@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/expo-supabase/prompts/quality.md

@@ -0,0 +1,143 @@
+# Quality & Performance Standards
+
+## Performance Rules
+
+### Critical
+
+1. **Bundle size**
+   - Keep JavaScript bundles reasonable
+   - Use dynamic imports for code splitting
+   - Avoid large libraries when smaller alternatives exist
+   - Tree-shake unused code
+
+2. **Image optimization**
+   - Use optimized image formats
+   - Provide appropriate resolutions for devices
+   - Lazy load off-screen images
+   - Use Expo's Image component
+
+3. **Navigation performance**
+   - Minimize screen transitions
+   - Preload critical screens
+   - Avoid heavy computations in render
+
+4. **Memory management**
+   - Clean up subscriptions in useEffect
+   - Avoid memory leaks in listeners
+   - Profile with React DevTools
+
+---
+
+## Accessibility (a11y) Rules
+
+### Critical
+
+1. **Touchable elements**
+   - Minimum touch target: 44×44 points
+   - Proper feedback on press
+   - Disabled state clearly visible
+
+2. **Screen reader support**
+   - Add `accessibilityLabel` to interactive elements
+   - Use `accessibilityHint` for context
+   - Mark decorative elements with `accessibilityRole="none"`
+
+3. **Text scaling**
+   - Support Dynamic Type/font scaling
+   - Test with large text sizes
+   - Don't hard-code font sizes
+
+4. **Color contrast**
+   - Text: minimum 4.5:1 ratio
+   - Icons: minimum 3:1 ratio
+   - Test in dark mode
+
+---
+
+## Functionality & Code Quality
+
+### Critical
+
+1. **Error handling**
+   - Catch async errors
+   - Show user-friendly messages
+   - Log errors to Sentry
+
+2. **Loading states**
+   - Show spinners during async operations
+   - Skeleton screens for lists
+   - Pull-to-refresh where appropriate
+
+3. **Form validation**
+   - Client-side validation for UX
+   - Clear error messages
+   - Disable submit while processing
+
+4. **Keyboard handling**
+   - Dismiss keyboard on submit
+   - Proper keyboard types (email, number, etc.)
+   - Handle keyboard avoidance
+
+---
+
+## Security Rules
+
+### Critical
+
+1. **Secure storage**
+   - Use SecureStore for sensitive data
+   - Never store tokens in AsyncStorage
+   - Validate all API responses
+
+2. **Environment variables**
+   - Never commit secrets
+   - Use `expo-constants` for config
+   - Validate env vars on startup
+
+3. **API security**
+   - Always use HTTPS
+   - Validate SSL certificates
+   - Handle auth token expiration
+
+---
+
+## Testing Requirements
+
+### Critical
+
+1. **Unit tests**
+   - Test business logic
+   - Test custom hooks
+   - Mock external dependencies
+
+2. **Component tests**
+   - Test user interactions
+   - Test conditional rendering
+   - Test error states
+
+3. **E2E tests (optional)**
+   - Test critical user flows
+   - Test on real devices
+   - Test offline scenarios
+
+---
+
+## How AI Should Apply These Rules
+
+1. **During implementation**
+   - Follow these rules by default
+   - Add proper error handling
+   - Include loading states
+
+2. **During code review**
+   - Check for violations
+   - Suggest performance improvements
+
+3. **When debugging**
+   - Use React DevTools
+   - Check performance with Profiler
+   - Test on low-end devices
+
+---
+
+*These rules are enforced by `npm run verify:quality`. Run locally before pushing.*

package/bundles/expo-supabase/supabase/migrations/001_initial_schema.sql

@@ -0,0 +1,66 @@
+-- Initial database schema
+-- Generated by Lattice Project Builder
+
+-- Enable UUID extension
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+-- Users profile table (extends auth.users)
+CREATE TABLE IF NOT EXISTS public.profiles (
+  id UUID REFERENCES auth.users(id) ON DELETE CASCADE PRIMARY KEY,
+  email TEXT,
+  full_name TEXT,
+  avatar_url TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Enable Row Level Security
+ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
+
+-- Profiles policies
+CREATE POLICY "Users can view own profile"
+  ON public.profiles FOR SELECT
+  USING (auth.uid() = id);
+
+CREATE POLICY "Users can update own profile"
+  ON public.profiles FOR UPDATE
+  USING (auth.uid() = id);
+
+-- Billing identifiers and any future privileged columns are server-owned.
+REVOKE INSERT, UPDATE, DELETE ON TABLE public.profiles FROM PUBLIC, anon, authenticated;
+GRANT UPDATE (full_name, avatar_url) ON TABLE public.profiles TO authenticated;
+GRANT ALL ON TABLE public.profiles TO service_role;
+
+-- Function to create profile on signup
+CREATE OR REPLACE FUNCTION public.handle_new_user()
+RETURNS TRIGGER AS $$
+BEGIN
+  INSERT INTO public.profiles (id, email, full_name)
+  VALUES (
+    NEW.id,
+    NEW.email,
+    NEW.raw_user_meta_data->>'full_name'
+  );
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER SET search_path = '';
+
+-- Trigger for new user signup
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();
+
+-- Updated at trigger function
+CREATE OR REPLACE FUNCTION public.update_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Apply updated_at trigger to profiles
+CREATE TRIGGER update_profiles_updated_at
+  BEFORE UPDATE ON public.profiles
+  FOR EACH ROW EXECUTE FUNCTION public.update_updated_at();

package/bundles/expo-supabase/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "extends": "expo/tsconfig.base",
+  "compilerOptions": {
+    "strict": true,
+    "types": [
+      "jest",
+      "react"
+    ],
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".expo/types/**/*.ts",
+    "expo-env.d.ts"
+  ]
+}

package/bundles/expo-supabase/types/database.types.ts

@@ -0,0 +1,76 @@
+// Generated database types
+// Run: npx supabase gen types typescript --local > types/database.types.ts
+// to generate actual types from your database
+
+export type Json =
+  | string
+  | number
+  | boolean
+  | null
+  | { [key: string]: Json | undefined }
+  | Json[];
+
+export interface Database {
+  public: {
+    Tables: {
+      profiles: {
+        Row: {
+          id: string;
+          email: string | null;
+          full_name: string | null;
+          avatar_url: string | null;
+          stripe_customer_id: string | null;
+          created_at: string;
+          updated_at: string;
+        };
+        Insert: {
+          id: string;
+          email?: string | null;
+          full_name?: string | null;
+          avatar_url?: string | null;
+          stripe_customer_id?: string | null;
+          created_at?: string;
+          updated_at?: string;
+        };
+        Update: {
+          id?: string;
+          email?: string | null;
+          full_name?: string | null;
+          avatar_url?: string | null;
+          stripe_customer_id?: string | null;
+          created_at?: string;
+          updated_at?: string;
+        };
+        Relationships: [];
+      };
+      billing_subscriptions: {
+        Row: {
+          id: string;
+          user_id: string;
+          stripe_customer_id: string;
+          stripe_price_id: string | null;
+          status: string;
+          updated_at: string;
+        };
+        Insert: {
+          id: string;
+          user_id: string;
+          stripe_customer_id: string;
+          stripe_price_id?: string | null;
+          status: string;
+          updated_at?: string;
+        };
+        Update: {
+          stripe_price_id?: string | null;
+          status?: string;
+          updated_at?: string;
+        };
+        Relationships: [];
+      };
+    };
+    Views: { [_ in never]: never };
+    Functions: { [_ in never]: never };
+    Enums: { [_ in never]: never };
+    CompositeTypes: { [_ in never]: never };
+  };
+}

package/bundles/nextjs-landing/.agents/skills/lattice-feature-handoff/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: lattice-feature-handoff
+description: Prepare an evidence-backed feature handoff for Lattice release review after scoped implementation or when work is blocked.
+---
+
+# Lattice Feature Handoff
+
+Use this skill after a scoped feature task, before asking for merge or release review, or when a prerequisite blocks completion.
+
+## Authority
+
+You may implement the approved scope, run checks, and prepare a handoff. You may not merge, deploy, migrate data, change provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Steps
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.lattice/release-workflow.json`.
+2. Confirm the repository, worktree, branch, approved base ref, base SHA, and current head SHA. Do not infer lineage from a task description.
+3. Inspect the exact diff and preserve unrelated work. Record included and excluded scope.
+4. Run the repository checks required for the change. Record every material command as `passed`, `failed`, `not_run`, or `blocked`; never convert missing proof into a pass.
+5. Assess database migrations, environment changes, background workers, provider effects, and destructive actions. A field needing review must remain `needs_assessment`.
+6. Copy `.lattice/templates/feature-handoff.json` to `.lattice/runtime/<handoff-id>.json` and replace every placeholder. Do not include credentials, tokens, secret values, payment data, or direct personal contact data.
+7. Check that the handoff parses as JSON and contains every field required by `.lattice/schemas/feature-handoff.schema.json`.
+8. Set exactly one status:
+   - `READY_FOR_RELEASE`: scoped implementation and its required proof are complete.
+   - `NEEDS_REWORK`: a confirmed defect or failed check remains.
+   - `BLOCKED`: an external prerequisite, missing authority, or unsafe ambiguity prevents progress.
+9. If the current environment exposes a native messaging tool and an exact Release Manager destination is bound, send the handoff there. Otherwise use the repository's GitHub issue, pull request, or comment, or surface the exact artifact path to the owner. Never claim delivery without tool evidence.
+
+## Handoff Summary
+
+Report the artifact path, status, base SHA, head SHA, checks, operational impacts, required approvals, and transport result. `READY_FOR_RELEASE` means ready for independent review, not merged, deployed, released, or live.

package/bundles/nextjs-landing/.agents/skills/lattice-release-manager/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: lattice-release-manager
+description: Independently audit a Lattice feature handoff and prepare an evidence-backed release recommendation without assuming production authority.
+---
+
+# Lattice Release Manager
+
+Use this skill when a feature handoff is ready for independent release review or needs an evidence-backed rework decision.
+
+## Authority
+
+You may inspect source state, review the exact diff, run non-destructive checks, request rework, and prepare a release recommendation. You may not deploy or promote production, migrate data, write to provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Review
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, `.lattice/release-workflow.json`, and the handoff schema.
+2. Resolve the actual repository and worktree. Verify the handoff base SHA, head SHA, branch, and diff. A mismatch blocks the review until reconciled.
+3. Review only the exact candidate. Treat handoff claims as evidence to verify, not truth to repeat.
+4. Rerun the checks proportionate to the change and inspect failure, permission, recovery, migration, provider, worker, and environment boundaries that are in scope.
+5. Confirm no secret values or direct personal contact or payment data appear in the handoff.
+6. Return one decision:
+   - Accept for owner approval: the exact candidate and required proof pass.
+   - Request rework: a reproducible defect, failed gate, incomplete evidence, or scope mismatch is identified.
+   - Block: lineage, authority, environment, or safety cannot be resolved.
+7. When rework is required and a native tool plus exact origin task are available, send the evidence to that task. Otherwise record it on the shared GitHub surface or preserve a handoff artifact and report that routing remains pending.
+
+## Release State
+
+Keep these states separate: automated validation, candidate preparation, owner approval, deployment, and live verification. Do not merge or clean feature work until the authorized release is proven live and rollback evidence is current.

package/bundles/nextjs-landing/.agents/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Next.js
+- Use Next.js App Router patterns from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/nextjs-landing/.claude/agents/lattice-feature-agent.md

@@ -0,0 +1,10 @@
+---
+name: lattice-feature-agent
+description: Implements one approved feature in an isolated worktree and prepares a Lattice release handoff.
+tools: Read, Glob, Grep, Edit, Write, Bash, Skill, SendMessage
+model: inherit
+permissionMode: default
+isolation: worktree
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-feature-handoff/SKILL.md` before editing. Work only on the assigned scope, run proportionate checks, and produce the schema-shaped handoff. Use `SendMessage` only when the exact destination is present. Never merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.

package/bundles/nextjs-landing/.claude/agents/lattice-release-manager.md

@@ -0,0 +1,9 @@
+---
+name: lattice-release-manager
+description: Independently audits a Lattice feature handoff and returns a release, rework, or blocked decision.
+tools: Read, Glob, Grep, Bash, Skill, SendMessage
+model: inherit
+permissionMode: plan
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-release-manager/SKILL.md`. Verify the actual repository, exact base and head SHAs, diff, checks, impacts, and approval gates. Use `SendMessage` only when the exact origin is present. Never claim a candidate is merged, deployed, released, or live without matching proof.

package/bundles/nextjs-landing/.claude/hooks/README.md

@@ -0,0 +1,9 @@
+# Claude Hook Templates
+
+These scripts are templates generated by Lattice Project Builder.
+
+- `pre-tool-use`: blocks obviously dangerous shell patterns.
+- `pre-commit-verify`: runs `npm run verify` before commit workflows.
+
+The generated `.claude/settings.json` already wires `pre-tool-use`.
+If you want a commit-time hook, wire `pre-commit-verify.mjs` into your local git workflow.

package/bundles/nextjs-landing/.claude/hooks/pre-commit-verify.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const result = spawnSync(npmCommand, ["run", "verify"], {
+  stdio: "inherit",
+});
+
+process.exit(result.status ?? 1);

package/bundles/nextjs-landing/.claude/hooks/pre-tool-use.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/* global Buffer */
+import process from "node:process";
+
+async function main() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+
+  const payload = chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : "";
+  let command = "";
+
+  try {
+    const parsed = JSON.parse(payload || "{}");
+    command =
+      typeof parsed?.tool_input?.command === "string" ? parsed.tool_input.command : "";
+  } catch {
+    command = "";
+  }
+
+  const blockedPatterns = [
+    {
+      pattern: /(^|\s)rm\s+-rf(\s|$)/,
+      reason: "Blocked dangerous command pattern: rm -rf",
+    },
+    {
+      pattern: /git\s+reset\s+--hard/,
+      reason: "Blocked dangerous command pattern: git reset --hard",
+    },
+  ];
+
+  const blocked = blockedPatterns.find(({ pattern }) => pattern.test(command));
+  if (!blocked) {
+    return;
+  }
+
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: blocked.reason,
+      },
+    }),
+  );
+}
+
+main().catch(() => {
+  process.exit(0);
+});

package/bundles/nextjs-landing/.claude/rules/lattice-core.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.{ts,tsx,js,jsx}"
+  - "app/**"
+  - "components/**"
+  - "lib/**"
+  - "src/**"
+  - "package.json"
+---
+
+# Lattice Core Code Rule
+
+Claude loads this rule when working on source or project configuration files.
+
+- Match the existing Next.js patterns before creating new structure.
+- Keep edits scoped to the user's request and the plan in `PROJECT_GUIDE.md`.
+- Prefer small, reviewable diffs.
+- Use `/lattice-verify` or the generated `.claude/skills/lattice-verify/SKILL.md` workflow before final handoff.
+- Ask before destructive commands, production writes, dependency upgrades, or secret-handling changes.
+- Follow Next.js App Router conventions and prefer Server Components unless interactivity requires a client component.

package/bundles/nextjs-landing/.claude/settings.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "defaultMode": "default",
+    "allow": [
+      "Read(**)",
+      "Edit(**)",
+      "Glob(**)",
+      "Grep(**)",
+      "Bash(npm run lint)",
+      "Bash(npm run typecheck)",
+      "Bash(npm run test)",
+      "Bash(npm run build)",
+      "Bash(npm run verify)"
+    ],
+    "deny": [
+      "Bash(rm -rf *)",
+      "Bash(sudo *)",
+      "Bash(git reset --hard *)",
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pre-tool-use.mjs"
+          }
+        ]
+      }
+    ]
+  }
+}

package/bundles/nextjs-landing/.claude/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Next.js
+- Use Next.js App Router patterns from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/nextjs-landing/.codex/agents/lattice-feature-agent.toml

@@ -0,0 +1,9 @@
+name = "lattice-feature-agent"
+description = "Implements one approved feature in isolation and prepares a schema-shaped Lattice handoff for release review."
+sandbox_mode = "workspace-write"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-feature-handoff/SKILL.md before editing.
+Work only on the assigned scope in the isolated worktree supplied by the parent.
+Run proportionate checks and produce the exact handoff evidence required by the shared skill.
+Do not merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.
+"""

package/bundles/nextjs-landing/.codex/agents/lattice-release-manager.toml

@@ -0,0 +1,9 @@
+name = "lattice-release-manager"
+description = "Read-only release auditor that verifies exact Git lineage, diff, checks, impacts, and approval gates."
+sandbox_mode = "read-only"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-release-manager/SKILL.md.
+Independently verify the handoff against the actual repository, base SHA, head SHA, and diff.
+Return accept for owner approval, request rework, or block with concrete evidence.
+Never describe a candidate as merged, deployed, released, or live without matching proof.
+"""

package/bundles/nextjs-landing/.cursor/mcp.json

@@ -0,0 +1,34 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem@1.0.0",
+        "."
+      ],
+      "disabled": true
+    },
+    "github": {
+      "url": "https://api.githubcopilot.com/mcp/readonly",
+      "headers": {
+        "Authorization": "Bearer ${env:GITHUB_TOKEN}"
+      },
+      "disabled": true
+    },
+    "supabase": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@supabase/mcp-server-supabase@0.14.0",
+        "--read-only",
+        "--project-ref",
+        "${env:SUPABASE_PROJECT_REF}"
+      ],
+      "env": {
+        "SUPABASE_ACCESS_TOKEN": "${env:SUPABASE_ACCESS_TOKEN}"
+      },
+      "disabled": true
+    }
+  }
+}

package/bundles/nextjs-landing/.cursor/rules/lattice-core.mdc

@@ -0,0 +1,35 @@
+---
+description: Lattice Core engineering rules for this Next.js repo. Use for implementation, verification, and release-safety work.
+globs:
+  - "**/*"
+alwaysApply: true
+---
+
+# Lattice Core Rules
+
+## Scope
+- Implement exactly what is requested.
+- Preserve existing behavior unless change is requested.
+- Read `AGENTS.md` and `PROJECT_GUIDE.md` before coding.
+- Use this project rule for Agent Chat. Cursor Tab and inline edit do not receive these rules.
+
+## Quality Gates
+- Run `npm run lint`
+- Run `npm run typecheck`
+- Run `npm run test`
+- Run `npm run build`
+- Run `npm run verify`
+
+## Skills and Tools
+- Use `.agents/skills/lattice-verify/SKILL.md` when a task asks for verification, release readiness, or final handoff checks.
+- Project MCP examples live in `.cursor/mcp.json`; keep credentials in environment variables.
+- Keep rules short. Add a focused skill instead of growing this always-applied rule when the guidance is procedural.
+
+## Security
+- Never commit secrets or credentials.
+- Use env vars for sensitive values.
+- Refuse destructive shell commands unless explicitly requested.
+
+## Framework Rules
+- Active framework: Next.js
+- Use App Router and prefer Server Components.