@msn-control/liftoff 0.2.1 → 0.3.0

package/dist/templates.js

@@ -1,20 +1,38 @@
 import { createHash } from 'node:crypto';
+import { addGenAiExtensionArtifacts } from './genai-templates.js';
+import { addStandardStackArtifacts, renderStandardDockerfile, renderStandardEnv } from './standard-templates.js';
 import { liftoffVersion } from './version.js';
 const contentHash = (content) => `sha256:${createHash('sha256').update(content, 'utf8').digest('hex')}`;
 const pyModule = (value) => value.replace(/-/g, '_');
 const titleCase = (value) => value.replace(/(^|[-_\s])([a-z])/g, (_match, prefix, letter) => `${prefix ? ' ' : ''}${letter.toUpperCase()}`).trim();
-const hasFunctionWorker = (plan) => plan.provider.id === 'azure' && plan.pattern.worker;
-const functionWorkerName = (plan) => `${plan.pattern.id}-worker`;
+const sourceString = (value) => JSON.stringify(value);
+const scriptSourceString = (value) => sourceString(value).replaceAll('<', '\\u003c');
+const escapeHtml = (value) => value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;');
+const genAiPattern = (plan) => {
+    if (plan.projectType.id !== 'genai' || !plan.pattern) {
+        throw new Error('GenAI template rendering requires a GenAI pattern.');
+    }
+    return plan.pattern;
+};
+const hasFunctionWorker = (plan) => plan.projectType.id === 'genai' && plan.provider.id === 'azure' && genAiPattern(plan).worker;
+const functionWorkerName = (plan) => `${genAiPattern(plan).id}-worker`;
 export function buildArtifacts(plan) {
     const artifacts = [];
     const add = (logicalName, category, pathParts, content) => {
         artifacts.push({ logicalName, category, pathParts, content: ensureTrailingNewline(content) });
     };
     addBaseArtifacts(add, plan);
-    addBackendArtifacts(add, plan);
-    addDatabaseArtifacts(add, plan);
-    addPatternArtifacts(add, plan);
-    addFunctionArtifacts(add, plan);
+    if (plan.projectType.id === 'genai') {
+        addGenAiExtensionArtifacts(add, plan, {
+            backend: addBackendArtifacts,
+            database: addDatabaseArtifacts,
+            pattern: addPatternArtifacts,
+            functions: addFunctionArtifacts
+        });
+    }
+    else {
+        addStandardStackArtifacts(add, plan);
+    }
     addEnvironmentArtifacts(add, plan);
     addDockerArtifacts(add, plan);
     addInfrastructureArtifacts(add, plan);
@@ -38,7 +56,9 @@ export function buildManifest(plan, artifacts) {
         liftoffVersion,
         project: {
             name: plan.projectName,
-            pattern: plan.pattern.id,
+            projectType: plan.projectType.id,
+            apiStack: plan.apiStack.id,
+            ...(plan.pattern ? { pattern: plan.pattern.id } : {}),
             cloud: plan.provider.id,
             region: plan.region.slug,
             frontend: plan.includeFrontend,
@@ -60,7 +80,9 @@ function addBaseArtifacts(add, plan) {
     add('root-gitignore', 'project', ['.gitignore'], renderGeneratedGitignore());
     add('liftoff-config', 'project', ['liftoff.config.json'], JSON.stringify({
         projectName: plan.projectName,
-        pattern: plan.pattern.id,
+        projectType: plan.projectType.id,
+        apiStack: plan.apiStack.id,
+        ...(plan.pattern ? { pattern: plan.pattern.id } : {}),
         cloud: plan.provider.id,
         region: plan.region.slug,
         includeFrontend: plan.includeFrontend,
@@ -68,10 +90,10 @@ function addBaseArtifacts(add, plan) {
         specWorkflow: plan.specWorkflow.id
     }, null, 2));
     add('env-example', 'configuration', ['.env.example'], renderEnvExample(plan));
-    add('backend-dockerfile', 'runtime', ['Dockerfile'], renderBackendDockerfile());
+    add('backend-dockerfile', 'runtime', ['Dockerfile'], plan.projectType.id === 'genai' ? renderBackendDockerfile() : renderStandardDockerfile(plan));
 }
 function addBackendArtifacts(add, plan) {
-    const routeModule = pyModule(plan.pattern.id);
+    const routeModule = pyModule(genAiPattern(plan).id);
     add('backend-pyproject', 'backend', ['backend', 'pyproject.toml'], renderBackendPyproject(plan));
     add('backend-package', 'backend', ['backend', '__init__.py'], '');
     add('backend-api-package', 'backend', ['backend', 'apis', '__init__.py'], '');
@@ -97,20 +119,21 @@ function addDatabaseArtifacts(add, plan) {
     add('database-schema', 'database', ['database', 'models', 'schema.sql'], renderDatabaseSchema(plan));
 }
 function addPatternArtifacts(add, plan) {
-    const routeModule = pyModule(plan.pattern.id);
+    const pattern = genAiPattern(plan);
+    const routeModule = pyModule(pattern.id);
     add('pattern-agent', 'pattern', ['backend', 'orchestration', 'agents', `${routeModule}_agent.py`], renderPatternAgent(plan));
-    add('pattern-prompt', 'pattern', ['backend', 'orchestration', 'prompts', `${plan.pattern.id}.md`], renderPromptTemplate(plan));
+    add('pattern-prompt', 'pattern', ['backend', 'orchestration', 'prompts', `${pattern.id}.md`], renderPromptTemplate(plan));
     add('pattern-agent-package', 'pattern', ['backend', 'orchestration', 'agents', '__init__.py'], '');
     add('pattern-prompt-readme', 'pattern', ['backend', 'orchestration', 'prompts', 'README.md'], renderPromptReadme());
-    if (plan.pattern.id === 'rag') {
+    if (pattern.id === 'rag') {
         add('rag-vector-store', 'pattern', ['backend', 'orchestration', 'retrieval', 'vector_store.py'], renderVectorStore());
         add('rag-retrieval-package', 'pattern', ['backend', 'orchestration', 'retrieval', '__init__.py'], '');
     }
-    if (plan.pattern.worker) {
+    if (pattern.worker) {
         add('pattern-worker', 'pattern', ['backend', 'workers', `${routeModule}_worker.py`], renderPatternWorker(plan));
         add('backend-workers-package', 'pattern', ['backend', 'workers', '__init__.py'], '');
     }
-    if (plan.pattern.id === 'fine-tuned') {
+    if (pattern.id === 'fine-tuned') {
         add('fine-tuned-eval-dataset', 'pattern', ['backend', 'evaluation', 'datasets', 'sample.jsonl'], '{"input":"Example request","expected":"Expected response placeholder"}');
     }
 }
@@ -132,7 +155,7 @@ function addFunctionArtifacts(add, plan) {
 }
 function addEnvironmentArtifacts(add, plan) {
     for (const environment of plan.environments) {
-        add(`environment-${environment.id}-backend`, 'environment', ['environments', environment.id, 'backend.env'], renderBackendEnv(plan, environment.id));
+        add(`environment-${environment.id}-backend`, 'environment', ['environments', environment.id, 'backend.env'], plan.projectType.id === 'genai' ? renderBackendEnv(plan, environment.id) : renderStandardEnv(plan, environment.id));
         if (hasFunctionWorker(plan)) {
             add(`environment-${environment.id}-functions`, 'environment', ['environments', environment.id, 'functions.env'], renderFunctionsEnv(plan, environment.id));
         }
@@ -183,6 +206,48 @@ function addFrontendArtifacts(add, plan) {
     add('frontend-dockerfile', 'frontend', ['frontend', 'Dockerfile'], renderFrontendDockerfile());
 }
 function renderRootReadme(plan) {
+    if (plan.projectType.id === 'standard') {
+        return `# ${plan.projectName}
+
+Generated by Mission Control Liftoff.
+
+## Stack
+
+- Project type: Standard application
+- API: ${plan.apiStack.label}
+- Database tooling: ${plan.apiStack.databaseTooling}
+- API reference: Scalar with OpenAPI
+- Cloud: ${plan.provider.label} (${plan.region.slug})
+- Infrastructure: OpenTofu
+- Database: PostgreSQL
+- Cache and local messaging: Redis
+- Local development: Docker Compose
+${plan.includeFrontend ? '- Frontend: Vue 3 with Tailwind\n' : ''}
+## Local Development
+
+\`\`\`bash
+docker compose up --build
+\`\`\`
+
+The backend API is available on port 8000. Health and readiness endpoints are available at \`/health\` and \`/ready\`; Scalar is exposed at \`/scalar\`.
+
+## Infrastructure
+
+\`\`\`bash
+cd infrastructure/opentofu/azure
+tofu init
+tofu plan -var-file=environments/dev.tfvars
+tofu apply -var-file=environments/dev.tfvars
+\`\`\`
+
+The first apply uses a public bootstrap image. Follow \`infrastructure/opentofu/azure/README.md\` to build the generated backend in ACR and apply its image.
+
+## Spec-Driven Workflow
+
+Selected workflow: ${plan.specWorkflow.label}.
+`;
+    }
+    const pattern = genAiPattern(plan);
     const functionsStackLine = hasFunctionWorker(plan) ? `- Azure Functions worker: Python v2 Service Bus trigger under \`functions/${functionWorkerName(plan)}\`
 ` : '';
     const functionsSection = hasFunctionWorker(plan) ? `
@@ -197,10 +262,10 @@ Generated by Mission Control Liftoff.
 ## Stack
 
 - Backend: FastAPI, PydanticAI, Pydantic settings, Scalar
-- Pattern: ${plan.pattern.label}
+- Pattern: ${pattern.label}
 - Cloud: ${plan.provider.label} (${plan.region.slug})
 - Infrastructure: OpenTofu
-- Database: PostgreSQL with Alembic migrations${plan.pattern.id === 'rag' ? ' and pgvector retrieval' : ''}
+- Database: PostgreSQL with Alembic migrations${pattern.id === 'rag' ? ' and pgvector retrieval' : ''}
 - Cache and local messaging: Redis
 - Observability: Langfuse
 - Local development: Docker Compose
@@ -224,6 +289,8 @@ tofu plan -var-file=environments/dev.tfvars
 tofu apply -var-file=environments/dev.tfvars
 \`\`\`
 
+The first apply uses a public bootstrap image. Follow \`infrastructure/opentofu/azure/README.md\` to build the generated backend in ACR and apply its image.
+
 ## Spec-Driven Workflow
 
 Selected workflow: ${plan.specWorkflow.label}.
@@ -244,9 +311,13 @@ migration/legacy/
 `;
 }
 function renderEnvExample(plan) {
+    if (plan.projectType.id === 'standard') {
+        return renderStandardEnv(plan);
+    }
+    const pattern = genAiPattern(plan);
     return `APP_ENV=dev
 APP_NAME=${plan.safeProjectName}
-GENAI_PATTERN=${plan.pattern.id}
+GENAI_PATTERN=${pattern.id}
 CLOUD_PROVIDER=${plan.provider.id}
 AZURE_REGION=${plan.region.slug}
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@postgres:5432/${plan.safeProjectName.replace(/-/g, '_')}
@@ -289,6 +360,7 @@ dependencies = [
   "scalar-fastapi>=1.0",
   "sqlalchemy[asyncio]>=2.0",
   "asyncpg>=0.29",
+  "psycopg[binary]>=3.2",
   "alembic>=1.13",
   "redis>=5.0",
   "langfuse>=2.39",
@@ -304,6 +376,9 @@ test = ["pytest>=8.2", "httpx>=0.27"]
 requires = ["setuptools>=70"]
 build-backend = "setuptools.build_meta"
 
+[tool.setuptools]
+packages = []
+
 [tool.pytest.ini_options]
 pythonpath = [".."]
 testpaths = ["tests"]
@@ -352,16 +427,17 @@ def ready():
 `;
 }
 function renderPatternRoutes(plan) {
-    const moduleName = pyModule(plan.pattern.id);
+    const pattern = genAiPattern(plan);
+    const moduleName = pyModule(pattern.id);
     const agentName = `${moduleName}_agent`;
-    const prefix = plan.pattern.routePrefix;
-    if (plan.pattern.id === 'streaming') {
+    const prefix = pattern.routePrefix;
+    if (pattern.id === 'streaming') {
         return `from fastapi import APIRouter
 from fastapi.responses import StreamingResponse
 
 from backend.orchestration.agents.${agentName} import stream_response
 
-router = APIRouter(prefix="${prefix}", tags=["${plan.pattern.id}"])
+router = APIRouter(prefix="${prefix}", tags=["${pattern.id}"])
 
 
 @router.get("")
@@ -369,7 +445,7 @@ def stream(prompt: str):
     return StreamingResponse(stream_response(prompt), media_type="text/event-stream")
 `;
     }
-    if (plan.pattern.id === 'rag') {
+    if (pattern.id === 'rag') {
         return `from fastapi import APIRouter
 from pydantic import BaseModel
 
@@ -396,13 +472,13 @@ async def ingest(request: IngestionRequest):
     return await enqueue_ingestion(request.source_uri)
 `;
     }
-    const bodyClass = `${titleCase(plan.pattern.id).replace(/\s/g, '')}Request`;
+    const bodyClass = `${titleCase(pattern.id).replace(/\s/g, '')}Request`;
     return `from fastapi import APIRouter
 from pydantic import BaseModel
 
 from backend.orchestration.agents.${agentName} import run_${moduleName}
 
-router = APIRouter(prefix="${prefix}", tags=["${plan.pattern.id}"])
+router = APIRouter(prefix="${prefix}", tags=["${pattern.id}"])
 
 
 class ${bodyClass}(BaseModel):
@@ -428,6 +504,7 @@ async def get_current_user() -> CurrentUser:
 `;
 }
 function renderSettings(plan) {
+    const pattern = genAiPattern(plan);
     return `from functools import lru_cache
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -435,9 +512,9 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
 
-    app_name: str = "${plan.projectName}"
+    app_name: str = ${sourceString(plan.projectName)}
     app_env: str = "dev"
-    genai_pattern: str = "${plan.pattern.id}"
+    genai_pattern: str = "${pattern.id}"
     cloud_provider: str = "${plan.provider.id}"
     azure_region: str = "${plan.region.slug}"
     database_url: str
@@ -453,6 +530,7 @@ def get_settings() -> Settings:
 `;
 }
 function renderModelConfig(plan) {
+    const pattern = genAiPattern(plan);
     return `from pydantic import BaseModel, Field
 
 
@@ -460,7 +538,7 @@ class ModelConfig(BaseModel):
     provider: str = Field(default="azure-openai")
     deployment_name: str = Field(default="gpt-4.1")
     embedding_deployment_name: str = Field(default="text-embedding-3-large")
-    pattern: str = Field(default="${plan.pattern.id}")
+    pattern: str = Field(default="${pattern.id}")
 `;
 }
 function renderMessagingBoundary() {
@@ -515,25 +593,35 @@ def test_health():
 }
 function renderAlembicIni() {
     return `[alembic]
-script_location = migrations
+script_location = %(here)s/migrations
 sqlalchemy.url = driver://user:pass@localhost/dbname
 `;
 }
 function renderAlembicEnv() {
-    return `from alembic import context
+    return `import os
+
+from alembic import context
+from sqlalchemy import create_engine
 
 
 def run_migrations_online():
-    context.configure(url=context.get_x_argument(as_dictionary=True).get("database_url"))
-    with context.begin_transaction():
-        context.run_migrations()
+    database_url = os.environ.get("DATABASE_URL")
+    if not database_url:
+        raise RuntimeError("DATABASE_URL is required to run migrations")
+    database_url = database_url.replace("postgresql+asyncpg://", "postgresql+psycopg://", 1)
+    database_url = database_url.replace("postgresql://", "postgresql+psycopg://", 1)
+    connectable = create_engine(database_url)
+    with connectable.connect() as connection:
+        context.configure(connection=connection, target_metadata=None)
+        with context.begin_transaction():
+            context.run_migrations()
 
 
 run_migrations_online()
 `;
 }
 function renderInitialMigration(plan) {
-    const vectorExtension = plan.pattern.id === 'rag' ? '    op.execute("CREATE EXTENSION IF NOT EXISTS vector")\n' : '';
+    const vectorExtension = genAiPattern(plan).id === 'rag' ? '    op.execute("CREATE EXTENSION IF NOT EXISTS vector")\n' : '';
     return `from alembic import op
 import sqlalchemy as sa
 
@@ -564,11 +652,12 @@ function renderDatabaseSchema(plan) {
   payload JSONB NOT NULL,
   created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 );
-${plan.pattern.id === 'rag' ? '\nCREATE EXTENSION IF NOT EXISTS vector;\n' : ''}`;
+${genAiPattern(plan).id === 'rag' ? '\nCREATE EXTENSION IF NOT EXISTS vector;\n' : ''}`;
 }
 function renderPatternAgent(plan) {
-    const moduleName = pyModule(plan.pattern.id);
-    if (plan.pattern.id === 'rag') {
+    const pattern = genAiPattern(plan);
+    const moduleName = pyModule(pattern.id);
+    if (pattern.id === 'rag') {
         return `from backend.orchestration.tools.messaging import build_message_publisher
 
 
@@ -586,7 +675,7 @@ async def enqueue_ingestion(source_uri: str) -> dict:
     return {"status": "queued", "source_uri": source_uri}
 `;
     }
-    if (plan.pattern.id === 'streaming') {
+    if (pattern.id === 'streaming') {
         return `async def stream_response(prompt: str):
     yield f"data: Starting response for {prompt}\\n\\n"
     yield "data: Replace this placeholder with PydanticAI streaming orchestration.\\n\\n"
@@ -594,15 +683,16 @@ async def enqueue_ingestion(source_uri: str) -> dict:
     }
     return `async def run_${moduleName}(input_text: str) -> dict:
     return {
-        "result": "Replace this placeholder with ${plan.pattern.label} PydanticAI orchestration.",
+        "result": "Replace this placeholder with ${pattern.label} PydanticAI orchestration.",
         "input": input_text,
     }
 `;
 }
 function renderPromptTemplate(plan) {
-    return `# ${plan.pattern.label} Prompt
+    const pattern = genAiPattern(plan);
+    return `# ${pattern.label} Prompt
 
-You are implementing a ${plan.pattern.label} generated by Mission Control Liftoff.
+You are implementing a ${pattern.label} generated by Mission Control Liftoff.
 
 Use PydanticAI orchestration and return outputs that match the API contract.
 `;
@@ -628,8 +718,9 @@ class PgVectorStore:
 `;
 }
 function renderPatternWorker(plan) {
+    const pattern = genAiPattern(plan);
     return `async def run_worker() -> None:
-    # Consume ${plan.pattern.label} jobs from the configured messaging boundary.
+    # Consume ${pattern.label} jobs from the configured messaging boundary.
     return None
 `;
 }
@@ -643,9 +734,10 @@ Keep reusable GenAI orchestration, model configuration, prompt handling, and dom
 }
 function renderFunctionWorkerReadme(plan) {
     const workerName = functionWorkerName(plan);
+    const pattern = genAiPattern(plan);
     return `# ${workerName}
 
-Azure Functions worker scaffold for ${plan.pattern.label}.
+Azure Functions worker scaffold for ${pattern.label}.
 
 This Function app uses the Python v2 decorator programming model and a Service Bus queue trigger. The trigger adapter should stay thin: decode the message, validate the envelope, and call shared code from \`backend/orchestration\` after that shared code is packaged with the Function app.
 
@@ -672,6 +764,7 @@ function renderFunctionHostJson() {
     }, null, 2);
 }
 function renderFunctionLocalSettings(plan) {
+    const pattern = genAiPattern(plan);
     return JSON.stringify({
         IsEncrypted: false,
         Values: {
@@ -679,7 +772,7 @@ function renderFunctionLocalSettings(plan) {
             FUNCTIONS_WORKER_RUNTIME: 'python',
             SERVICEBUS_QUEUE_NAME: 'events',
             ServiceBusConnection__fullyQualifiedNamespace: '<service-bus-namespace>.servicebus.windows.net',
-            GENAI_PATTERN: plan.pattern.id,
+            GENAI_PATTERN: pattern.id,
             SHARED_ORCHESTRATION_ROOT: '../../backend'
         }
     }, null, 2);
@@ -690,7 +783,8 @@ pytest>=8.2
 `;
 }
 function renderFunctionApp(plan) {
-    const moduleName = pyModule(plan.pattern.id);
+    const pattern = genAiPattern(plan);
+    const moduleName = pyModule(pattern.id);
     return `import json
 import logging
 
@@ -717,7 +811,7 @@ def decode_message_payload(body: str) -> dict:
 )
 def process_${moduleName}_work(message: func.ServiceBusMessage) -> None:
     payload = decode_message_payload(message.get_body().decode("utf-8"))
-    logging.info("Received ${plan.pattern.id} worker message with keys: %s", sorted(payload.keys()))
+    logging.info("Received ${pattern.id} worker message with keys: %s", sorted(payload.keys()))
     # Keep this adapter thin; call backend.orchestration code from packaged shared modules.
 `;
 }
@@ -751,10 +845,11 @@ local.settings.json
 `;
 }
 function renderBackendEnv(plan, environment) {
+    const pattern = genAiPattern(plan);
     const transport = environment === 'dev' ? 'redis-streams' : 'azure-service-bus';
     return `APP_ENV=${environment}
 APP_NAME=${plan.safeProjectName}
-GENAI_PATTERN=${plan.pattern.id}
+GENAI_PATTERN=${pattern.id}
 CLOUD_PROVIDER=${plan.provider.id}
 AZURE_REGION=${plan.region.slug}
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@postgres:5432/${plan.safeProjectName.replace(/-/g, '_')}
@@ -765,9 +860,10 @@ LANGFUSE_HOST=
 `;
 }
 function renderFunctionsEnv(plan, environment) {
+    const pattern = genAiPattern(plan);
     return `APP_ENV=${environment}
 APP_NAME=${plan.safeProjectName}
-GENAI_PATTERN=${plan.pattern.id}
+GENAI_PATTERN=${pattern.id}
 FUNCTIONS_WORKER_RUNTIME=python
 SERVICEBUS_QUEUE_NAME=events
 ServiceBusConnection__fullyQualifiedNamespace=<service-bus-namespace>.servicebus.windows.net
@@ -776,6 +872,7 @@ SHARED_ORCHESTRATION_ROOT=../../backend
 `;
 }
 function renderDockerCompose(plan) {
+    const localEnvironment = plan.environments.find((environment) => environment.id === 'dev') ?? plan.environments[0];
     const frontendService = plan.includeFrontend ? `
   frontend:
     build:
@@ -785,13 +882,17 @@ function renderDockerCompose(plan) {
     depends_on:
       - backend
 ` : '';
+    const postgresImage = plan.projectType.id === 'genai' ? 'pgvector/pgvector:pg16' : 'postgres:16-alpine';
     return `services:
   backend:
     build:
       context: .
       dockerfile: Dockerfile
     env_file:
-      - ./environments/dev/backend.env
+      - ./environments/${localEnvironment.id}/backend.env
+    environment:
+      MESSAGING_TRANSPORT: redis-streams
+      BLOB_ENDPOINT: http://azurite:10000/devstoreaccount1
     ports:
       - "8000:8000"
     depends_on:
@@ -801,7 +902,7 @@ function renderDockerCompose(plan) {
       - mailpit
 ${frontendService}
   postgres:
-    image: pgvector/pgvector:pg16
+    image: ${postgresImage}
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -825,7 +926,7 @@ ${frontendService}
     ports:
       - "8025:8025"
 
-  langfuse:
+${plan.projectType.id === 'genai' ? `  langfuse:
     image: langfuse/langfuse:2
     profiles:
       - observability
@@ -835,6 +936,7 @@ ${frontendService}
       SALT: local-development-placeholder
     ports:
       - "3000:3000"
+` : ''}
 `;
 }
 function renderTofuVersions() {
@@ -856,6 +958,13 @@ function renderTofuProviders() {
 `;
 }
 function renderTofuVariables(plan) {
+    const frontendVariables = plan.includeFrontend ? `
+variable "frontend_image" {
+  type        = string
+  default     = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+  description = "Frontend image. Replace the bootstrap image with the generated frontend image after pushing it to ACR."
+}
+` : '';
     const functionVariables = hasFunctionWorker(plan) ? `
 variable "function_worker_queue_name" {
   type        = string
@@ -885,6 +994,18 @@ variable "resource_suffix" {
   description = "Globally unique suffix for Azure resource names."
 }
 
+variable "backend_image" {
+  type        = string
+  default     = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+  description = "Backend image. Replace the bootstrap image with the generated backend image after pushing it to ACR."
+}
+
+variable "backend_target_port" {
+  type        = number
+  default     = 80
+  description = "Backend ingress port. Set to 8000 when switching from the bootstrap image to the generated backend."
+}
+${frontendVariables}
 variable "postgres_admin_password" {
   type        = string
   sensitive   = true
@@ -900,6 +1021,18 @@ ${functionVariables}
 `;
 }
 function renderTofuMain(plan) {
+    const functionPattern = hasFunctionWorker(plan) ? genAiPattern(plan) : undefined;
+    const projectIdentityEnv = plan.projectType.id === 'genai' ? `
+      env {
+        name  = "GENAI_PATTERN"
+        value = "${genAiPattern(plan).id}"
+      }
+` : `
+      env {
+        name  = "API_STACK"
+        value = "${plan.apiStack.id}"
+      }
+`;
     const frontendContainer = plan.includeFrontend ? `
 resource "azurerm_container_app" "frontend" {
   name                         = "ca-${plan.safeProjectName}-frontend-\${var.environment}"
@@ -907,10 +1040,20 @@ resource "azurerm_container_app" "frontend" {
   resource_group_name          = azurerm_resource_group.main.name
   revision_mode                = "Single"
 
+  identity {
+    type         = "UserAssigned"
+    identity_ids = [azurerm_user_assigned_identity.app.id]
+  }
+
+  registry {
+    server   = azurerm_container_registry.main.login_server
+    identity = azurerm_user_assigned_identity.app.id
+  }
+
   template {
     container {
       name   = "frontend"
-      image  = "\${azurerm_container_registry.main.login_server}/${plan.safeProjectName}-frontend:latest"
+      image  = var.frontend_image
       cpu    = 0.25
       memory = "0.5Gi"
     }
@@ -924,6 +1067,8 @@ resource "azurerm_container_app" "frontend" {
       latest_revision = true
     }
   }
+
+  depends_on = [azurerm_role_assignment.acr_pull]
 }
 ` : '';
     const functionWorker = hasFunctionWorker(plan) ? `
@@ -957,7 +1102,7 @@ resource "azurerm_linux_function_app" "worker" {
   app_settings = {
     APP_ENV                                      = var.environment
     APP_NAME                                     = "${plan.safeProjectName}"
-    GENAI_PATTERN                                = "${plan.pattern.id}"
+    GENAI_PATTERN                                = "${functionPattern?.id}"
     FUNCTIONS_WORKER_RUNTIME                     = "python"
     SERVICEBUS_QUEUE_NAME                        = var.function_worker_queue_name
     ServiceBusConnection__fullyQualifiedNamespace = "\${azurerm_servicebus_namespace.main.name}.servicebus.windows.net"
@@ -1001,6 +1146,12 @@ resource "azurerm_user_assigned_identity" "app" {
   location            = azurerm_resource_group.main.location
 }
 
+resource "azurerm_role_assignment" "acr_pull" {
+  scope                = azurerm_container_registry.main.id
+  role_definition_name = "AcrPull"
+  principal_id         = azurerm_user_assigned_identity.app.principal_id
+}
+
 resource "azurerm_container_app_environment" "main" {
   name                = "cae-\${local.name_prefix}"
   resource_group_name = azurerm_resource_group.main.name
@@ -1018,23 +1169,85 @@ resource "azurerm_container_app" "backend" {
     identity_ids = [azurerm_user_assigned_identity.app.id]
   }
 
+  registry {
+    server   = azurerm_container_registry.main.login_server
+    identity = azurerm_user_assigned_identity.app.id
+  }
+
+  secret {
+    name  = "database-url"
+    value = "postgresql://liftoffadmin:\${urlencode(var.postgres_admin_password)}@\${azurerm_postgresql_flexible_server.main.fqdn}:5432/postgres?sslmode=require"
+  }
+
+  secret {
+    name  = "redis-url"
+    value = "rediss://:\${urlencode(azurerm_redis_cache.main.primary_access_key)}@\${azurerm_redis_cache.main.hostname}:\${azurerm_redis_cache.main.ssl_port}/0"
+  }
+
   template {
     container {
       name   = "backend"
-      image  = "\${azurerm_container_registry.main.login_server}/${plan.safeProjectName}-backend:latest"
+      image  = var.backend_image
       cpu    = 0.5
       memory = "1Gi"
+
+      env {
+        name  = "APP_ENV"
+        value = var.environment
+      }
+
+      env {
+        name  = "APP_NAME"
+        value = "${plan.safeProjectName}"
+      }
+
+      env {
+        name  = "PROJECT_TYPE"
+        value = "${plan.projectType.id}"
+      }
+${projectIdentityEnv}
+      env {
+        name  = "CLOUD_PROVIDER"
+        value = "azure"
+      }
+
+      env {
+        name  = "AZURE_REGION"
+        value = var.location
+      }
+
+      env {
+        name        = "DATABASE_URL"
+        secret_name = "database-url"
+      }
+
+      env {
+        name        = "REDIS_URL"
+        secret_name = "redis-url"
+      }
+
+      env {
+        name  = "MESSAGING_TRANSPORT"
+        value = "azure-service-bus"
+      }
+
+      env {
+        name  = "BLOB_ENDPOINT"
+        value = azurerm_storage_account.main.primary_blob_endpoint
+      }
     }
   }
 
   ingress {
     external_enabled = true
-    target_port      = 8000
+    target_port      = var.backend_target_port
     traffic_weight {
       percentage      = 100
       latest_revision = true
     }
   }
+
+  depends_on = [azurerm_role_assignment.acr_pull]
 }
 ${frontendContainer}
 resource "azurerm_postgresql_flexible_server" "main" {
@@ -1048,6 +1261,14 @@ resource "azurerm_postgresql_flexible_server" "main" {
   sku_name               = "B_Standard_B1ms"
 }
 
+resource "azurerm_postgresql_flexible_server_firewall_rule" "azure_services" {
+  count            = var.enable_private_networking ? 0 : 1
+  name             = "AllowAzureServices"
+  server_id        = azurerm_postgresql_flexible_server.main.id
+  start_ip_address = "0.0.0.0"
+  end_ip_address   = "0.0.0.0"
+}
+
 resource "azurerm_redis_cache" "main" {
   name                = "redis-\${local.name_prefix}-\${var.resource_suffix}"
   location            = azurerm_resource_group.main.location
@@ -1121,6 +1342,10 @@ ${plan.includeFrontend ? `output "frontend_url" {
 ` : ''}${functionOutputs}output "container_registry" {
   value = azurerm_container_registry.main.login_server
 }
+
+output "container_registry_name" {
+  value = azurerm_container_registry.main.name
+}
 `;
 }
 function renderTofuLocalState() {
@@ -1151,30 +1376,98 @@ This project includes an Azure Functions worker under \`functions/${functionWork
 
 Azure is the complete V1 provider for this Liftoff project.
 
+## Bootstrap Infrastructure
+
+The first apply uses a public bootstrap image so Azure Container Apps can start before the new ACR contains application images.
+
 \`\`\`bash
 tofu init
 tofu plan -var-file=environments/${env}.tfvars
 tofu apply -var-file=environments/${env}.tfvars
-tofu output
+\`\`\`
+
+Build the generated backend in ACR, then replace the bootstrap image:
+
+\`\`\`bash
+ACR_NAME="$(tofu output -raw container_registry_name)"
+az acr build --registry "$ACR_NAME" --image ${plan.safeProjectName}-backend:latest ../../..
+${plan.includeFrontend ? `az acr build --registry "$ACR_NAME" --image ${plan.safeProjectName}-frontend:latest ../../../frontend
+` : ''}\`\`\`
+
+Persist the deployed images in \`environments/${env}.tfvars\` so future applies do not restore the bootstrap image:
+
+\`\`\`hcl
+backend_image       = "<login-server>/${plan.safeProjectName}-backend:latest"
+backend_target_port = 8000
+${plan.includeFrontend ? `frontend_image      = "<login-server>/${plan.safeProjectName}-frontend:latest"
+` : ''}\`\`\`
+
+\`\`\`bash
+tofu apply -var-file=environments/${env}.tfvars
 \`\`\`
 
 Local OpenTofu state is generated by default. Use \`backend.remote.example.tf\` as the starting point for team remote state.
+The default PostgreSQL firewall permits Azure-hosted services. Replace it with private networking before production; set \`enable_private_networking=true\` only when the required VNet, delegated subnet, and private DNS resources are added.
 ${functionSection}
 `;
 }
 function renderTofuTfvars(plan, environment) {
-    const functionValues = hasFunctionWorker(plan) ? `function_worker_queue_name = "events"
-functions_python_version = "3.12"
-` : '';
-    return `environment = "${environment}"
-location = "${plan.region.slug}"
-resource_suffix = "${plan.safeProjectName.replace(/-/g, '')}${environment}"
-enable_private_networking = ${environment === 'prod' ? 'true' : 'false'}
-${functionValues}
-`;
+    const values = [
+        ['environment', JSON.stringify(environment)],
+        ['location', JSON.stringify(plan.region.slug)],
+        ['resource_suffix', JSON.stringify(`${plan.safeProjectName.replace(/-/g, '')}${environment}`)],
+        ['backend_image', JSON.stringify('mcr.microsoft.com/azuredocs/containerapps-helloworld:latest')],
+        ['backend_target_port', '80'],
+        ['enable_private_networking', 'false']
+    ];
+    if (plan.includeFrontend) {
+        values.push(['frontend_image', JSON.stringify('mcr.microsoft.com/azuredocs/containerapps-helloworld:latest')]);
+    }
+    if (hasFunctionWorker(plan)) {
+        values.push(['function_worker_queue_name', JSON.stringify('events')], ['functions_python_version', JSON.stringify('3.12')]);
+    }
+    const width = Math.max(...values.map(([key]) => key.length));
+    return values.map(([key, value]) => `${key.padEnd(width)} = ${value}`).join('\n');
 }
 function renderOpenSpecConfig(plan) {
     const frontendRule = plan.includeFrontend ? '\n    - Keep frontend code under frontend.' : '';
+    if (plan.projectType.id === 'standard') {
+        const backendRule = plan.apiStack.id === 'python-fastapi'
+            ? 'Keep backend API code under backend/apis.'
+            : plan.apiStack.id === 'node-fastify'
+                ? 'Keep backend API code under backend/src.'
+                : 'Keep the Go entrypoint under backend/cmd/api and reusable code under backend/internal.';
+        return `schema: spec-driven
+
+context: |
+  Project generated by Mission Control Liftoff.
+  Project type: Standard application.
+  API stack: ${plan.apiStack.label}.
+  Database tooling: ${plan.apiStack.databaseTooling}.
+  API developer portal: Scalar.
+  Infrastructure: OpenTofu.
+  Primary cloud: Azure (${plan.region.slug}).
+  Local development: Docker Compose.
+  Database: PostgreSQL.
+  Cache and local messaging: Redis.
+  Environments: ${plan.environments.map((environment) => environment.id).join(', ')}.
+
+rules:
+  specs:
+    - Requirements must describe observable product behavior.
+    - Cloud behavior must identify environment differences for generated environments.
+  design:
+    - Use ${plan.apiStack.framework} for backend APIs.
+    - Use ${plan.apiStack.databaseTooling} for database access and migrations.
+    - Use OpenTofu for infrastructure changes.${frontendRule}
+    - ${backendRule}
+    - Keep database artifacts under database.
+  tasks:
+    - Include local Docker Compose verification.
+    - Include OpenTofu validation for generated infrastructure.
+`;
+    }
+    const pattern = genAiPattern(plan);
     const functionsContext = hasFunctionWorker(plan) ? `
   Azure Functions worker: functions/${functionWorkerName(plan)}.` : '';
     const functionsRule = hasFunctionWorker(plan) ? `
@@ -1184,7 +1477,7 @@ function renderOpenSpecConfig(plan) {
 
 context: |
   Project generated by Mission Control Liftoff.
-  GenAI pattern: ${plan.pattern.label}
+  GenAI pattern: ${pattern.label}
   Application framework: FastAPI + PydanticAI.
   API developer portal: Scalar.
   Infrastructure: OpenTofu.
@@ -1213,10 +1506,36 @@ ${functionsRule}
 `;
 }
 function renderSeedProposal(plan) {
+    if (plan.projectType.id === 'standard') {
+        return `## Why
+
+Bootstrap the generated ${plan.apiStack.label} standard application baseline created by Mission Control Liftoff.
+
+## What Changes
+
+- Establish the approved backend, infrastructure, local development, and governance baseline.
+- Capture follow-up product requirements through spec-driven changes.
+
+## Capabilities
+
+### New Capabilities
+
+- \`${plan.apiStack.id}-application-baseline\`: Generated standard application baseline for this Liftoff project.
+
+### Modified Capabilities
+
+- None.
+
+## Impact
+
+- Generated ${plan.apiStack.label} backend, OpenTofu infrastructure, Docker Compose local development, and governance files.
+`;
+    }
+    const pattern = genAiPattern(plan);
     const functionsChange = hasFunctionWorker(plan) ? '\n- Establish Azure Functions worker trigger adapters for event-driven processing.' : '';
     return `## Why
 
-Bootstrap the generated ${plan.pattern.label} application baseline created by Mission Control Liftoff.
+Bootstrap the generated ${pattern.label} application baseline created by Mission Control Liftoff.
 
 ## What Changes
 
@@ -1228,7 +1547,7 @@ ${functionsChange}
 
 ### New Capabilities
 
-- \`${plan.pattern.id}-application-baseline\`: Generated application baseline for this Liftoff project.
+- \`${pattern.id}-application-baseline\`: Generated application baseline for this Liftoff project.
 
 ### Modified Capabilities
 
@@ -1240,10 +1559,38 @@ ${functionsChange}
 `;
 }
 function renderSeedDesign(plan) {
+    if (plan.projectType.id === 'standard') {
+        return `## Context
+
+This standard project was generated with Liftoff using ${plan.apiStack.label}, Azure, OpenTofu, and ${plan.specWorkflow.label}.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Keep the generated baseline aligned to the approved Mission Control stack.
+
+**Non-Goals:**
+
+- Define domain-specific product behavior in the bootstrap change.
+
+## Decisions
+
+- Use ${plan.apiStack.framework} for backend APIs.
+- Use ${plan.apiStack.databaseTooling} for PostgreSQL integration.
+- Use OpenTofu for Azure infrastructure.
+- Use Docker Compose for local development.
+
+## Risks / Trade-offs
+
+- The baseline contains placeholders that product-specific changes should replace.
+`;
+    }
+    const pattern = genAiPattern(plan);
     const functionsDecision = hasFunctionWorker(plan) ? '\n- Keep Azure Functions trigger adapters under functions/' + functionWorkerName(plan) + ' and shared GenAI logic under backend/orchestration.' : '';
     return `## Context
 
-This project was generated with Liftoff using ${plan.pattern.label}, Azure, OpenTofu, and ${plan.specWorkflow.label}.
+This project was generated with Liftoff using ${pattern.label}, Azure, OpenTofu, and ${plan.specWorkflow.label}.
 
 ## Goals / Non-Goals
 
@@ -1276,6 +1623,28 @@ function renderSeedTasks() {
 `;
 }
 function renderSpecKitConstitution(plan) {
+    if (plan.projectType.id === 'standard') {
+        const backendLayout = plan.apiStack.id === 'python-fastapi'
+            ? 'backend/apis'
+            : plan.apiStack.id === 'node-fastify' ? 'backend/src' : 'backend/cmd/api and backend/internal';
+        return `# Mission Control Liftoff Constitution
+
+## Principle 1: Approved Application Stack
+Generated backend services MUST use ${plan.apiStack.framework}, ${plan.apiStack.databaseTooling}, and Scalar for API documentation.
+
+## Principle 2: Standard Project Layout
+Backend APIs live under ${backendLayout}. Database artifacts live under database.${plan.includeFrontend ? ' Frontend code lives under frontend.' : ''}
+
+## Principle 3: Infrastructure As Code
+Cloud infrastructure MUST be defined with OpenTofu. Azure is the supported V1 provider.
+
+## Principle 4: Local Development Parity
+Projects MUST include Docker Compose for local development with PostgreSQL, Redis, local blob storage, and local messaging behavior.
+
+## Principle 5: Observability And Operations
+Services MUST use structured logging and environment-specific configuration for ${plan.environments.map((environment) => environment.id).join(', ')}.
+`;
+    }
     const functionsLayout = hasFunctionWorker(plan) ? ` Azure Functions trigger adapters live under functions/${functionWorkerName(plan)} and call shared orchestration from backend/orchestration.` : '';
     return `# Mission Control Liftoff Constitution
 
@@ -1337,7 +1706,7 @@ function renderFrontendPackage(plan) {
     }, null, 2);
 }
 function renderFrontendIndex(plan) {
-    return `<div id="app"></div><script type="module" src="/src/main.ts"></script><title>${plan.projectName}</title>`;
+    return `<div id="app"></div><script type="module" src="/src/main.ts"></script><title>${escapeHtml(plan.projectName)}</title>`;
 }
 function renderFrontendMain() {
     return `import { createApp } from 'vue';
@@ -1348,10 +1717,11 @@ createApp(App).mount('#app');
 `;
 }
 function renderFrontendApp(plan) {
+    const descriptor = plan.projectType.id === 'genai' ? `${genAiPattern(plan).label} starter` : `${plan.apiStack.label} starter`;
     return `<script setup lang="ts">
-const title = '${plan.projectName}';
-const starter = '${plan.frontendStarter}';
-const pattern = '${plan.pattern.label}';
+const title = ${scriptSourceString(plan.projectName)};
+const starter = ${scriptSourceString(plan.frontendStarter)};
+const descriptor = ${scriptSourceString(descriptor)};
 </script>
 
 <template>
@@ -1360,7 +1730,7 @@ const pattern = '${plan.pattern.label}';
       <header>
         <p class="text-sm font-semibold uppercase tracking-wide text-emerald-700">Mission Control Liftoff</p>
         <h1 class="mt-2 text-3xl font-bold">{{ title }}</h1>
-        <p class="mt-2 text-slate-600">{{ pattern }} starter</p>
+        <p class="mt-2 text-slate-600">{{ descriptor }}</p>
       </header>
       <section class="rounded-lg border border-slate-200 bg-white p-6 shadow-sm">
         <h2 class="text-xl font-semibold">{{ starter }}</h2>