PowerCat-CodeAppsCompact 2.7 (lean)

Reuse working infrastructure; author domain rules, fixtures, views and independent assertions. Do not copy a previous benchmark app or hide repairs. Browser-local persistence is synthetic-demo storage, not production authorization.

Portable distribution with unchanged 2.7.0 runtime APIs. Keep this folder complete; scaffolding resolves bundled assets relative to the skill, with no repository checkout or runtime rebuild. Development sources, standalone examples, maintainer tests, generated API snapshots and benchmark-only tooling are omitted. API lookup reads the shipped declarations directly. The runtime package remains private; sharing this skill does not publish an app.

Choose once, then scaffold

For nested records, approvals, ledgers or atomic multi-record commands use --profile aggregate. Its neutral example already wires typed nested drafts, accessible fields/dialogs, errors, discard confirmation, duplicate-submit protection, stale revisions, cross-tab refresh, tables and CSV. Replace the neutral domain and tests, not that infrastructure. Read only aggregate authoring and api-reference.mjs aggregate-ui; consult the aggregate signature only for tables/storage/CSV. Do not rebuild form or persistence lifecycle in every app.

For flat CRUD use --definition <typed-folder> / the integrated workspace; read authoring. --profile minimal is a custom-shell escape hatch, not the default for a multi-module aggregate app. Use the catalog for other capabilities; do not dump all sources, signatures or maintainer tests into model context.

node "<skill>\scripts\create-app.mjs" "<new-app>" --name "Workspace" --local-only --profile aggregate --port 5173 --dry-run

Review, then omit --dry-run. For authorized authenticated hosting, replace --local-only with --environment <authorized-guid>. Never supply both or fabricate a tenant ID. Local-only scaffolds have an empty environment, no host/SDK-context request, and local verify/finalize defaults. The official SDK/plugin remain available for an explicitly authorized hosted scaffold. No command deploys.

Scaffolding never overwrites, installs, executes definitions or changes existing processes. Keep vendor assets and lockfiles project-local. Restore only after a manifest change or missing-dependency failure with approved npm and --install-links --ignore-scripts --strict-peer-deps --legacy-peer-deps=false --force=false --no-audit --no-fund. No denial or registry-policy bypass.