@mars-stack/cli 0.2.0 → 0.2.2

package/template/docs/exec-plans/tech-debt.md

@@ -0,0 +1,7 @@
+# Technical Debt Tracker
+
+Track technical debt items here as the project evolves.
+
+| Item | Location | Impact | Status |
+|------|----------|--------|--------|
+| — | — | — | No items yet |

package/template/docs/product-specs/index.md

@@ -0,0 +1,7 @@
+# Product Specifications
+
+Add product specs here as features are designed.
+
+| Spec | Status | Summary |
+|------|--------|---------|
+| — | — | No specs yet |

package/template/docs/references/index.md

@@ -0,0 +1,18 @@
+# References
+
+External documents, articles, and open-source projects that influenced the architecture and conventions of this project. Track influences here so future agents (and humans) can trace *why* things are structured the way they are.
+
+| Reference | Type | Key Influence |
+|-----------|------|---------------|
+| [Mars Product Roadmap](../exec-plans/completed/) | Execution Plan | The blueprint that generated this project's architecture |
+| [Harness Engineering](https://openai.com/index/harness-engineering/) | Article | Agent-first development model: AGENTS.md, docs/ knowledge base, plans as artifacts |
+| [UI Design Brain](https://github.com/carmahhawwari/ui-design-brain) | Cursor Skill | Component knowledge model for UI generation |
+| [Vercel React Best Practices](https://github.com/vercel-labs/agent-skills/tree/main/skills/react-best-practices) | Agent Skill | Structured rules with impact levels for React/Next.js performance |
+
+## Adding References
+
+When a conversation, article, or external project significantly influences an architectural decision:
+
+1. Add an entry to this table with the source, type, and key influence
+2. If the influence is substantial, create a dedicated reference file explaining what was adopted and why
+3. Update `docs/design-docs/` if the influence resulted in a new design decision

package/template/e2e/api.spec.ts

@@ -0,0 +1,20 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('API endpoints', () => {
+  test('CSRF endpoint returns token', async ({ request }) => {
+    const response = await request.get('/api/csrf');
+    expect(response.ok()).toBeTruthy();
+    const body = await response.json();
+    expect(body.csrfToken).toBeDefined();
+  });
+
+  test('readiness endpoint returns ok', async ({ request }) => {
+    const response = await request.get('/api/readiness');
+    expect(response.status()).toBeLessThan(600);
+  });
+
+  test('protected endpoints return 401 without auth', async ({ request }) => {
+    const response = await request.get('/api/protected/admin/users');
+    expect(response.status()).toBe(401);
+  });
+});

package/template/e2e/auth.spec.ts

@@ -0,0 +1,24 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Authentication flow', () => {
+  test('signup page loads', async ({ page }) => {
+    await page.goto('/register');
+    await expect(page).toHaveTitle(/register|sign up/i);
+    await expect(page.locator('form')).toBeVisible();
+  });
+
+  test('login page loads', async ({ page }) => {
+    await page.goto('/sign-in');
+    await expect(page.locator('form')).toBeVisible();
+  });
+
+  test('unauthenticated user is redirected from protected routes', async ({ page }) => {
+    await page.goto('/dashboard');
+    await expect(page).toHaveURL(/sign-in/);
+  });
+
+  test('forgot password page loads', async ({ page }) => {
+    await page.goto('/forgotten-password');
+    await expect(page.locator('form')).toBeVisible();
+  });
+});

package/template/e2e/public.spec.ts

@@ -0,0 +1,25 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Public pages', () => {
+  test('landing page loads', async ({ page }) => {
+    await page.goto('/');
+    await expect(page.locator('h1')).toBeVisible();
+  });
+
+  test('terms page loads', async ({ page }) => {
+    await page.goto('/terms');
+    await expect(page.locator('h1')).toBeVisible();
+  });
+
+  test('privacy page loads', async ({ page }) => {
+    await page.goto('/privacy');
+    await expect(page.locator('h1')).toBeVisible();
+  });
+
+  test('health endpoint returns ok', async ({ request }) => {
+    const response = await request.get('/api/health');
+    expect(response.ok()).toBeTruthy();
+    const body = await response.json();
+    expect(body.status).toBe('ok');
+  });
+});

package/template/eslint.config.mjs

@@ -0,0 +1,24 @@
+import nextVitals from 'eslint-config-next/core-web-vitals';
+import tsConfig from 'eslint-config-next/typescript';
+
+const eslintConfig = [
+  ...nextVitals,
+  ...tsConfig,
+  {
+    ignores: ['.next/**', 'out/**', 'build/**', 'node_modules/**'],
+  },
+  {
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+      '@typescript-eslint/no-explicit-any': 'error',
+      'prefer-const': 'error',
+      'no-console': ['warn', { allow: ['warn', 'error'] }],
+      'react-hooks/set-state-in-effect': 'off',
+    },
+  },
+];
+
+export default eslintConfig;

package/template/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/template/next.config.ts

@@ -0,0 +1,45 @@
+import type { NextConfig } from 'next';
+
+const cspDirectives = [
+  "default-src 'self'",
+  "script-src 'self' 'unsafe-eval' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' blob: data: https:",
+  "font-src 'self' https://fonts.gstatic.com",
+  "connect-src 'self' https:",
+  "frame-ancestors 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+];
+
+const cspHeader = cspDirectives.join('; ');
+
+const securityHeaders = [
+  { key: 'X-Frame-Options', value: 'DENY' },
+  { key: 'X-Content-Type-Options', value: 'nosniff' },
+  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  { key: 'X-DNS-Prefetch-Control', value: 'on' },
+  {
+    key: 'Strict-Transport-Security',
+    value: 'max-age=63072000; includeSubDomains; preload',
+  },
+  {
+    key: 'Permissions-Policy',
+    value: 'camera=(), microphone=(), geolocation=()',
+  },
+  { key: 'Content-Security-Policy', value: cspHeader },
+];
+
+const nextConfig: NextConfig = {
+  transpilePackages: ['@mars-stack/core', '@mars-stack/ui'],
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: securityHeaders,
+      },
+    ];
+  },
+};
+
+export default nextConfig;

package/template/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "@mars-stack/template",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "node scripts/ensure-db.mjs && next dev --turbopack",
+    "dev:no-db": "next dev --turbopack",
+    "db:local": "npx prisma dev --detach",
+    "db:local:stop": "npx prisma dev stop",
+    "db:local:ls": "npx prisma dev ls",
+    "build": "prisma generate && next build",
+    "start": "next start",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "playwright test",
+    "test:e2e:ui": "playwright test --ui",
+    "db:generate": "prisma generate",
+    "db:push": "prisma generate && prisma db push",
+    "db:migrate": "prisma generate && prisma migrate dev",
+    "db:seed": "prisma db seed",
+    "db:studio": "prisma studio",
+    "generate:env": "tsx scripts/generate-env-example.ts",
+    "check:architecture": "tsx scripts/check-architecture.ts",
+    "check:docs": "tsx scripts/check-doc-freshness.ts",
+    "update:quality": "tsx scripts/update-quality-score.ts"
+  },
+  "dependencies": {
+    "@mars-stack/core": "*",
+    "@mars-stack/ui": "*",
+    "@prisma/adapter-pg": "^7.5.0",
+    "@prisma/client": "^7.5.0",
+    "dotenv": "^16.4.0",
+    "@react-email/components": "^1.0.8",
+    "@sendgrid/mail": "^8.1.0",
+    "@upstash/ratelimit": "^2.0.0",
+    "@upstash/redis": "^1.36.4",
+    "bcryptjs": "^2.4.3",
+    "clsx": "^2.1.1",
+    "jose": "^6.2.1",
+    "next": "^16.0.0",
+    "pino": "^9.6.0",
+    "pino-pretty": "^13.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "react-email": "^5.2.9",
+    "server-only": "^0.0.1",
+    "stripe": "^17.0.0",
+    "zod": "^4.3.6"
+  },
+  "prisma": {
+    "schema": "prisma/schema",
+    "seed": "npx tsx scripts/seed.ts"
+  },
+  "devDependencies": {
+    "@eslint/eslintrc": "^3.3.5",
+    "@playwright/test": "^1.50.0",
+    "@tailwindcss/postcss": "^4.0.0",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.0.0",
+    "@types/bcryptjs": "^2.4.0",
+    "@types/node": "^25.4.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^5.1.4",
+    "eslint": "^9.0.0",
+    "eslint-config-next": "^16.0.0",
+    "jsdom": "^28.1.0",
+    "postcss": "^8.5.0",
+    "prettier": "^3.5.0",
+    "prettier-plugin-tailwindcss": "^0.7.2",
+    "prisma": "^7.5.0",
+    "tailwindcss": "^4.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}

package/template/playwright.config.ts

@@ -0,0 +1,31 @@
+import { defineConfig, devices } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './e2e',
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+  reporter: 'html',
+  use: {
+    baseURL: 'http://localhost:3000',
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+    {
+      name: 'mobile',
+      use: { ...devices['iPhone 14'] },
+    },
+  ],
+  webServer: {
+    command: 'yarn build && yarn start',
+    url: 'http://localhost:3000',
+    reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
+  },
+});

package/template/postcss.config.mjs

@@ -0,0 +1,8 @@
+/** @type {import('postcss-load-config').Config} */
+const config = {
+  plugins: {
+    '@tailwindcss/postcss': {},
+  },
+};
+
+export default config;

package/template/prisma/generated/prisma/browser.ts

@@ -0,0 +1,49 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!! */
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+// @ts-nocheck 
+/*
+ * This file should be your main import to use Prisma-related types and utilities in a browser. 
+ * Use it to get access to models, enums, and input types.
+ * 
+ * This file does not contain a `PrismaClient` class, nor several other helpers that are intended as server-side only.
+ * See `client.ts` for the standard, server-side entry point.
+ *
+ * 🟢 You can import this file directly.
+ */
+
+import * as Prisma from './internal/prismaNamespaceBrowser'
+export { Prisma }
+export * as $Enums from './enums'
+export * from './enums';
+/**
+ * Model User
+ * 
+ */
+export type User = Prisma.UserModel
+/**
+ * Model Account
+ * 
+ */
+export type Account = Prisma.AccountModel
+/**
+ * Model Session
+ * 
+ */
+export type Session = Prisma.SessionModel
+/**
+ * Model VerificationToken
+ * 
+ */
+export type VerificationToken = Prisma.VerificationTokenModel
+/**
+ * Model File
+ * 
+ */
+export type File = Prisma.FileModel
+/**
+ * Model Subscription
+ * 
+ */
+export type Subscription = Prisma.SubscriptionModel

package/template/prisma/generated/prisma/client.ts

@@ -0,0 +1,73 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!! */
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+// @ts-nocheck 
+/*
+ * This file should be your main import to use Prisma. Through it you get access to all the models, enums, and input types.
+ * If you're looking for something you can import in the client-side of your application, please refer to the `browser.ts` file instead.
+ *
+ * 🟢 You can import this file directly.
+ */
+
+import * as process from 'node:process'
+import * as path from 'node:path'
+import { fileURLToPath } from 'node:url'
+globalThis['__dirname'] = path.dirname(fileURLToPath(import.meta.url))
+
+import * as runtime from "@prisma/client/runtime/client"
+import * as $Enums from "./enums"
+import * as $Class from "./internal/class"
+import * as Prisma from "./internal/prismaNamespace"
+
+export * as $Enums from './enums'
+export * from "./enums"
+/**
+ * ## Prisma Client
+ * 
+ * Type-safe database client for TypeScript
+ * @example
+ * ```
+ * const prisma = new PrismaClient({
+ *   adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL })
+ * })
+ * // Fetch zero or more Users
+ * const users = await prisma.user.findMany()
+ * ```
+ * 
+ * Read more in our [docs](https://pris.ly/d/client).
+ */
+export const PrismaClient = $Class.getPrismaClientClass()
+export type PrismaClient<LogOpts extends Prisma.LogLevel = never, OmitOpts extends Prisma.PrismaClientOptions["omit"] = Prisma.PrismaClientOptions["omit"], ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = $Class.PrismaClient<LogOpts, OmitOpts, ExtArgs>
+export { Prisma }
+
+/**
+ * Model User
+ * 
+ */
+export type User = Prisma.UserModel
+/**
+ * Model Account
+ * 
+ */
+export type Account = Prisma.AccountModel
+/**
+ * Model Session
+ * 
+ */
+export type Session = Prisma.SessionModel
+/**
+ * Model VerificationToken
+ * 
+ */
+export type VerificationToken = Prisma.VerificationTokenModel
+/**
+ * Model File
+ * 
+ */
+export type File = Prisma.FileModel
+/**
+ * Model Subscription
+ * 
+ */
+export type Subscription = Prisma.SubscriptionModel