@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/nextjs-saas/.claude/settings.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "defaultMode": "default",
+    "allow": [
+      "Read(**)",
+      "Edit(**)",
+      "Glob(**)",
+      "Grep(**)",
+      "Bash(npm run lint)",
+      "Bash(npm run typecheck)",
+      "Bash(npm run test)",
+      "Bash(npm run build)",
+      "Bash(npm run verify)"
+    ],
+    "deny": [
+      "Bash(rm -rf *)",
+      "Bash(sudo *)",
+      "Bash(git reset --hard *)",
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pre-tool-use.mjs"
+          }
+        ]
+      }
+    ]
+  }
+}

package/bundles/nextjs-saas/.claude/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Next.js
+- Use Next.js App Router patterns from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/nextjs-saas/.codex/agents/lattice-feature-agent.toml

@@ -0,0 +1,9 @@
+name = "lattice-feature-agent"
+description = "Implements one approved feature in isolation and prepares a schema-shaped Lattice handoff for release review."
+sandbox_mode = "workspace-write"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-feature-handoff/SKILL.md before editing.
+Work only on the assigned scope in the isolated worktree supplied by the parent.
+Run proportionate checks and produce the exact handoff evidence required by the shared skill.
+Do not merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.
+"""

package/bundles/nextjs-saas/.codex/agents/lattice-release-manager.toml

@@ -0,0 +1,9 @@
+name = "lattice-release-manager"
+description = "Read-only release auditor that verifies exact Git lineage, diff, checks, impacts, and approval gates."
+sandbox_mode = "read-only"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-release-manager/SKILL.md.
+Independently verify the handoff against the actual repository, base SHA, head SHA, and diff.
+Return accept for owner approval, request rework, or block with concrete evidence.
+Never describe a candidate as merged, deployed, released, or live without matching proof.
+"""

package/bundles/nextjs-saas/.cursor/mcp.json

@@ -0,0 +1,34 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem@1.0.0",
+        "."
+      ],
+      "disabled": true
+    },
+    "github": {
+      "url": "https://api.githubcopilot.com/mcp/readonly",
+      "headers": {
+        "Authorization": "Bearer ${env:GITHUB_TOKEN}"
+      },
+      "disabled": true
+    },
+    "supabase": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@supabase/mcp-server-supabase@0.14.0",
+        "--read-only",
+        "--project-ref",
+        "${env:SUPABASE_PROJECT_REF}"
+      ],
+      "env": {
+        "SUPABASE_ACCESS_TOKEN": "${env:SUPABASE_ACCESS_TOKEN}"
+      },
+      "disabled": true
+    }
+  }
+}

package/bundles/nextjs-saas/.cursor/rules/lattice-core.mdc

@@ -0,0 +1,35 @@
+---
+description: Lattice Core engineering rules for this Next.js repo. Use for implementation, verification, and release-safety work.
+globs:
+  - "**/*"
+alwaysApply: true
+---
+
+# Lattice Core Rules
+
+## Scope
+- Implement exactly what is requested.
+- Preserve existing behavior unless change is requested.
+- Read `AGENTS.md` and `PROJECT_GUIDE.md` before coding.
+- Use this project rule for Agent Chat. Cursor Tab and inline edit do not receive these rules.
+
+## Quality Gates
+- Run `npm run lint`
+- Run `npm run typecheck`
+- Run `npm run test`
+- Run `npm run build`
+- Run `npm run verify`
+
+## Skills and Tools
+- Use `.agents/skills/lattice-verify/SKILL.md` when a task asks for verification, release readiness, or final handoff checks.
+- Project MCP examples live in `.cursor/mcp.json`; keep credentials in environment variables.
+- Keep rules short. Add a focused skill instead of growing this always-applied rule when the guidance is procedural.
+
+## Security
+- Never commit secrets or credentials.
+- Use env vars for sensitive values.
+- Refuse destructive shell commands unless explicitly requested.
+
+## Framework Rules
+- Active framework: Next.js
+- Use App Router and prefer Server Components.

package/bundles/nextjs-saas/.cursor/rules.md

@@ -0,0 +1,95 @@
+<!--
+latticeVersion: 0.8.4
+stack: nextjs
+policyVersion: 1.0.0
+configHash: cc0bb2db871da746993a1bbbb7a81ccf40125d0a11679f58498fe423511fa0a7
+-->
+<!-- LATTICE:START v1.0.0 -->
+# Lattice Project Rules
+
+## Stack
+- **Framework**: Next.js (TypeScript strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Core Operating Rules
+
+1. **Stay in scope** - Only implement what's explicitly requested
+2. **No placeholders** - All code must be production-ready
+3. **Verify before coding** - Check current package versions and API compatibility
+4. **Minimal changes** - Keep modifications localized and simple
+5. **Test everything** - Run lint, typecheck, test, and build before submitting
+6. **Never expose secrets** - API keys, tokens, passwords, and credentials must NEVER be committed to version control
+
+## Verification Commands
+
+```bash
+npm run lint       # ESLint check
+npm run typecheck  # TypeScript check
+npm test           # Run tests
+npm run build      # Production build
+npm run verify     # All checks via Lattice
+```
+
+## Code Standards
+- Use TypeScript strict mode
+- Prefer functional components and hooks
+- Use async/await over .then()
+- Handle all errors explicitly
+- No `any` types without justification
+
+## File Organization
+- Keep components in /components with index.ts barrels
+- Keep utilities in /lib
+- Keep API routes in /app/api (Next.js)
+- Use feature-based organization for large projects
+
+## Next.js-Specific Guidelines
+- Use App Router (`app/` directory)
+- Server Components by default, `"use client"` only when needed
+- Follow Next.js file conventions: `layout.tsx`, `page.tsx`, `loading.tsx`, `error.tsx`
+- Use Next.js Image component for optimized images
+
+## Before Making Changes
+
+1. Restate the scope in one paragraph
+2. Identify files to create or modify
+3. Check existing patterns in the codebase
+4. Verify package versions are current
+
+## After Making Changes
+
+1. Run all verification commands
+2. Fix any failures before proceeding
+3. Report verification results
+
+## Security Rules (CRITICAL)
+
+- **NEVER** commit API keys, secrets, tokens, or credentials to version control
+- **ALWAYS** use environment variables (`.env.local`, `.env`) for sensitive data
+- **ALWAYS** ensure `.env*` files are in `.gitignore`
+- **NEVER** hardcode secrets in source code, even in comments
+- **ONLY** access sensitive keys server-side (never expose to client-side code)
+
+## Execution Discipline
+
+Implement one scoped change at a time. Run the affected checks and real journeys, fix confirmed failures, and record the exact candidate and evidence before handoff.
+
+## Non-Goals
+
+Avoid unrelated rewrites, speculative features, or provider and production changes outside the approved scope.
+
+## Priority Order
+
+User instructions, repository agreements, accepted scope, existing patterns, then optional improvements.
+
+## Hard Stop Conditions
+
+- If requirements conflict -> ask for clarification
+- If verification fails -> fix before continuing
+- If scope is unclear -> ask for clarification
+- If you can't verify an API or version -> ask
+- If code contains hardcoded secrets -> STOP and use environment variables
+
+Violation of these rules is a failure.
+<!-- LATTICE:END -->

package/bundles/nextjs-saas/.env.example

@@ -0,0 +1,48 @@
+# Environment variables
+
+# Supabase
+# Project URL from Supabase settings.
+NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+
+# Anon public key from Supabase settings.
+NEXT_PUBLIC_SUPABASE_ANON_KEY=your-supabase-anon-key
+
+# Server-only service role key. Never expose this in the browser.
+SUPABASE_SERVICE_ROLE_KEY=your-supabase-service-role-key
+
+# App URL
+# Base URL for auth callbacks.
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+
+# Stripe
+# Server-only Stripe secret key.
+STRIPE_SECRET_KEY=sk_test_your_secret_key
+
+# Signing secret for the Stripe webhook endpoint.
+STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
+
+# Recurring Price used by the generated Checkout route.
+STRIPE_PRICE_ID=price_your_recurring_price
+
+# PostHog
+# Public phc_ project token for analytics; keep PostHog secret keys server-only.
+NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=<ph_project_token>
+
+# PostHog ingestion host for your region.
+NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
+
+# Sentry
+# Public DSN used by the browser SDK.
+NEXT_PUBLIC_SENTRY_DSN=https://public@example.ingest.sentry.io/project-id
+
+# Optional server-side DSN override.
+SENTRY_DSN=https://public@example.ingest.sentry.io/project-id
+
+# Organization slug for source map uploads.
+SENTRY_ORG=your-org
+
+# Project slug for source map uploads.
+SENTRY_PROJECT=your-project
+
+# Server-only token for source map uploads.
+SENTRY_AUTH_TOKEN=your-sentry-auth-token

package/bundles/nextjs-saas/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,42 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Changes
+
+<!-- List the main changes -->
+
+-
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Refactor (no functional changes)
+- [ ] Documentation update
+
+## Checklist
+
+### Before requesting review:
+
+- [ ] I ran `npm run verify` and all checks pass
+- [ ] I tested the changes locally
+- [ ] I reviewed my own diff for unnecessary changes
+- [ ] I added/updated tests if applicable
+- [ ] I updated documentation if applicable
+
+### Vibe Check:
+
+- [ ] Core flow works end-to-end
+- [ ] UI states (loading, error, empty) are handled
+- [ ] No console errors
+- [ ] Edge cases considered
+
+## Screenshots (if UI changes)
+
+<!-- Add before/after screenshots -->
+
+## Notes for Reviewers
+
+<!-- Any context that would help reviewers -->

package/bundles/nextjs-saas/.github/agents/lattice-feature-agent.agent.md

@@ -0,0 +1,7 @@
+---
+name: lattice-feature-agent
+description: Implements one approved feature and prepares a schema-shaped Lattice handoff for release review.
+tools: ["read", "search", "edit", "execute"]
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-feature-handoff/SKILL.md`. Stay within the issue or pull request scope, preserve exact Git lineage, run proportionate checks, and attach or commit the schema-shaped handoff. Do not merge, deploy, migrate, change provider or environment state, or perform destructive actions.

package/bundles/nextjs-saas/.github/agents/lattice-release-manager.agent.md

@@ -0,0 +1,7 @@
+---
+name: lattice-release-manager
+description: Audits an exact Lattice candidate and returns an evidence-backed release, rework, or blocked decision.
+tools: ["read", "search", "execute"]
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-release-manager/SKILL.md`. Verify the handoff against the pull request's exact base SHA, head SHA, diff, checks, impacts, and approvals. Record rework evidence on the originating issue or pull request. Never merge or claim deployment, release, or live state without separate authority and proof.

package/bundles/nextjs-saas/.github/copilot-instructions.md

@@ -0,0 +1,37 @@
+# GitHub Copilot Instructions
+
+Read `PROJECT_GUIDE.md` and `AGENTS.md` first. Use `docs/rules/codex.md` for the deeper execution workflow and keep these instructions aligned with `.cursor/rules.md` and `CLAUDE.md`.
+
+## Stack
+
+- **Framework**: Next.js
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Repository Guidance
+
+- Stay strictly within the approved scope from `PROJECT_GUIDE.md`.
+- Prefer small, reviewable diffs over broad rewrites.
+- Match the existing folder structure and app patterns before inventing new abstractions.
+- Do not add placeholder code, fake implementations, or silent behavior changes.
+- Keep generated and user-authored instruction files aligned when you touch them.
+
+## Required Verification
+
+Run these before marking work complete:
+
+```bash
+npm run lint
+npm run typecheck
+npm run test
+npm run build
+npm run verify
+```
+
+## Hard Stops
+
+- Requirements conflict with the requested scope.
+- Verification fails and has not been fixed.
+- An API, package, or version cannot be verified.
+- A change would expose secrets or overwrite unrelated work.

package/bundles/nextjs-saas/.github/instructions/lattice-core.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+---
+
+# Lattice Project Builder Code Instructions
+
+- Follow the approved plan in `PROJECT_GUIDE.md` and the shared guardrails in `AGENTS.md`.
+- Keep Next.js App Router patterns consistent with the existing codebase.
+- Avoid broad rewrites, compatibility guesses, and unverified dependencies.
+- Preserve existing behavior unless the task explicitly changes it.
+- Finish by running `npm run lint`, `npm run typecheck`, `npm test`, `npm run build`, and `npm run verify`.

package/bundles/nextjs-saas/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify Next.js
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24.22.0"
+          cache: npm
+      - run: npm ci
+      - name: Verify application
+        run: npm run verify
+      - name: Verify Lattice rules
+        run: npx latticeai@0.8.4 verify-rules

package/bundles/nextjs-saas/.gitmessage

@@ -0,0 +1,24 @@
+# <type>(<scope>): <subject>
+#
+# <body>
+#
+# <footer>
+#
+# Types:
+#   feat     - New feature
+#   fix      - Bug fix
+#   docs     - Documentation only
+#   style    - Formatting, no code change
+#   refactor - Code change that neither fixes a bug nor adds a feature
+#   test     - Adding or updating tests
+#   chore    - Maintenance tasks
+#
+# Scope: Component or area affected (optional)
+#
+# Subject: Imperative mood, no period, max 50 chars
+#
+# Body: Explain what and why (not how), wrap at 72 chars
+#
+# Footer: Reference issues, breaking changes
+#   Fixes #123
+#   BREAKING CHANGE: description

package/bundles/nextjs-saas/.lattice/config.json

@@ -0,0 +1,9 @@
+{
+  "version": "1.0.0",
+  "stack": "nextjs",
+  "projectType": "nextjs",
+  "strictnessPreset": "startup",
+  "policyVersion": "1.0.0",
+  "createdAt": "2026-10-18T14:44:47.998Z",
+  "bundle": true
+}

package/bundles/nextjs-saas/.lattice/dependency-security.json

@@ -0,0 +1,46 @@
+{
+  "schemaVersion": 1,
+  "generatedBy": "Lattice",
+  "stack": "nextjs",
+  "auditPolicy": "Preserve raw audit output; this manifest records reviewed source repairs and does not suppress advisories.",
+  "advisories": [
+    {
+      "package": "braces",
+      "registryVersion": "3.0.3",
+      "replacement": {
+        "package": "@m2ai/braces",
+        "version": "3.0.3-m2ai.1",
+        "maintainer": "M2 AI, LLC",
+        "locator": "file:vendor/m2ai-braces-3.0.3-m2ai.1.tar",
+        "distribution": "local-vendor-only",
+        "provenance": "SOURCE-PROVENANCE.json",
+        "archiveSha256": "E583B39B213E373A2B5276E112F0FE2C12CB9FC801A9E762FA42C360E090F7BE",
+        "archiveSha512": "61AF201668A7EF1988F369A294ADB316F78C00B564D23E14B4399193BB0473667BB2F8F7F7AEF68AE4D143E57BE7103A91ECAB606E6AF69797C21B3F69A82AE6"
+      },
+      "advisory": "GHSA-vfj7-8cjw-p6xm",
+      "cve": "CVE-2026-93687",
+      "status": "local-vendor-fork-reviewed",
+      "source": {
+        "repository": "https://github.com/micromatch/braces",
+        "pullRequest": "https://github.com/micromatch/braces/pull/87",
+        "commit": "d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe",
+        "archive": "https://github.com/micromatch/braces/archive/d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe.tar.gz",
+        "archiveSha512": "F016D19CF7F0F67478AD0A31C641F2FB64509543389055D8BAFCD805425F5C3E35C4315CEF65A1CD838F5971696C7156E478B9145BDB2FA8D26280675A526E05"
+      },
+      "license": {
+        "spdx": "MIT",
+        "source": "https://github.com/micromatch/braces/blob/d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe/LICENSE"
+      },
+      "maintainer": "M2 AI, LLC",
+      "provenance": "SOURCE-PROVENANCE.json records unchanged upstream MIT source, local vendor fork ownership, and archive lineage.",
+      "reconciliationPolicy": "Reconcile with the first upstream patched release when available, or before any product release while no patched release exists.",
+      "productionFiles": {
+        "lib/compile.js": "b651f7715e6db8942ce61d3394357b4d81c8ece88240aa31a458ea1165edd195",
+        "lib/constants.js": "f9fb688959232eee3e6ad7906a5b0e3234815db49ee857ef86983d65b917dc7c",
+        "lib/expand.js": "7ea3e14c2b2b256ef244fd3d83b8fcaa20aa2232b4e6d768c3bb6ab567f66cf5",
+        "lib/parse.js": "b1bf766fba6a62035f78ecbda8a5fd94e921aa1c1ec0cdf3f467e9c836abed55",
+        "lib/stringify.js": "49dc2d8bafa74f34715a18a845bcb82ce66caaf3bab4cf117998e06b1f9a50a9"
+      }
+    }
+  ]
+}

package/bundles/nextjs-saas/.lattice/prompts/01-feature.md

@@ -0,0 +1,36 @@
+# Feature Implementation Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are implementing a new feature in this Next.js codebase.
+
+**Goal**: [What the user should be able to do when this is complete]
+
+**Constraints**:
+- Use existing patterns from this codebase
+- No new dependencies unless explicitly approved
+- Must pass all verify checks
+
+**Context**:
+- Files to read first: [list relevant files]
+- Related components: [list any]
+- API endpoints: [list any]
+
+**Files allowed to change**:
+- [file1.tsx]
+- [file2.tsx]
+
+**Files NOT to touch**:
+- [protected files]
+
+**Acceptance Criteria**:
+- [ ] [Criterion 1]
+- [ ] [Criterion 2]
+- [ ] All verify checks pass
+
+**Non-goals**:
+- [What is explicitly out of scope]
+
+**Deliverable**: Working code + brief summary of changes

package/bundles/nextjs-saas/.lattice/prompts/02-bugfix.md

@@ -0,0 +1,32 @@
+# Bug Fix Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are fixing a bug in this Next.js codebase.
+
+**Bug Description**: [What is happening]
+
+**Expected Behavior**: [What should happen]
+
+**Reproduction Steps**:
+1. [Step 1]
+2. [Step 2]
+3. [Step 3]
+
+**Files to investigate**:
+- [suspected file 1]
+- [suspected file 2]
+
+**Constraints**:
+- Minimal change to fix the issue
+- No refactoring unrelated code
+- Must not break existing tests
+
+**Acceptance Criteria**:
+- [ ] Bug no longer reproduces
+- [ ] No new bugs introduced
+- [ ] All verify checks pass
+
+**Deliverable**: Targeted fix + explanation of root cause

package/bundles/nextjs-saas/.lattice/prompts/03-refactor.md

@@ -0,0 +1,30 @@
+# Safe Refactor Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are refactoring code in this Next.js codebase.
+
+**Goal**: [What improvement you're making - e.g., extract component, rename, simplify]
+
+**Current State**: [Brief description of what exists now]
+
+**Desired State**: [Brief description of the end result]
+
+**Constraints**:
+- Behavior must remain IDENTICAL
+- Keep diffs small and reviewable
+- No feature changes
+- No dependency changes
+
+**Files to refactor**:
+- [file1.tsx]
+- [file2.tsx]
+
+**Verification**:
+- [ ] All existing tests still pass
+- [ ] Manual testing confirms same behavior
+- [ ] No new warnings or errors
+
+**Deliverable**: Refactored code with same behavior + summary of changes

package/bundles/nextjs-saas/.lattice/prompts/04-test.md

@@ -0,0 +1,31 @@
+# Test-First Development Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are adding tests before implementing a feature.
+
+**Feature to test**: [What functionality needs tests]
+
+**Test cases to write**:
+1. [Happy path case]
+2. [Edge case 1]
+3. [Edge case 2]
+4. [Error case]
+
+**Test file location**: [e.g., app/component.test.tsx]
+
+**Constraints**:
+- Write tests FIRST, then implementation
+- Tests should fail initially
+- Use existing test patterns from this codebase
+- Use React Testing Library conventions
+
+**Acceptance Criteria**:
+- [ ] Tests written and initially failing
+- [ ] Implementation makes tests pass
+- [ ] No skipped or commented tests
+- [ ] All verify checks pass
+
+**Deliverable**: Test file + implementation that passes