgument);
 	if (loaded.errors.length) return loaded.errors;
 	const errors = [];
 	if (loaded.config.contractVersion !== runningVersion) {
 		errors.push(`tailframe.json requires ${loaded.config.contractVersion}, but this CLI is ${runningVersion}`);
 	}
+	if (selectedKind && !loaded.config.apps.some((app) => app.kind === selectedKind)) {
+		errors.push(`tailframe.json does not declare a ${selectedKind} app`);
+	}
 	errors.push(...validateVersionMetadata(loaded.root, runningVersion));
+	for (const app of loaded.config.apps) errors.push(...validateAppMetadata(loaded.root, app));
 	if (errors.length) return errors;
-	errors.push(...runValidate(loaded.root, loaded.config.kind));
-	errors.push(...runSync(loaded.root, "check", runningVersion).errors);
+	const apps = selectedKind ? loaded.config.apps.filter((app) => app.kind === selectedKind) : loaded.config.apps;
+	for (const app of apps) {
+		for (const error of runValidate(appRoot(loaded.root, app), app.kind)) errors.push(`${app.path}: ${error}`);
+	}
+	errors.push(...runSync(loaded.root, "check", runningVersion, selectedKind).errors);
 	return errors;
 }