@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/nextjs-saas/prompts/03-safe-refactor.md

@@ -0,0 +1,82 @@
+# Prompt Recipe: Safe Refactor
+
+Use this prompt when refactoring without changing behavior.
+
+---
+
+## Template
+
+```
+Role: You are refactoring this Next.js SaaS application.
+
+Goal: [WHAT YOU WANT TO IMPROVE]
+- Current: [CURRENT STATE]
+- Target: [DESIRED STATE]
+
+Scope:
+- Files to refactor: [LIST FILES]
+- Files that must not change: [LIST FILES]
+
+Constraints:
+- Behavior must remain identical
+- Keep diffs small and reviewable
+- Run tests after each change
+- Do not add new dependencies
+
+Steps:
+1. [STEP 1 - SMALL CHANGE]
+2. [STEP 2 - VERIFY STILL WORKS]
+3. [STEP 3 - NEXT SMALL CHANGE]
+
+Acceptance Criteria:
+- [ ] Behavior unchanged (test this manually)
+- [ ] Code is cleaner/more maintainable
+- [ ] `npm run verify` passes
+
+Non-goals:
+- Do not add new features
+- Do not fix unrelated bugs
+- Do not optimize prematurely
+
+Deliverable: Refactored code with summary of what changed and why.
+```
+
+---
+
+## Example
+
+```
+Role: You are refactoring this Next.js SaaS application.
+
+Goal: Extract duplicate Supabase query logic into reusable functions
+- Current: Same query pattern repeated in 5 different page.tsx files
+- Target: Shared data access functions in lib/queries.ts
+
+Scope:
+- Files to refactor: app/(dashboard)/*/page.tsx, lib/queries.ts (new)
+- Files that must not change: lib/supabase/server.ts, types/database.ts
+
+Constraints:
+- Behavior must remain identical
+- Keep diffs small and reviewable
+- Run tests after each change
+- Do not add new dependencies
+
+Steps:
+1. Create lib/queries.ts with first extracted function
+2. Update one page.tsx to use it, verify still works
+3. Extract remaining queries one at a time
+4. Final verification pass
+
+Acceptance Criteria:
+- [ ] All pages still load correctly
+- [ ] No duplicate query code
+- [ ] `npm run verify` passes
+
+Non-goals:
+- Do not add caching yet
+- Do not change the query logic itself
+- Do not refactor component structure
+
+Deliverable: Refactored code with summary of what changed and why.
+```

package/bundles/nextjs-saas/prompts/04-test-first.md

@@ -0,0 +1,80 @@
+# Prompt Recipe: Test-First Development
+
+Use this prompt when you want tests written before implementation.
+
+---
+
+## Template
+
+```
+Role: You are practicing test-driven development on this Next.js SaaS application.
+
+Feature: [FEATURE NAME]
+
+Step 1 — Write failing tests first:
+- Test file: [PATH TO TEST FILE]
+- Test cases:
+  1. [TEST CASE 1]
+  2. [TEST CASE 2]
+  3. [TEST CASE 3]
+
+Step 2 — Implement minimal code to pass:
+- Implementation file: [PATH TO IMPLEMENTATION]
+- Keep implementation simple
+
+Step 3 — Refactor if needed:
+- Only after tests pass
+- Keep tests passing
+
+Constraints:
+- Tests must fail initially (red)
+- Implementation makes tests pass (green)
+- Only then refactor
+- Use Jest + React Testing Library
+
+Acceptance Criteria:
+- [ ] All tests pass
+- [ ] Tests cover happy path and edge cases
+- [ ] `npm run verify` passes
+
+Deliverable: Test file + implementation + brief summary.
+```
+
+---
+
+## Example
+
+```
+Role: You are practicing test-driven development on this Next.js SaaS application.
+
+Feature: Subscription tier validation utility
+
+Step 1 — Write failing tests first:
+- Test file: lib/__tests__/subscription.test.ts
+- Test cases:
+  1. canAccessFeature returns true for pro users accessing pro features
+  2. canAccessFeature returns false for free users accessing pro features
+  3. canAccessFeature returns true for any user accessing free features
+  4. isSubscriptionActive returns false for expired subscriptions
+
+Step 2 — Implement minimal code to pass:
+- Implementation file: lib/subscription.ts
+- Keep implementation simple
+
+Step 3 — Refactor if needed:
+- Only after tests pass
+- Keep tests passing
+
+Constraints:
+- Tests must fail initially (red)
+- Implementation makes tests pass (green)
+- Only then refactor
+- Use Jest
+
+Acceptance Criteria:
+- [ ] All 4 tests pass
+- [ ] Edge cases covered (null subscription, expired)
+- [ ] `npm run verify` passes
+
+Deliverable: Test file + implementation + brief summary.
+```

package/bundles/nextjs-saas/prompts/05-ui-polish.md

@@ -0,0 +1,82 @@
+# Prompt Recipe: UI Polish Pass
+
+Use this prompt when polishing UI details without changing functionality.
+
+---
+
+## Template
+
+```
+Role: You are polishing the UI of this Next.js SaaS application.
+
+Target: [COMPONENT OR PAGE]
+
+Polish areas:
+- [ ] Spacing and alignment
+- [ ] Typography (sizes, weights, line heights)
+- [ ] Colors and contrast
+- [ ] Loading states
+- [ ] Empty states
+- [ ] Error states
+- [ ] Hover/focus states
+- [ ] Mobile responsiveness
+
+Constraints:
+- Do not change functionality
+- Do not change component structure
+- Keep changes to CSS/Tailwind only where possible
+- Test on mobile viewport
+
+Current issues:
+1. [ISSUE 1]
+2. [ISSUE 2]
+3. [ISSUE 3]
+
+Acceptance Criteria:
+- [ ] Visual issues are fixed
+- [ ] Component still functions correctly
+- [ ] Looks good on mobile (375px)
+- [ ] `npm run verify` passes
+
+Deliverable: Polished component with summary of changes.
+```
+
+---
+
+## Example
+
+```
+Role: You are polishing the UI of this Next.js SaaS application.
+
+Target: Dashboard sidebar navigation
+
+Polish areas:
+- [x] Spacing and alignment
+- [x] Typography (sizes, weights, line heights)
+- [ ] Colors and contrast
+- [ ] Loading states
+- [ ] Empty states
+- [ ] Error states
+- [x] Hover/focus states
+- [x] Mobile responsiveness
+
+Constraints:
+- Do not change functionality
+- Do not change component structure
+- Keep changes to CSS/Tailwind only where possible
+- Test on mobile viewport
+
+Current issues:
+1. Nav items too close together on mobile
+2. Active state not visible enough
+3. Hover state missing on desktop
+4. Icon and text not vertically aligned
+
+Acceptance Criteria:
+- [ ] 4 issues above are fixed
+- [ ] Navigation still works
+- [ ] Sidebar collapses properly on mobile
+- [ ] `npm run verify` passes
+
+Deliverable: Polished component with summary of changes.
+```

package/bundles/nextjs-saas/prompts/06-security-review.md

@@ -0,0 +1,74 @@
+# Prompt Recipe: Security Review
+
+Use this prompt when reviewing code for security issues.
+
+---
+
+## Template
+
+```
+Role: You are performing a security review of this Next.js SaaS application.
+
+Scope: [FILES OR FEATURES TO REVIEW]
+
+Check for:
+- [ ] SQL injection (raw queries)
+- [ ] XSS (unescaped user input)
+- [ ] CSRF (missing tokens)
+- [ ] Auth bypass (missing middleware)
+- [ ] Insecure direct object references
+- [ ] Exposed secrets (hardcoded keys)
+- [ ] Missing rate limiting
+- [ ] Overly permissive CORS
+- [ ] Supabase RLS policies
+
+Focus areas:
+1. [AREA 1]
+2. [AREA 2]
+
+Constraints:
+- Do not fix issues yet, just identify
+- Rank by severity (Critical, High, Medium, Low)
+- Provide specific file and line references
+
+Output format:
+| Severity | Issue | File | Line | Recommendation |
+|----------|-------|------|------|----------------|
+| Critical | ... | ... | ... | ... |
+
+Deliverable: Security report with prioritized findings.
+```
+
+---
+
+## Example
+
+```
+Role: You are performing a security review of this Next.js SaaS application.
+
+Scope: API routes and Supabase queries
+
+Check for:
+- [x] SQL injection (raw queries)
+- [x] Auth bypass (missing middleware)
+- [x] Insecure direct object references
+- [x] Supabase RLS policies
+
+Focus areas:
+1. /api/teams/* endpoints
+2. /api/webhooks/* endpoints
+
+Constraints:
+- Do not fix issues yet, just identify
+- Rank by severity (Critical, High, Medium, Low)
+- Provide specific file and line references
+
+Output format:
+| Severity | Issue | File | Line | Recommendation |
+|----------|-------|------|------|----------------|
+| Critical | Missing auth check on team delete | api/teams/[id]/route.ts | 45 | Add session check |
+| High | No RLS on team_members table | supabase/migrations/001.sql | 23 | Add policy |
+| Medium | Webhook signature not verified | api/webhooks/stripe/route.ts | 12 | Add Stripe signature check |
+
+Deliverable: Security report with prioritized findings.
+```

package/bundles/nextjs-saas/proxy.ts

@@ -0,0 +1,61 @@
+import { createServerClient } from "@supabase/ssr";
+import { NextResponse, type NextRequest } from "next/server";
+
+export async function proxy(request: NextRequest) {
+  let supabaseResponse = NextResponse.next({
+    request,
+  });
+
+  const supabase = createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return request.cookies.getAll();
+        },
+        setAll(cookiesToSet) {
+          cookiesToSet.forEach(({ name, value }) =>
+            request.cookies.set(name, value)
+          );
+          supabaseResponse = NextResponse.next({
+            request,
+          });
+          cookiesToSet.forEach(({ name, value, options }) =>
+            supabaseResponse.cookies.set(name, value, options)
+          );
+        },
+      },
+    }
+  );
+
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  // Protect dashboard routes
+  if (request.nextUrl.pathname.startsWith("/dashboard") && !user) {
+    const url = request.nextUrl.clone();
+    url.pathname = "/login";
+    return NextResponse.redirect(url);
+  }
+
+  // Redirect logged-in users away from auth pages
+  if (
+    user &&
+    (request.nextUrl.pathname === "/login" ||
+      request.nextUrl.pathname === "/signup")
+  ) {
+    const url = request.nextUrl.clone();
+    url.pathname = "/dashboard";
+    return NextResponse.redirect(url);
+  }
+
+  return supabaseResponse;
+}
+
+export const config = {
+  matcher: [
+    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
+  ],
+};

package/bundles/nextjs-saas/sentry.edge.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+if (process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN) {
+  Sentry.init({
+    dsn: process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN,
+    tracesSampleRate: process.env.NODE_ENV === "development" ? 1 : 0.1,
+    dataCollection: {
+      userInfo: false, cookies: false,
+      httpHeaders: { request: false, response: false }, urlQueryParams: false,
+      httpBodies: [], genAI: { inputs: false, outputs: false },
+      databaseQueryData: false, queues: false,
+      graphQL: { document: false, variables: false },
+    },
+  });
+}

package/bundles/nextjs-saas/sentry.server.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/nextjs";
+
+if (process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN) {
+  Sentry.init({
+    dsn: process.env.SENTRY_DSN || process.env.NEXT_PUBLIC_SENTRY_DSN,
+    tracesSampleRate: process.env.NODE_ENV === "development" ? 1 : 0.1,
+    dataCollection: {
+      userInfo: false, cookies: false,
+      httpHeaders: { request: false, response: false }, urlQueryParams: false,
+      httpBodies: [], genAI: { inputs: false, outputs: false },
+      databaseQueryData: false, queues: false,
+      graphQL: { document: false, variables: false },
+    },
+  });
+}

package/bundles/nextjs-saas/supabase/migrations/001_initial_schema.sql

@@ -0,0 +1,66 @@
+-- Initial database schema
+-- Generated by Lattice Project Builder
+
+-- Enable UUID extension
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+-- Users profile table (extends auth.users)
+CREATE TABLE IF NOT EXISTS public.profiles (
+  id UUID REFERENCES auth.users(id) ON DELETE CASCADE PRIMARY KEY,
+  email TEXT,
+  full_name TEXT,
+  avatar_url TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Enable Row Level Security
+ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
+
+-- Profiles policies
+CREATE POLICY "Users can view own profile"
+  ON public.profiles FOR SELECT
+  USING (auth.uid() = id);
+
+CREATE POLICY "Users can update own profile"
+  ON public.profiles FOR UPDATE
+  USING (auth.uid() = id);
+
+-- Billing identifiers and any future privileged columns are server-owned.
+REVOKE INSERT, UPDATE, DELETE ON TABLE public.profiles FROM PUBLIC, anon, authenticated;
+GRANT UPDATE (full_name, avatar_url) ON TABLE public.profiles TO authenticated;
+GRANT ALL ON TABLE public.profiles TO service_role;
+
+-- Function to create profile on signup
+CREATE OR REPLACE FUNCTION public.handle_new_user()
+RETURNS TRIGGER AS $$
+BEGIN
+  INSERT INTO public.profiles (id, email, full_name)
+  VALUES (
+    NEW.id,
+    NEW.email,
+    NEW.raw_user_meta_data->>'full_name'
+  );
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER SET search_path = '';
+
+-- Trigger for new user signup
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();
+
+-- Updated at trigger function
+CREATE OR REPLACE FUNCTION public.update_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Apply updated_at trigger to profiles
+CREATE TRIGGER update_profiles_updated_at
+  BEFORE UPDATE ON public.profiles
+  FOR EACH ROW EXECUTE FUNCTION public.update_updated_at();

package/bundles/nextjs-saas/supabase/migrations/002_billing.sql

@@ -0,0 +1,17 @@
+ALTER TABLE public.profiles
+  ADD COLUMN IF NOT EXISTS stripe_customer_id TEXT UNIQUE;
+
+CREATE TABLE IF NOT EXISTS public.billing_subscriptions (
+  id TEXT PRIMARY KEY,
+  user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  stripe_customer_id TEXT NOT NULL,
+  stripe_price_id TEXT,
+  status TEXT NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+ALTER TABLE public.billing_subscriptions ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users can view own subscription"
+  ON public.billing_subscriptions FOR SELECT
+  USING (auth.uid() = user_id);

package/bundles/nextjs-saas/tsconfig.json

@@ -0,0 +1,42 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/bundles/nextjs-saas/types/database.types.ts

@@ -0,0 +1,76 @@
+// Generated database types
+// Run: npx supabase gen types typescript --local > types/database.types.ts
+// to generate actual types from your database
+
+export type Json =
+  | string
+  | number
+  | boolean
+  | null
+  | { [key: string]: Json | undefined }
+  | Json[];
+
+export interface Database {
+  public: {
+    Tables: {
+      profiles: {
+        Row: {
+          id: string;
+          email: string | null;
+          full_name: string | null;
+          avatar_url: string | null;
+          stripe_customer_id: string | null;
+          created_at: string;
+          updated_at: string;
+        };
+        Insert: {
+          id: string;
+          email?: string | null;
+          full_name?: string | null;
+          avatar_url?: string | null;
+          stripe_customer_id?: string | null;
+          created_at?: string;
+          updated_at?: string;
+        };
+        Update: {
+          id?: string;
+          email?: string | null;
+          full_name?: string | null;
+          avatar_url?: string | null;
+          stripe_customer_id?: string | null;
+          created_at?: string;
+          updated_at?: string;
+        };
+        Relationships: [];
+      };
+      billing_subscriptions: {
+        Row: {
+          id: string;
+          user_id: string;
+          stripe_customer_id: string;
+          stripe_price_id: string | null;
+          status: string;
+          updated_at: string;
+        };
+        Insert: {
+          id: string;
+          user_id: string;
+          stripe_customer_id: string;
+          stripe_price_id?: string | null;
+          status: string;
+          updated_at?: string;
+        };
+        Update: {
+          stripe_price_id?: string | null;
+          status?: string;
+          updated_at?: string;
+        };
+        Relationships: [];
+      };
+    };
+    Views: { [_ in never]: never };
+    Functions: { [_ in never]: never };
+    Enums: { [_ in never]: never };
+    CompositeTypes: { [_ in never]: never };
+  };
+}

package/bundles/nextjs-trpc/.agents/skills/lattice-feature-handoff/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: lattice-feature-handoff
+description: Prepare an evidence-backed feature handoff for Lattice release review after scoped implementation or when work is blocked.
+---
+
+# Lattice Feature Handoff
+
+Use this skill after a scoped feature task, before asking for merge or release review, or when a prerequisite blocks completion.
+
+## Authority
+
+You may implement the approved scope, run checks, and prepare a handoff. You may not merge, deploy, migrate data, change provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Steps
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.lattice/release-workflow.json`.
+2. Confirm the repository, worktree, branch, approved base ref, base SHA, and current head SHA. Do not infer lineage from a task description.
+3. Inspect the exact diff and preserve unrelated work. Record included and excluded scope.
+4. Run the repository checks required for the change. Record every material command as `passed`, `failed`, `not_run`, or `blocked`; never convert missing proof into a pass.
+5. Assess database migrations, environment changes, background workers, provider effects, and destructive actions. A field needing review must remain `needs_assessment`.
+6. Copy `.lattice/templates/feature-handoff.json` to `.lattice/runtime/<handoff-id>.json` and replace every placeholder. Do not include credentials, tokens, secret values, payment data, or direct personal contact data.
+7. Check that the handoff parses as JSON and contains every field required by `.lattice/schemas/feature-handoff.schema.json`.
+8. Set exactly one status:
+   - `READY_FOR_RELEASE`: scoped implementation and its required proof are complete.
+   - `NEEDS_REWORK`: a confirmed defect or failed check remains.
+   - `BLOCKED`: an external prerequisite, missing authority, or unsafe ambiguity prevents progress.
+9. If the current environment exposes a native messaging tool and an exact Release Manager destination is bound, send the handoff there. Otherwise use the repository's GitHub issue, pull request, or comment, or surface the exact artifact path to the owner. Never claim delivery without tool evidence.
+
+## Handoff Summary
+
+Report the artifact path, status, base SHA, head SHA, checks, operational impacts, required approvals, and transport result. `READY_FOR_RELEASE` means ready for independent review, not merged, deployed, released, or live.

package/bundles/nextjs-trpc/.agents/skills/lattice-release-manager/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: lattice-release-manager
+description: Independently audit a Lattice feature handoff and prepare an evidence-backed release recommendation without assuming production authority.
+---
+
+# Lattice Release Manager
+
+Use this skill when a feature handoff is ready for independent release review or needs an evidence-backed rework decision.
+
+## Authority
+
+You may inspect source state, review the exact diff, run non-destructive checks, request rework, and prepare a release recommendation. You may not deploy or promote production, migrate data, write to provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Review
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, `.lattice/release-workflow.json`, and the handoff schema.
+2. Resolve the actual repository and worktree. Verify the handoff base SHA, head SHA, branch, and diff. A mismatch blocks the review until reconciled.
+3. Review only the exact candidate. Treat handoff claims as evidence to verify, not truth to repeat.
+4. Rerun the checks proportionate to the change and inspect failure, permission, recovery, migration, provider, worker, and environment boundaries that are in scope.
+5. Confirm no secret values or direct personal contact or payment data appear in the handoff.
+6. Return one decision:
+   - Accept for owner approval: the exact candidate and required proof pass.
+   - Request rework: a reproducible defect, failed gate, incomplete evidence, or scope mismatch is identified.
+   - Block: lineage, authority, environment, or safety cannot be resolved.
+7. When rework is required and a native tool plus exact origin task are available, send the evidence to that task. Otherwise record it on the shared GitHub surface or preserve a handoff artifact and report that routing remains pending.
+
+## Release State
+
+Keep these states separate: automated validation, candidate preparation, owner approval, deployment, and live verification. Do not merge or clean feature work until the authorized release is proven live and rollback evidence is current.