@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/nextjs-saas/.lattice/prompts/05-polish.md

@@ -0,0 +1,38 @@
+# UX Polish Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are polishing the UX of a specific component or screen.
+
+**Component/Screen**: [What you're polishing]
+
+**Current issues**:
+- [Spacing issue]
+- [Copy issue]
+- [State handling issue]
+
+**Desired improvements**:
+- [Improvement 1]
+- [Improvement 2]
+- [Improvement 3]
+
+**Constraints**:
+- Focus on micro-interactions and visual polish
+- No feature changes
+- No structural changes
+- Keep changes localized to this component
+
+**Files to modify**:
+- [component.tsx]
+- [styles if applicable]
+
+**Vibe Check**:
+- [ ] Spacing feels balanced
+- [ ] Copy is clear and helpful
+- [ ] Loading states are smooth
+- [ ] Error states are clear
+- [ ] Interactions feel responsive
+
+**Deliverable**: Polished component + summary of changes

package/bundles/nextjs-saas/.lattice/prompts/06-security.md

@@ -0,0 +1,32 @@
+# Security Review Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are conducting a security review of this codebase.
+
+**Scope**: [What area to review - e.g., auth, API routes, data handling]
+
+**Review checklist**:
+- [ ] Input validation on all user inputs
+- [ ] Output encoding to prevent XSS
+- [ ] Authentication checks on protected routes
+- [ ] Authorization checks for user actions
+- [ ] Sensitive data not logged or exposed
+- [ ] API keys and secrets in environment variables
+- [ ] CSRF protection on mutations
+- [ ] Rate limiting on sensitive endpoints
+
+**Files to review**:
+- [file1]
+- [file2]
+
+**Output format**:
+For each finding:
+1. **Risk**: High/Medium/Low
+2. **Location**: File and line
+3. **Issue**: What's wrong
+4. **Fix**: How to address it
+
+**Deliverable**: Security findings list + recommended fixes

package/bundles/nextjs-saas/.lattice/prompts/quality.md

@@ -0,0 +1,269 @@
+# Quality & Performance Standards
+
+## Performance Rules
+
+### Critical
+
+1. **No CDN dependencies in production**
+   - ❌ Tailwind CSS CDN
+   - ❌ External font CDN without optimization
+   - ✅ Build process with optimized bundles
+   - ✅ Self-hosted fonts or optimized Google Fonts
+
+2. **Font loading optimization**
+   - Use `font-display: swap` for web fonts
+   - Combine multiple font requests
+   - Preload critical fonts
+   - Remove duplicate font imports
+
+3. **CSS optimization**
+   - No massive blur effects (`blur-[100px]`)
+   - Use `will-change` for animations
+   - Prefer `transform` and `opacity` for GPU acceleration
+   - Avoid expensive filter operations
+
+4. **Bundle size**
+   - Keep JavaScript bundles under thresholds:
+     - Initial bundle: < 200KB (gzipped)
+     - Route chunks: < 100KB (gzipped)
+   - Use dynamic imports for code splitting
+   - Tree-shake unused code
+
+### Medium Priority
+
+5. **Resource hints**
+   - Add `dns-prefetch` for external domains
+   - Use `preconnect` for critical resources
+   - Preload critical assets
+
+6. **Image optimization**
+   - Use Next.js `Image` component
+   - Add `loading="lazy"` for below-fold images
+   - Use modern formats (WebP, AVIF)
+   - Provide proper width/height
+
+7. **Inline code**
+   - Extract large inline styles to external CSS
+   - Move scripts to separate files with caching
+   - Keep HTML size reasonable
+
+---
+
+## Accessibility (a11y) Rules
+
+### Critical
+
+1. **Interactive elements MUST have handlers**
+   - Buttons need `onClick` or form `type="submit"`
+   - Links need valid `href` (not `#`)
+   - Form inputs need labels
+
+2. **ARIA labels for icon buttons**
+   ```tsx
+   ❌ <button><MenuIcon /></button>
+   ✅ <button aria-label="Open menu"><MenuIcon /></button>
+   ```
+
+3. **Alt text for images**
+   - Decorative images: `alt=""`
+   - Meaningful images: descriptive alt text
+   - No missing alt attributes
+
+4. **Keyboard navigation**
+   - All interactive elements reachable via keyboard
+   - Visible focus states (`:focus-visible`)
+   - Logical tab order
+
+### Medium Priority
+
+5. **Color contrast**
+   - Text: minimum 4.5:1 ratio
+   - Large text: minimum 3:1 ratio
+   - Use tools to verify
+
+6. **Semantic HTML**
+   - Use proper heading hierarchy (h1 → h2 → h3)
+   - Use `<nav>`, `<main>`, `<article>`, `<section>`
+   - No generic `<div>` for everything
+
+7. **Form accessibility**
+   - Labels properly associated
+   - Error messages announced
+   - Required fields marked
+   - Validation feedback
+
+---
+
+## SEO & Metadata Rules
+
+### Critical
+
+1. **Required meta tags**
+   ```tsx
+   <title>Page Title - Site Name</title>
+   <meta name="description" content="..." />
+   <meta name="viewport" content="width=device-width, initial-scale=1" />
+   ```
+
+2. **Open Graph tags**
+   ```tsx
+   <meta property="og:title" content="..." />
+   <meta property="og:description" content="..." />
+   <meta property="og:image" content="..." />
+   <meta property="og:url" content="..." />
+   ```
+
+3. **Twitter Card tags**
+   ```tsx
+   <meta name="twitter:card" content="summary_large_image" />
+   <meta name="twitter:title" content="..." />
+   <meta name="twitter:description" content="..." />
+   <meta name="twitter:image" content="..." />
+   ```
+
+### Medium Priority
+
+4. **Favicon**
+   - Include `favicon.ico`
+   - Add Apple touch icon
+   - Include manifest.json
+
+5. **Canonical URL**
+   ```tsx
+   <link rel="canonical" href="https://..." />
+   ```
+
+6. **Structured data**
+   - Add JSON-LD for Organization, Product, etc.
+   - Use Schema.org vocabulary
+
+---
+
+## Functionality & Code Quality
+
+### Critical
+
+1. **No broken links**
+   - All `href` must point to valid routes
+   - Use Next.js `Link` for internal navigation
+   - External links open in new tab if appropriate
+
+2. **Mobile menu implementation**
+   - If mobile menu button exists, menu must work
+   - Toggle open/close state properly
+   - Close on outside click or route change
+
+3. **Copy-to-clipboard**
+   - Use `navigator.clipboard.writeText()`
+   - Show success feedback (toast, checkmark)
+   - Handle errors gracefully
+
+4. **Form validation**
+   - Client-side validation for UX
+   - Server-side validation for security
+   - Clear error messages
+
+### Medium Priority
+
+5. **Smooth scrolling**
+   ```css
+   html {
+     scroll-behavior: smooth;
+   }
+   ```
+
+6. **Loading states**
+   - Show spinners/skeletons during async operations
+   - Disable buttons while submitting
+   - Prevent duplicate submissions
+
+7. **Error boundaries**
+   - Catch errors in components
+   - Show fallback UI
+   - Log errors to Sentry
+
+---
+
+## Security Rules
+
+### Critical
+
+1. **No external CDN without SRI**
+   - If using CDN, add Subresource Integrity hash
+   - Or self-host dependencies
+
+2. **Content Security Policy**
+   ```tsx
+   <meta http-equiv="Content-Security-Policy" content="..." />
+   ```
+
+3. **Environment variables**
+   - Never expose secrets in client code
+   - Use `NEXT_PUBLIC_` prefix for client vars
+   - Validate env vars on startup
+
+---
+
+## Testing Requirements
+
+### Critical
+
+1. **Lighthouse CI**
+   - Performance: ≥ 80
+   - Accessibility: ≥ 90
+   - Best Practices: ≥ 90
+   - SEO: ≥ 90
+
+2. **Accessibility testing**
+   - Run axe-core checks
+   - Zero critical violations
+   - Address all serious violations
+
+3. **Visual regression**
+   - Key pages render correctly
+   - Responsive layouts work
+   - No layout shifts (CLS)
+
+---
+
+## When to Run Quality Checks
+
+1. **Pre-commit**
+   - Quick checks (linting, type-check)
+
+2. **Pre-push**
+   - Full verification (`npm run verify:quality`)
+
+3. **CI/CD**
+   - All quality checks must pass
+   - Block merge if quality gates fail
+
+4. **Pre-production**
+   - Full Lighthouse audit
+   - Manual QA on staging
+
+---
+
+## How AI Should Apply These Rules
+
+1. **During implementation**
+   - Follow these rules by default
+   - Don't add non-functional buttons
+   - Don't use CDN for production code
+
+2. **During code review**
+   - Check for violations
+   - Suggest fixes proactively
+
+3. **When generating documentation**
+   - Include quality considerations
+   - Mention performance implications
+
+4. **When debugging**
+   - Use browser DevTools Performance tab
+   - Check Network tab for unnecessary requests
+   - Verify accessibility tree
+
+---
+
+*These rules are enforced by `npm run verify:quality`. Run locally before pushing.*

package/bundles/nextjs-saas/.lattice/release-workflow.json

@@ -0,0 +1,55 @@
+{
+  "schemaVersion": "1.0",
+  "productionBranch": "main",
+  "runtimeStatePath": ".lattice/runtime/release-state.json",
+  "artifacts": {
+    "workflowGuide": "docs/LATTICE_RELEASE_WORKFLOW.md",
+    "handoffSchema": ".lattice/schemas/feature-handoff.schema.json",
+    "handoffTemplate": ".lattice/templates/feature-handoff.json",
+    "featureSkill": ".agents/skills/lattice-feature-handoff/SKILL.md",
+    "releaseManagerSkill": ".agents/skills/lattice-release-manager/SKILL.md"
+  },
+  "statuses": [
+    "READY_FOR_RELEASE",
+    "NEEDS_REWORK",
+    "BLOCKED"
+  ],
+  "stages": [
+    "feature_work",
+    "handoff",
+    "release_audit",
+    "candidate_prepared",
+    "owner_approved",
+    "deployed",
+    "live_verified",
+    "cleanup"
+  ],
+  "transports": [
+    "native_task_message_when_bound",
+    "github_issue_pull_request_or_comment",
+    "versioned_handoff_artifact"
+  ],
+  "ownerApprovalRequiredFor": [
+    "production_promotion",
+    "database_or_data_migration",
+    "provider_or_account_write",
+    "secret_or_environment_change",
+    "destructive_action"
+  ],
+  "authority": {
+    "featureAgent": [
+      "implement_approved_scope",
+      "run_verification",
+      "prepare_handoff"
+    ],
+    "releaseManager": [
+      "audit_exact_candidate",
+      "request_rework",
+      "prepare_release_recommendation"
+    ],
+    "productOwner": [
+      "approve_consequential_action",
+      "authorize_production_release"
+    ]
+  }
+}

package/bundles/nextjs-saas/.lattice/schemas/feature-handoff.schema.json

@@ -0,0 +1,264 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://latticeai.app/schemas/feature-handoff-1.0.json",
+  "title": "Lattice Feature Handoff",
+  "description": "Evidence-backed transfer from a feature agent to release review. Never include credentials, tokens, secret values, payment data, or direct personal contact data.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "handoffId",
+    "project",
+    "origin",
+    "destination",
+    "status",
+    "summary",
+    "scope",
+    "changedFiles",
+    "verification",
+    "impacts",
+    "risks",
+    "approvalsRequired",
+    "createdAt"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "1.0"
+    },
+    "handoffId": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]{2,79}$"
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "repository",
+        "baseRef",
+        "baseSha",
+        "headSha",
+        "branch",
+        "worktree"
+      ],
+      "properties": {
+        "repository": {
+          "type": "string",
+          "minLength": 1
+        },
+        "baseRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "baseSha": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
+        },
+        "headSha": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
+        },
+        "branch": {
+          "type": "string",
+          "minLength": 1
+        },
+        "worktree": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "origin": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider",
+        "taskId",
+        "taskName"
+      ],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "minLength": 1
+        },
+        "taskId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "taskName": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "destination": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "role",
+        "taskId"
+      ],
+      "properties": {
+        "role": {
+          "const": "release-manager"
+        },
+        "taskId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "status": {
+      "enum": [
+        "READY_FOR_RELEASE",
+        "NEEDS_REWORK",
+        "BLOCKED"
+      ]
+    },
+    "summary": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "included",
+        "excluded"
+      ],
+      "properties": {
+        "included": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "excluded": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "changedFiles": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "verification": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "command",
+          "result",
+          "scope",
+          "evidence"
+        ],
+        "properties": {
+          "command": {
+            "type": "string",
+            "minLength": 1
+          },
+          "result": {
+            "enum": [
+              "passed",
+              "failed",
+              "not_run",
+              "blocked"
+            ]
+          },
+          "scope": {
+            "type": "string",
+            "minLength": 1
+          },
+          "evidence": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "impacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "databaseMigration",
+        "environmentChanges",
+        "backgroundWorkers",
+        "providers",
+        "destructiveActions"
+      ],
+      "properties": {
+        "databaseMigration": {
+          "enum": [
+            "none",
+            "required",
+            "needs_assessment"
+          ]
+        },
+        "environmentChanges": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "backgroundWorkers": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "providers": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "destructiveActions": {
+          "enum": [
+            "none",
+            "required",
+            "needs_assessment"
+          ]
+        }
+      }
+    },
+    "risks": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "approvalsRequired": {
+      "type": "array",
+      "items": {
+        "enum": [
+          "production_promotion",
+          "database_or_data_migration",
+          "provider_or_account_write",
+          "secret_or_environment_change",
+          "destructive_action"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/bundles/nextjs-saas/.lattice/templates/feature-handoff.json

@@ -0,0 +1,52 @@
+{
+  "schemaVersion": "1.0",
+  "handoffId": "replace-with-handoff-id",
+  "project": {
+    "repository": "owner/repository",
+    "baseRef": "origin/main",
+    "baseSha": "0000000000000000000000000000000000000000",
+    "headSha": "1111111111111111111111111111111111111111",
+    "branch": "feature/replace-with-branch",
+    "worktree": "replace-with-absolute-or-repo-relative-worktree"
+  },
+  "origin": {
+    "provider": "replace-with-provider",
+    "taskId": null,
+    "taskName": "replace-with-task-name"
+  },
+  "destination": {
+    "role": "release-manager",
+    "taskId": null
+  },
+  "status": "BLOCKED",
+  "summary": "Replace every placeholder and record the observable outcome.",
+  "scope": {
+    "included": [
+      "Replace with the implemented scope."
+    ],
+    "excluded": [
+      "Replace with an explicit non-goal."
+    ]
+  },
+  "changedFiles": [],
+  "verification": [
+    {
+      "command": "replace-with-verification-command",
+      "result": "not_run",
+      "scope": "Replace with what the command proves.",
+      "evidence": "Replace with the exit result or artifact reference."
+    }
+  ],
+  "impacts": {
+    "databaseMigration": "needs_assessment",
+    "environmentChanges": [],
+    "backgroundWorkers": [],
+    "providers": [],
+    "destructiveActions": "needs_assessment"
+  },
+  "risks": [
+    "Replace with remaining risk or remove this item."
+  ],
+  "approvalsRequired": [],
+  "createdAt": "1970-01-01T00:00:00.000Z"
+}