@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/nextjs-landing/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "landing-page-starter",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "jest --passWithNoTests",
+    "verify": "npm run lint && npm run typecheck && npm test && npm run build"
+  },
+  "dependencies": {
+    "next": "16.4.2",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
+    "clsx": "^2.1.1",
+    "tailwind-merge": "^3.4.0",
+    "posthog-js": "1.438.12",
+    "@sentry/nextjs": "11.8.0",
+    "motion": "14.3.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4",
+    "@types/node": "^24",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "eslint": "^9",
+    "eslint-config-next": "16.4.2",
+    "tailwindcss": "^4",
+    "typescript": "6.0.3",
+    "jest": "^30",
+    "@types/jest": "^30",
+    "@testing-library/react": "^16",
+    "@testing-library/jest-dom": "^7",
+    "jest-environment-jsdom": "^30"
+  },
+  "engines": {
+    "node": "24.x"
+  },
+  "overrides": {
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "4.3.2"
+    },
+    "braces": "file:vendor/m2ai-braces-3.0.3-m2ai.1.tar"
+  }
+}

package/bundles/nextjs-landing/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    '@tailwindcss/postcss': {},
+  },
+};
+
+export default config;

package/bundles/nextjs-landing/prompts/01-feature-implementation.md

@@ -0,0 +1,9 @@
+# Feature Implementation
+
+```
+Role: You are building this Next.js landing page.
+Goal: Implement [SECTION NAME] that [PURPOSE].
+Constraints: Use Tailwind CSS, keep animations subtle, mobile-first
+Files to change: [LIST]
+Acceptance: [ ] Looks good on mobile, [ ] verify passes
+```

package/bundles/nextjs-landing/prompts/02-bug-fix.md

@@ -0,0 +1,10 @@
+# Bug Fix
+
+```
+Role: You are debugging this landing page.
+Bug: [DESCRIPTION]
+Steps: 1. [STEP] 2. [STEP]
+Expected: [WHAT SHOULD HAPPEN]
+Actual: [WHAT HAPPENS]
+Fix only the bug, keep diff minimal.
+```

package/bundles/nextjs-landing/prompts/03-safe-refactor.md

@@ -0,0 +1,8 @@
+# Safe Refactor
+
+```
+Role: You are refactoring this landing page.
+Goal: [IMPROVEMENT]
+Scope: [FILES TO CHANGE]
+Constraints: Behavior must remain identical, small diffs only.
+```

package/bundles/nextjs-landing/prompts/04-test-first.md

@@ -0,0 +1,8 @@
+# Test-First Development
+
+```
+Role: Write tests before implementation.
+Feature: [NAME]
+Test cases: 1. [CASE] 2. [CASE]
+Then implement minimal code to pass.
+```

package/bundles/nextjs-landing/prompts/05-ui-polish.md

@@ -0,0 +1,8 @@
+# UI Polish
+
+```
+Role: You are polishing this landing page.
+Target: [COMPONENT]
+Polish: spacing, typography, colors, hover states, mobile
+Do not change functionality.
+```

package/bundles/nextjs-landing/prompts/06-security-review.md

@@ -0,0 +1,7 @@
+# Security Review
+
+```
+Role: Security review of this landing page.
+Check: XSS, exposed keys, form validation, CORS
+Output: | Severity | Issue | File | Recommendation |
+```

package/bundles/nextjs-landing/prompts/quality.md

@@ -0,0 +1,269 @@
+# Quality & Performance Standards
+
+## Performance Rules
+
+### Critical
+
+1. **No CDN dependencies in production**
+   - ❌ Tailwind CSS CDN
+   - ❌ External font CDN without optimization
+   - ✅ Build process with optimized bundles
+   - ✅ Self-hosted fonts or optimized Google Fonts
+
+2. **Font loading optimization**
+   - Use `font-display: swap` for web fonts
+   - Combine multiple font requests
+   - Preload critical fonts
+   - Remove duplicate font imports
+
+3. **CSS optimization**
+   - No massive blur effects (`blur-[100px]`)
+   - Use `will-change` for animations
+   - Prefer `transform` and `opacity` for GPU acceleration
+   - Avoid expensive filter operations
+
+4. **Bundle size**
+   - Keep JavaScript bundles under thresholds:
+     - Initial bundle: < 200KB (gzipped)
+     - Route chunks: < 100KB (gzipped)
+   - Use dynamic imports for code splitting
+   - Tree-shake unused code
+
+### Medium Priority
+
+5. **Resource hints**
+   - Add `dns-prefetch` for external domains
+   - Use `preconnect` for critical resources
+   - Preload critical assets
+
+6. **Image optimization**
+   - Use Next.js `Image` component
+   - Add `loading="lazy"` for below-fold images
+   - Use modern formats (WebP, AVIF)
+   - Provide proper width/height
+
+7. **Inline code**
+   - Extract large inline styles to external CSS
+   - Move scripts to separate files with caching
+   - Keep HTML size reasonable
+
+---
+
+## Accessibility (a11y) Rules
+
+### Critical
+
+1. **Interactive elements MUST have handlers**
+   - Buttons need `onClick` or form `type="submit"`
+   - Links need valid `href` (not `#`)
+   - Form inputs need labels
+
+2. **ARIA labels for icon buttons**
+   ```tsx
+   ❌ <button><MenuIcon /></button>
+   ✅ <button aria-label="Open menu"><MenuIcon /></button>
+   ```
+
+3. **Alt text for images**
+   - Decorative images: `alt=""`
+   - Meaningful images: descriptive alt text
+   - No missing alt attributes
+
+4. **Keyboard navigation**
+   - All interactive elements reachable via keyboard
+   - Visible focus states (`:focus-visible`)
+   - Logical tab order
+
+### Medium Priority
+
+5. **Color contrast**
+   - Text: minimum 4.5:1 ratio
+   - Large text: minimum 3:1 ratio
+   - Use tools to verify
+
+6. **Semantic HTML**
+   - Use proper heading hierarchy (h1 → h2 → h3)
+   - Use `<nav>`, `<main>`, `<article>`, `<section>`
+   - No generic `<div>` for everything
+
+7. **Form accessibility**
+   - Labels properly associated
+   - Error messages announced
+   - Required fields marked
+   - Validation feedback
+
+---
+
+## SEO & Metadata Rules
+
+### Critical
+
+1. **Required meta tags**
+   ```tsx
+   <title>Page Title - Site Name</title>
+   <meta name="description" content="..." />
+   <meta name="viewport" content="width=device-width, initial-scale=1" />
+   ```
+
+2. **Open Graph tags**
+   ```tsx
+   <meta property="og:title" content="..." />
+   <meta property="og:description" content="..." />
+   <meta property="og:image" content="..." />
+   <meta property="og:url" content="..." />
+   ```
+
+3. **Twitter Card tags**
+   ```tsx
+   <meta name="twitter:card" content="summary_large_image" />
+   <meta name="twitter:title" content="..." />
+   <meta name="twitter:description" content="..." />
+   <meta name="twitter:image" content="..." />
+   ```
+
+### Medium Priority
+
+4. **Favicon**
+   - Include `favicon.ico`
+   - Add Apple touch icon
+   - Include manifest.json
+
+5. **Canonical URL**
+   ```tsx
+   <link rel="canonical" href="https://..." />
+   ```
+
+6. **Structured data**
+   - Add JSON-LD for Organization, Product, etc.
+   - Use Schema.org vocabulary
+
+---
+
+## Functionality & Code Quality
+
+### Critical
+
+1. **No broken links**
+   - All `href` must point to valid routes
+   - Use Next.js `Link` for internal navigation
+   - External links open in new tab if appropriate
+
+2. **Mobile menu implementation**
+   - If mobile menu button exists, menu must work
+   - Toggle open/close state properly
+   - Close on outside click or route change
+
+3. **Copy-to-clipboard**
+   - Use `navigator.clipboard.writeText()`
+   - Show success feedback (toast, checkmark)
+   - Handle errors gracefully
+
+4. **Form validation**
+   - Client-side validation for UX
+   - Server-side validation for security
+   - Clear error messages
+
+### Medium Priority
+
+5. **Smooth scrolling**
+   ```css
+   html {
+     scroll-behavior: smooth;
+   }
+   ```
+
+6. **Loading states**
+   - Show spinners/skeletons during async operations
+   - Disable buttons while submitting
+   - Prevent duplicate submissions
+
+7. **Error boundaries**
+   - Catch errors in components
+   - Show fallback UI
+   - Log errors to Sentry
+
+---
+
+## Security Rules
+
+### Critical
+
+1. **No external CDN without SRI**
+   - If using CDN, add Subresource Integrity hash
+   - Or self-host dependencies
+
+2. **Content Security Policy**
+   ```tsx
+   <meta http-equiv="Content-Security-Policy" content="..." />
+   ```
+
+3. **Environment variables**
+   - Never expose secrets in client code
+   - Use `NEXT_PUBLIC_` prefix for client vars
+   - Validate env vars on startup
+
+---
+
+## Testing Requirements
+
+### Critical
+
+1. **Lighthouse CI**
+   - Performance: ≥ 80
+   - Accessibility: ≥ 90
+   - Best Practices: ≥ 90
+   - SEO: ≥ 90
+
+2. **Accessibility testing**
+   - Run axe-core checks
+   - Zero critical violations
+   - Address all serious violations
+
+3. **Visual regression**
+   - Key pages render correctly
+   - Responsive layouts work
+   - No layout shifts (CLS)
+
+---
+
+## When to Run Quality Checks
+
+1. **Pre-commit**
+   - Quick checks (linting, type-check)
+
+2. **Pre-push**
+   - Full verification (`npm run verify:quality`)
+
+3. **CI/CD**
+   - All quality checks must pass
+   - Block merge if quality gates fail
+
+4. **Pre-production**
+   - Full Lighthouse audit
+   - Manual QA on staging
+
+---
+
+## How AI Should Apply These Rules
+
+1. **During implementation**
+   - Follow these rules by default
+   - Don't add non-functional buttons
+   - Don't use CDN for production code
+
+2. **During code review**
+   - Check for violations
+   - Suggest fixes proactively
+
+3. **When generating documentation**
+   - Include quality considerations
+   - Mention performance implications
+
+4. **When debugging**
+   - Use browser DevTools Performance tab
+   - Check Network tab for unnecessary requests
+   - Verify accessibility tree
+
+---
+
+*These rules are enforced by `npm run verify:quality`. Run locally before pushing.*

package/bundles/nextjs-landing/sentry.edge.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+if (process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN) {
+  Sentry.init({
+    dsn: process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN,
+    tracesSampleRate: process.env.NODE_ENV === "development" ? 1 : 0.1,
+    dataCollection: {
+      userInfo: false, cookies: false,
+      httpHeaders: { request: false, response: false }, urlQueryParams: false,
+      httpBodies: [], genAI: { inputs: false, outputs: false },
+      databaseQueryData: false, queues: false,
+      graphQL: { document: false, variables: false },
+    },
+  });
+}

package/bundles/nextjs-landing/sentry.server.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+if (process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN) {
+  Sentry.init({
+    dsn: process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN,
+    tracesSampleRate: process.env.NODE_ENV === "development" ? 1 : 0.1,
+    dataCollection: {
+      userInfo: false, cookies: false,
+      httpHeaders: { request: false, response: false }, urlQueryParams: false,
+      httpBodies: [], genAI: { inputs: false, outputs: false },
+      databaseQueryData: false, queues: false,
+      graphQL: { document: false, variables: false },
+    },
+  });
+}

package/bundles/nextjs-landing/tsconfig.json

@@ -0,0 +1,42 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/bundles/nextjs-saas/.agents/skills/lattice-feature-handoff/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: lattice-feature-handoff
+description: Prepare an evidence-backed feature handoff for Lattice release review after scoped implementation or when work is blocked.
+---
+
+# Lattice Feature Handoff
+
+Use this skill after a scoped feature task, before asking for merge or release review, or when a prerequisite blocks completion.
+
+## Authority
+
+You may implement the approved scope, run checks, and prepare a handoff. You may not merge, deploy, migrate data, change provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Steps
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.lattice/release-workflow.json`.
+2. Confirm the repository, worktree, branch, approved base ref, base SHA, and current head SHA. Do not infer lineage from a task description.
+3. Inspect the exact diff and preserve unrelated work. Record included and excluded scope.
+4. Run the repository checks required for the change. Record every material command as `passed`, `failed`, `not_run`, or `blocked`; never convert missing proof into a pass.
+5. Assess database migrations, environment changes, background workers, provider effects, and destructive actions. A field needing review must remain `needs_assessment`.
+6. Copy `.lattice/templates/feature-handoff.json` to `.lattice/runtime/<handoff-id>.json` and replace every placeholder. Do not include credentials, tokens, secret values, payment data, or direct personal contact data.
+7. Check that the handoff parses as JSON and contains every field required by `.lattice/schemas/feature-handoff.schema.json`.
+8. Set exactly one status:
+   - `READY_FOR_RELEASE`: scoped implementation and its required proof are complete.
+   - `NEEDS_REWORK`: a confirmed defect or failed check remains.
+   - `BLOCKED`: an external prerequisite, missing authority, or unsafe ambiguity prevents progress.
+9. If the current environment exposes a native messaging tool and an exact Release Manager destination is bound, send the handoff there. Otherwise use the repository's GitHub issue, pull request, or comment, or surface the exact artifact path to the owner. Never claim delivery without tool evidence.
+
+## Handoff Summary
+
+Report the artifact path, status, base SHA, head SHA, checks, operational impacts, required approvals, and transport result. `READY_FOR_RELEASE` means ready for independent review, not merged, deployed, released, or live.

package/bundles/nextjs-saas/.agents/skills/lattice-release-manager/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: lattice-release-manager
+description: Independently audit a Lattice feature handoff and prepare an evidence-backed release recommendation without assuming production authority.
+---
+
+# Lattice Release Manager
+
+Use this skill when a feature handoff is ready for independent release review or needs an evidence-backed rework decision.
+
+## Authority
+
+You may inspect source state, review the exact diff, run non-destructive checks, request rework, and prepare a release recommendation. You may not deploy or promote production, migrate data, write to provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Review
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, `.lattice/release-workflow.json`, and the handoff schema.
+2. Resolve the actual repository and worktree. Verify the handoff base SHA, head SHA, branch, and diff. A mismatch blocks the review until reconciled.
+3. Review only the exact candidate. Treat handoff claims as evidence to verify, not truth to repeat.
+4. Rerun the checks proportionate to the change and inspect failure, permission, recovery, migration, provider, worker, and environment boundaries that are in scope.
+5. Confirm no secret values or direct personal contact or payment data appear in the handoff.
+6. Return one decision:
+   - Accept for owner approval: the exact candidate and required proof pass.
+   - Request rework: a reproducible defect, failed gate, incomplete evidence, or scope mismatch is identified.
+   - Block: lineage, authority, environment, or safety cannot be resolved.
+7. When rework is required and a native tool plus exact origin task are available, send the evidence to that task. Otherwise record it on the shared GitHub surface or preserve a handoff artifact and report that routing remains pending.
+
+## Release State
+
+Keep these states separate: automated validation, candidate preparation, owner approval, deployment, and live verification. Do not merge or clean feature work until the authorized release is proven live and rollback evidence is current.

package/bundles/nextjs-saas/.agents/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Next.js
+- Use Next.js App Router patterns from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/nextjs-saas/.claude/agents/lattice-feature-agent.md

@@ -0,0 +1,10 @@
+---
+name: lattice-feature-agent
+description: Implements one approved feature in an isolated worktree and prepares a Lattice release handoff.
+tools: Read, Glob, Grep, Edit, Write, Bash, Skill, SendMessage
+model: inherit
+permissionMode: default
+isolation: worktree
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-feature-handoff/SKILL.md` before editing. Work only on the assigned scope, run proportionate checks, and produce the schema-shaped handoff. Use `SendMessage` only when the exact destination is present. Never merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.

package/bundles/nextjs-saas/.claude/agents/lattice-release-manager.md

@@ -0,0 +1,9 @@
+---
+name: lattice-release-manager
+description: Independently audits a Lattice feature handoff and returns a release, rework, or blocked decision.
+tools: Read, Glob, Grep, Bash, Skill, SendMessage
+model: inherit
+permissionMode: plan
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-release-manager/SKILL.md`. Verify the actual repository, exact base and head SHAs, diff, checks, impacts, and approval gates. Use `SendMessage` only when the exact origin is present. Never claim a candidate is merged, deployed, released, or live without matching proof.

package/bundles/nextjs-saas/.claude/hooks/README.md

@@ -0,0 +1,9 @@
+# Claude Hook Templates
+
+These scripts are templates generated by Lattice Project Builder.
+
+- `pre-tool-use`: blocks obviously dangerous shell patterns.
+- `pre-commit-verify`: runs `npm run verify` before commit workflows.
+
+The generated `.claude/settings.json` already wires `pre-tool-use`.
+If you want a commit-time hook, wire `pre-commit-verify.mjs` into your local git workflow.

package/bundles/nextjs-saas/.claude/hooks/pre-commit-verify.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const result = spawnSync(npmCommand, ["run", "verify"], {
+  stdio: "inherit",
+});
+
+process.exit(result.status ?? 1);

package/bundles/nextjs-saas/.claude/hooks/pre-tool-use.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/* global Buffer */
+import process from "node:process";
+
+async function main() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+
+  const payload = chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : "";
+  let command = "";
+
+  try {
+    const parsed = JSON.parse(payload || "{}");
+    command =
+      typeof parsed?.tool_input?.command === "string" ? parsed.tool_input.command : "";
+  } catch {
+    command = "";
+  }
+
+  const blockedPatterns = [
+    {
+      pattern: /(^|\s)rm\s+-rf(\s|$)/,
+      reason: "Blocked dangerous command pattern: rm -rf",
+    },
+    {
+      pattern: /git\s+reset\s+--hard/,
+      reason: "Blocked dangerous command pattern: git reset --hard",
+    },
+  ];
+
+  const blocked = blockedPatterns.find(({ pattern }) => pattern.test(command));
+  if (!blocked) {
+    return;
+  }
+
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: blocked.reason,
+      },
+    }),
+  );
+}
+
+main().catch(() => {
+  process.exit(0);
+});

package/bundles/nextjs-saas/.claude/rules/lattice-core.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.{ts,tsx,js,jsx}"
+  - "app/**"
+  - "components/**"
+  - "lib/**"
+  - "src/**"
+  - "package.json"
+---
+
+# Lattice Core Code Rule
+
+Claude loads this rule when working on source or project configuration files.
+
+- Match the existing Next.js patterns before creating new structure.
+- Keep edits scoped to the user's request and the plan in `PROJECT_GUIDE.md`.
+- Prefer small, reviewable diffs.
+- Use `/lattice-verify` or the generated `.claude/skills/lattice-verify/SKILL.md` workflow before final handoff.
+- Ask before destructive commands, production writes, dependency upgrades, or secret-handling changes.
+- Follow Next.js App Router conventions and prefer Server Components unless interactivity requires a client component.