@mars-stack/cli 7.0.2 → 7.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mars-stack/cli",
-  "version": "7.0.2",
+  "version": "7.0.3",
   "description": "MARS CLI: scaffold, configure, and maintain SaaS apps",
   "license": "MIT",
   "repository": {

package/template/AGENTS.md

@@ -97,12 +97,16 @@ yarn db:studio        # Open Prisma Studio
 2. **Document every executed plan.** All plans — whether they started in a chat, a Cursor plan file, or someone's head — must end up in `docs/exec-plans/completed/` with decisions, discoveries, and outcomes recorded. Use the `capture-conversation-context` skill.
 3. **Feed conversations back.** Decisions, discoveries, and context that live only in chat threads are invisible to future agents. See [docs/design-docs/conversation-as-system-record.md](docs/design-docs/conversation-as-system-record.md).
 
+## Dogfood QA
+
+After **generator changes**, **template sync**, or before a **release**, run the manual checklist in **[docs/exec-plans/QA-dogfood-matrix.md](docs/exec-plans/QA-dogfood-matrix.md)** (happy path + edges × local / preview / prod smoke). Unchecked rows mean **not verified**. If a feature is off in `app.config.ts`, mark the row **N/A** instead of removing it.
+
 ## Pointers
 
 - **Architecture details:** [docs/design-docs/](docs/design-docs/)
 - **Core beliefs:** [docs/design-docs/core-beliefs.md](docs/design-docs/core-beliefs.md)
 - **Conversation feedback:** [docs/design-docs/conversation-as-system-record.md](docs/design-docs/conversation-as-system-record.md)
-- **Execution plans:** [docs/exec-plans/](docs/exec-plans/)
+- **Execution plans:** [docs/exec-plans/](docs/exec-plans/) — includes [QA dogfood matrix](docs/exec-plans/QA-dogfood-matrix.md)
 - **Quality scores:** [docs/QUALITY_SCORE.md](docs/QUALITY_SCORE.md)
 - **Skills:** [.cursor/skills/](.cursor/skills/) — all skills use the `mars-` prefix (e.g., `mars-add-api-route/`, `mars-configure-email/`)
 - **Rules:** [.cursor/rules/](.cursor/rules/) — all rules use the `mars-` prefix (e.g., `mars-security.mdc`, `mars-data-access.mdc`)

package/template/docs/exec-plans/QA-dogfood-matrix.md

@@ -0,0 +1,111 @@
+# Dogfood QA matrix (generated app)
+
+Manual and automated verification that the **entire shipped surface** of this app behaves correctly end-to-end—including edge cases—in **local**, **preview**, and **production-class** environments.
+
+**Source:** Mars monorepo [dogfood guard-rails plan](https://github.com/greaveselliott/mars/blob/main/docs/exec-plans/active/dogfood-guard-rails-generated-apps-p0.md). Update this file when you add or remove first-class features.
+
+## How to use
+
+1. Work **row by row**. Check the box only after the **happy path and listed edges** are exercised for that row in the given environment.
+2. **Unchecked boxes mean “not verified”—not “passed”.** Do not infer green status from silence.
+3. After each run, fill **Last run** with **date** (ISO `YYYY-MM-DD` is fine), **environment** (`local` / `preview` / `prod smoke`), and **commit** (short SHA or release tag you tested).
+4. Run this matrix after **major generator or template upgrades**, before a **release**, or when changing **auth, CSRF, billing, or uploads**.
+
+## Feature flags (`app.config.ts`)
+
+- If a feature is **disabled** in `src/config/app.config.ts`, mark the row **N/A** in the notes column (feature not present) instead of deleting the row. If the feature is enabled but you are **skipping** verification temporarily, mark **Skip** with a short reason—still not a pass.
+- If you **customized** Mars plumbing files, treat **user-owned** paths per `mars template sync` / upgrade docs before assuming failures are product bugs.
+
+---
+
+## Matrix
+
+### Auth
+
+- [ ] **Verified**
+  - **Happy path + edges:** sign-in, sign-up, forgot/reset, verify email, session expiry, wrong password, locked account, already logged-in redirect to dashboard.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Protected shell
+
+- [ ] **Verified**
+  - **Happy path + edges:** nav, search, notifications, command palette (⌘K), theme toggle, user menu, **logout** (cookie cleared, lands on expected page).
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Onboarding
+
+- [ ] **Verified**
+  - **Happy path + edges:** all steps, skip where allowed, **CSRF** on step POST, mobile stepper layout.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Settings
+
+- [ ] **Verified**
+  - **Happy path + edges:** display name, password change, **session list** (copy vs multi-row behaviour), revoke one / revoke all.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Billing / pricing
+
+- [ ] **Verified**
+  - **Happy path + edges:** checkout/portal where Stripe enabled; gated UI when disabled.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Files
+
+- [ ] **Verified**
+  - **Happy path + edges:** upload (XHR + **CSRF**), list, download, delete (**CSRF**), size limit error.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### AI
+
+- [ ] **Verified**
+  - **Happy path + edges:** chat send, stream, **CSRF**, provider-none vs configured behaviour.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Admin
+
+- [ ] **Verified**
+  - **Happy path + edges:** users list, forbidden for non-admin.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Blog, dashboard, landing, coming-soon, legal, cookie consent
+
+- [ ] **Verified**
+  - **Happy path + edges:** load + critical interaction for blog, files page, dashboard cards, landing, coming-soon, legal pages, cookie consent as applicable.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**
+
+### Edge cases (cross-cutting)
+
+- [ ] **Verified**
+  - **Happy path + edges:** **403 CSRF** surfaces clear message (not `SyntaxError`), **mobile ~375px**, **dark mode**, **slow network** / abort, **two tabs** same user.
+  - **Local** — Date: _____________  Env: _____________  Commit: _____________
+  - **Preview** — Date: _____________  Env: _____________  Commit: _____________
+  - **Prod smoke** — Date: _____________  Env: _____________  Commit: _____________
+  - **Notes (N/A / Skip):**

package/template/scripts/dogfood-matrix-contract.test.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const matrixPath = join(__dirname, '../docs/exec-plans/QA-dogfood-matrix.md');
+
+/** Minimum feature slices from docs/exec-plans/active/dogfood-guard-rails-generated-apps-p0.md */
+const REQUIRED_SECTION_TITLES = [
+  'Auth',
+  'Protected shell',
+  'Onboarding',
+  'Settings',
+  'Billing / pricing',
+  'Files',
+  'AI',
+  'Admin',
+  'Blog, dashboard, landing, coming-soon, legal, cookie consent',
+  'Edge cases (cross-cutting)',
+] as const;
+
+describe('QA dogfood matrix contract', () => {
+  const content = readFileSync(matrixPath, 'utf8');
+
+  it('exists and documents last-run fields per environment', () => {
+    expect(content).toContain('**Local**');
+    expect(content).toContain('**Preview**');
+    expect(content).toContain('**Prod smoke**');
+    expect(content).toMatch(/Date:\s+_+.*Commit:/s);
+  });
+
+  it('states that unchecked rows are not verified', () => {
+    expect(content).toMatch(/not verified|Not verified/i);
+  });
+
+  it('documents N/A vs Skip for disabled or deferred features', () => {
+    expect(content).toMatch(/N\/A|Skip/);
+    expect(content).toMatch(/app\.config\.ts/);
+  });
+
+  it.each(REQUIRED_SECTION_TITLES)('includes matrix section: %s', (title) => {
+    expect(content).toContain(`### ${title}`);
+  });
+});

package/template/vitest.config.ts

@@ -8,7 +8,7 @@ export default defineConfig({
     environment: 'jsdom',
     globals: true,
     setupFiles: ['./vitest.setup.ts'],
-    include: ['src/**/*.test.{ts,tsx}'],
+    include: ['src/**/*.test.{ts,tsx}', 'scripts/**/*.test.ts'],
     passWithNoTests: true,
     coverage: {
       provider: 'v8',