@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/expo-supabase/.lattice/schemas/feature-handoff.schema.json

@@ -0,0 +1,264 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://latticeai.app/schemas/feature-handoff-1.0.json",
+  "title": "Lattice Feature Handoff",
+  "description": "Evidence-backed transfer from a feature agent to release review. Never include credentials, tokens, secret values, payment data, or direct personal contact data.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "handoffId",
+    "project",
+    "origin",
+    "destination",
+    "status",
+    "summary",
+    "scope",
+    "changedFiles",
+    "verification",
+    "impacts",
+    "risks",
+    "approvalsRequired",
+    "createdAt"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "1.0"
+    },
+    "handoffId": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]{2,79}$"
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "repository",
+        "baseRef",
+        "baseSha",
+        "headSha",
+        "branch",
+        "worktree"
+      ],
+      "properties": {
+        "repository": {
+          "type": "string",
+          "minLength": 1
+        },
+        "baseRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "baseSha": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
+        },
+        "headSha": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
+        },
+        "branch": {
+          "type": "string",
+          "minLength": 1
+        },
+        "worktree": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "origin": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider",
+        "taskId",
+        "taskName"
+      ],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "minLength": 1
+        },
+        "taskId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "taskName": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "destination": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "role",
+        "taskId"
+      ],
+      "properties": {
+        "role": {
+          "const": "release-manager"
+        },
+        "taskId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "status": {
+      "enum": [
+        "READY_FOR_RELEASE",
+        "NEEDS_REWORK",
+        "BLOCKED"
+      ]
+    },
+    "summary": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "included",
+        "excluded"
+      ],
+      "properties": {
+        "included": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "excluded": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "changedFiles": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "verification": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "command",
+          "result",
+          "scope",
+          "evidence"
+        ],
+        "properties": {
+          "command": {
+            "type": "string",
+            "minLength": 1
+          },
+          "result": {
+            "enum": [
+              "passed",
+              "failed",
+              "not_run",
+              "blocked"
+            ]
+          },
+          "scope": {
+            "type": "string",
+            "minLength": 1
+          },
+          "evidence": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "impacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "databaseMigration",
+        "environmentChanges",
+        "backgroundWorkers",
+        "providers",
+        "destructiveActions"
+      ],
+      "properties": {
+        "databaseMigration": {
+          "enum": [
+            "none",
+            "required",
+            "needs_assessment"
+          ]
+        },
+        "environmentChanges": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "backgroundWorkers": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "providers": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "destructiveActions": {
+          "enum": [
+            "none",
+            "required",
+            "needs_assessment"
+          ]
+        }
+      }
+    },
+    "risks": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "approvalsRequired": {
+      "type": "array",
+      "items": {
+        "enum": [
+          "production_promotion",
+          "database_or_data_migration",
+          "provider_or_account_write",
+          "secret_or_environment_change",
+          "destructive_action"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/bundles/expo-supabase/.lattice/templates/feature-handoff.json

@@ -0,0 +1,52 @@
+{
+  "schemaVersion": "1.0",
+  "handoffId": "replace-with-handoff-id",
+  "project": {
+    "repository": "owner/repository",
+    "baseRef": "origin/main",
+    "baseSha": "0000000000000000000000000000000000000000",
+    "headSha": "1111111111111111111111111111111111111111",
+    "branch": "feature/replace-with-branch",
+    "worktree": "replace-with-absolute-or-repo-relative-worktree"
+  },
+  "origin": {
+    "provider": "replace-with-provider",
+    "taskId": null,
+    "taskName": "replace-with-task-name"
+  },
+  "destination": {
+    "role": "release-manager",
+    "taskId": null
+  },
+  "status": "BLOCKED",
+  "summary": "Replace every placeholder and record the observable outcome.",
+  "scope": {
+    "included": [
+      "Replace with the implemented scope."
+    ],
+    "excluded": [
+      "Replace with an explicit non-goal."
+    ]
+  },
+  "changedFiles": [],
+  "verification": [
+    {
+      "command": "replace-with-verification-command",
+      "result": "not_run",
+      "scope": "Replace with what the command proves.",
+      "evidence": "Replace with the exit result or artifact reference."
+    }
+  ],
+  "impacts": {
+    "databaseMigration": "needs_assessment",
+    "environmentChanges": [],
+    "backgroundWorkers": [],
+    "providers": [],
+    "destructiveActions": "needs_assessment"
+  },
+  "risks": [
+    "Replace with remaining risk or remove this item."
+  ],
+  "approvalsRequired": [],
+  "createdAt": "1970-01-01T00:00:00.000Z"
+}

package/bundles/expo-supabase/.mcp.json

@@ -0,0 +1,35 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem@1.0.0",
+        "."
+      ],
+      "disabled": true
+    },
+    "github": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/readonly",
+      "headers": {
+        "Authorization": "Bearer ${GITHUB_TOKEN}"
+      },
+      "disabled": true
+    },
+    "supabase": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@supabase/mcp-server-supabase@0.14.0",
+        "--read-only",
+        "--project-ref",
+        "${SUPABASE_PROJECT_REF}"
+      ],
+      "env": {
+        "SUPABASE_ACCESS_TOKEN": "${SUPABASE_ACCESS_TOKEN}"
+      },
+      "disabled": true
+    }
+  }
+}

package/bundles/expo-supabase/AGENTS.md

@@ -0,0 +1,58 @@
+# AGENTS
+
+## Read This First
+- Codex workspace rules live in `docs/rules/codex.md`.
+- Portable Agent Skills live in `.agents/skills/`.
+- Multi-agent release workflow lives in `docs/LATTICE_RELEASE_WORKFLOW.md`.
+- Cursor Agent rules live in `.cursor/rules/lattice-core.mdc`.
+- Claude Code rules and skills live in `.claude/rules/` and `.claude/skills/`.
+- GitHub Copilot instructions live in `.github/copilot-instructions.md` and `.github/instructions/lattice-core.instructions.md`.
+- Keep implementation aligned with `PROJECT_GUIDE.md`.
+
+## Mission
+- Keep implementation aligned with PROJECT_GUIDE.md.
+- Prioritize small, reviewable diffs and deterministic behavior.
+- Keep security boundaries explicit and avoid privilege escalation by default.
+
+## Stack Baseline
+- Framework: Expo
+- Language: TypeScript strict mode
+- Styling: Tailwind CSS
+- Test command: `npm run test`
+- Verify command: `npm run verify`
+
+## Execution Policy
+- Default mode: ask before risky commands.
+- Always explain why a command or change is needed.
+- Never write secrets to source control.
+
+## Tooling
+- Codex rules: `docs/rules/codex.md`
+- Portable verification skill: `.agents/skills/lattice-verify/SKILL.md`
+- Cursor rules: `.cursor/rules.md` and `.cursor/rules/lattice-core.mdc`
+- Cursor MCP: `.cursor/mcp.json`
+- Claude rules: `.claude/rules/lattice-core.md`
+- Claude skill: `.claude/skills/lattice-verify/SKILL.md`
+- Claude config: `.claude/settings.json`
+- Claude hooks: `.claude/hooks/*`
+- GitHub Copilot repo instructions: `.github/copilot-instructions.md`
+- GitHub Copilot path instructions: `.github/instructions/lattice-core.instructions.md`
+- MCP template: `.mcp.json`
+
+## Agent Skills
+- Use `lattice-verify` before final handoff, release work, or PR prep.
+- Use `lattice-feature-handoff` after scoped implementation and `lattice-release-manager` for independent release review.
+- Keep new reusable procedures in skills instead of bloating always-loaded instruction files.
+- Keep skills deterministic: clear trigger, exact commands, and explicit pass/fail reporting.
+
+## Required Checks Before Completion
+1. `npm run lint`
+2. `npm run typecheck`
+3. `npm run test`
+4. `npm run build`
+5. `npm run verify`
+
+## Hard Stops
+- Requirements conflict with PROJECT_GUIDE.md.
+- Any command would delete or overwrite unrelated user data.
+- Missing env vars required for delivery path.

package/bundles/expo-supabase/CLAUDE.md

@@ -0,0 +1,75 @@
+# Project Instructions
+
+This file provides context for Claude Code. For Cursor users, see `.cursor/rules.md` and `.cursor/rules/lattice-core.mdc`. For GitHub Copilot, see `.github/copilot-instructions.md` and `.github/instructions/lattice-core.instructions.md`. For Codex users, see `AGENTS.md` and `docs/rules/codex.md`.
+
+## Stack
+
+- **Framework**: Expo
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Core Rules
+
+1. **Stay in scope** - Only implement what's explicitly requested
+2. **No placeholders** - All code must be production-ready
+3. **Verify before coding** - Check current package versions and API compatibility
+4. **Minimal changes** - Keep modifications localized and simple
+5. **Test everything** - Run lint, typecheck, test, and build before submitting
+6. **Never expose secrets** - API keys, tokens, passwords, and credentials must NEVER be committed to version control
+
+## Claude Code Surfaces
+
+- `CLAUDE.md` is the shared project instruction file.
+- `.claude/rules/lattice-core.md` is path-scoped source guidance for code edits.
+- `.claude/skills/lattice-verify/SKILL.md` defines the repeatable verification workflow. Use `/lattice-verify` before final handoff or release work.
+- `.claude/settings.json` contains project permissions and hook wiring.
+- `.mcp.json` contains disabled MCP server templates. Approve and enable only the servers this project actually needs.
+
+## Verification Commands
+
+```bash
+npm run lint       # ESLint check
+npm run typecheck  # TypeScript check
+npm test           # Run tests
+npm run build      # Production build
+npm run verify     # All checks via Lattice
+```
+
+## Security Rules (CRITICAL)
+
+- **NEVER** commit API keys, secrets, tokens, or credentials to version control
+- **ALWAYS** use environment variables (`.env.local`, `.env`) for sensitive data
+- **ALWAYS** ensure `.env*` files are in `.gitignore`
+- **NEVER** hardcode secrets in source code, even in comments
+- **ONLY** access sensitive keys server-side (never expose to client-side code)
+
+## Expo Guidelines
+
+- Use Expo Router (`app/` directory)
+- Follow Expo file conventions
+- Use expo-image for optimized images
+
+## Before Making Changes
+
+1. Restate the scope in one paragraph
+2. Identify files to create or modify
+3. Check existing patterns in the codebase
+4. Verify package versions are current
+
+## After Making Changes
+
+1. Run all verification commands
+2. Fix any failures before proceeding
+3. Report verification results
+
+## Hard Stops
+
+- If requirements conflict -> ask for clarification
+- If verification fails -> fix before continuing
+- If scope is unclear -> ask for clarification
+- If you can't verify an API or version -> ask
+- If code contains hardcoded secrets -> STOP and use environment variables
+
+---
+*Generated by Lattice Project Builder*

package/bundles/expo-supabase/PROJECT_GUIDE.md

@@ -0,0 +1,201 @@
+# Expo + Supabase Starter — Project Guide
+
+This is your project guide for building a full-featured mobile app with Expo and Supabase.
+
+## Stack Overview
+
+| Layer | Technology | Purpose |
+|-------|------------|---------|
+| Framework | Expo SDK | Managed workflow, EAS Build |
+| Navigation | Expo Router | File-based routing |
+| Backend | Supabase | Auth, Database, Storage, Realtime, Edge Functions |
+| Analytics | PostHog | Product analytics |
+| Monitoring | Sentry | Crash reporting |
+
+**IMPORTANT FOR AI:** Always check `package.json` for the exact versions of dependencies before referencing them in code or documentation. Never hardcode version numbers—they change frequently. For Expo specifically, use tilde (`~`) versioning as shown in package.json.
+
+## Supabase Features Used
+
+- **Auth** — Email, OAuth, Magic Links
+- **Database** — PostgreSQL with Row Level Security
+- **Storage** — File uploads with policies
+- **Realtime** — Live subscriptions
+- **Edge Functions** — Serverless compute (Deno)
+
+## Project Structure
+
+```
+├── app/
+│   ├── (auth)/
+│   ├── (tabs)/
+│   └── _layout.tsx
+├── components/
+├── lib/
+│   ├── supabase.ts
+│   ├── auth.tsx
+│   └── storage.ts
+├── hooks/
+│   ├── useAuth.ts
+│   ├── useRealtime.ts
+│   └── useStorage.ts
+├── types/
+│   └── database.ts
+└── supabase/
+    ├── migrations/
+    └── functions/
+```
+
+---
+
+## Phase 1: Foundation (Days 1-2)
+
+### Goal
+Set up Supabase with authentication.
+
+### Tasks
+
+1. **Initialize Supabase project**
+   - Create project at supabase.com
+   - Link locally: `supabase link`
+   - Configure secure storage for tokens
+
+2. **Set up auth flow**
+   - Email/password authentication
+   - Auth state persistence
+   - Protected navigation
+
+3. **Generate TypeScript types**
+   - `npm run db:types`
+
+### Acceptance Criteria
+
+- [ ] Auth flow works
+- [ ] Types generated from schema
+- [ ] `npm run verify` passes
+
+---
+
+## Phase 2: Database & RLS (Days 3-5)
+
+### Goal
+Design schema with proper security.
+
+### Tasks
+
+1. **Create migrations**
+   - `supabase migration new <name>`
+   - Define tables and relationships
+
+2. **Set up Row Level Security**
+   - Policies for each table
+   - Test with different users
+
+3. **Create data hooks**
+   - useQuery for reads
+   - useMutation for writes
+
+### Acceptance Criteria
+
+- [ ] Schema migrated
+- [ ] RLS policies working
+- [ ] CRUD operations secure
+- [ ] `npm run verify` passes
+
+---
+
+## Phase 3: Storage & Realtime (Days 6-8)
+
+### Goal
+Add file uploads and live updates.
+
+### Tasks
+
+1. **Configure Storage**
+   - Create bucket
+   - Set policies
+   - Implement upload flow
+
+2. **Add Realtime subscriptions**
+   - Subscribe to changes
+   - Update UI live
+
+3. **Handle offline state**
+   - Queue mutations
+   - Sync on reconnect
+
+### Acceptance Criteria
+
+- [ ] File uploads work
+- [ ] Realtime updates display
+- [ ] Offline mode graceful
+- [ ] `npm run verify` passes
+
+---
+
+## Phase 4: Core Features (Days 9-14)
+
+### Goal
+Build your application features.
+
+### Tasks
+
+*Define your specific features here.*
+
+### Acceptance Criteria
+
+- [ ] Core flows work
+- [ ] Edge cases handled
+- [ ] `npm run verify` passes
+
+---
+
+## Phase 5: Polish & Launch (Days 15-21)
+
+### Goal
+Production-ready mobile app.
+
+### Tasks
+
+1. **Add monitoring**
+   - Sentry for crashes
+   - PostHog for analytics
+
+2. **Optimize performance**
+   - Profile with React DevTools
+   - Optimize images
+
+3. **App Store submission**
+   - `eas build --platform all`
+   - `eas submit`
+
+### Acceptance Criteria
+
+- [ ] Crashes tracked
+- [ ] Analytics working
+- [ ] App submitted
+- [ ] `npm run release-check` passes
+
+---
+
+## Supabase CLI Commands
+
+```bash
+# Link to project
+supabase link --project-ref <ref>
+
+# Create migration
+supabase migration new <name>
+
+# Push to remote
+supabase db push
+
+# Generate types
+npm run db:types
+
+# Start local dev
+supabase start
+```
+
+---
+
+*Generated by Lattice — AI workers are fast. Lattice keeps them building right.*