@opengroundplan/core 0.1.1

package/catalog/sources/backend-api.yaml

@@ -0,0 +1,720 @@
+# Groundplan template source catalog — category: backend-api
+#
+# Research date: 2026-07-18
+# License classes were verified from primary sources: the GitHub REST API
+# (/repos/{owner}/{repo} -> license.spdx_id, stargazers_count, pushed_at, archived).
+# Every repo whose API license came back NOASSERTION or null was re-checked by fetching
+# the repository's own LICENSE file from raw.githubusercontent.com. Two candidates failed
+# that gate and were dropped (see droppedCandidates at the bottom) — notably
+# golang-standards/project-layout, whose 56k stars hide a LICENSE.md reading, in full,
+# "Hacker license!".
+#
+# All star counts and pushed_at values in this file are exact reads from the GitHub API,
+# not estimates. Every referenced file path was confirmed to return HTTP 200 from
+# raw.githubusercontent.com — no invented filenames.
+#
+# ADVERSARIAL RE-VERIFICATION 2026-07-18 (second pass, independent):
+#   - All 15 entries re-fetched. Zero license mismatches: every recorded spdx matches
+#     license.spdx_id today. No entry is archived or disabled. No entry is stale.
+#   - The two NOASSERTION/null cases (realworld included; project-layout dropped) were
+#     re-confirmed by fetching the LICENSE bytes, not by trusting the earlier note.
+#   - All 48 referenced file paths re-probed: all HTTP 200.
+#   - Two repos had MOVED and were recorded under dead canonical names (both 301-redirect,
+#     so neither 404s and neither showed up in a naive check): gothinkster/realworld ->
+#     realworld-apps/realworld, and dotnet/aspire -> microsoft/aspire. Both corrected; the
+#     old name is kept as `formerName`. Re-verify these two on every refresh.
+#   - evrone/go-clean-template was labelled `api-go-gin`; its go.mod actually depends on
+#     gofiber/fiber v2 with no Gin at all. Corrected to `api-go-fiber`. Router/ORM layer ids
+#     must be read out of the manifest, never inferred from the repo's reputation.
+#   - Star drift since the first pass was <0.01% on every entry (max 2 stars); refreshed.
+#
+# Staleness rule: last commit older than 18 months (i.e. before 2025-01-18) => maintained: false.
+# Every entry below is inside that window; the stale candidates are in droppedCandidates.
+#
+# licenseClass gate:
+#   vendorable      MIT, Apache-2.0, BSD-2/3, ISC, Unlicense, CC0, 0BSD — copy + adapt,
+#                   carrying the NOTICE/attribution where Apache-2.0 or BSD requires it.
+#   reference-only  MPL-2.0, LGPL, EPL, or split/unclear licensing — read for ideas, do not copy files.
+#   excluded        GPL/AGPL/SSPL/BUSL/source-available/unlicensed — never copy.
+
+category: backend-api
+
+sources:
+  # ---------------------------------------------------------------- simple
+  - name: honojs/hono
+    url: https://github.com/honojs/hono
+    stack: typescript
+    complexity: simple
+    stars: 31392
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    whatToBorrow: >-
+      The smallest credible modern TS API surface — a Hono app is a single `src/index.ts`
+      exporting `app`, which makes it the ideal "simple" rung and the one template that
+      deploys unchanged to Node, Bun, Deno, Cloudflare Workers, and Lambda. Borrow three
+      specific things. First, the typed middleware contract: `c.set()` / `c.get()` with a
+      `Variables` generic on `new Hono<{ Variables: ... }>()` gives request-scoped DI with
+      zero container, which is how a scaffolded auth layer should inject the session. Second,
+      `@hono/zod-validator` — `zValidator('json', schema)` yields both runtime 400s and a
+      typed `c.req.valid('json')`, so validation and types come from one Zod schema; this is
+      the pattern to standardize a `validation-zod` layer on. Third, the RPC mode: exporting
+      `type AppType = typeof routes` and consuming it with `hc<AppType>()` gives an end-to-end
+      typed client with no codegen step and no OpenAPI round-trip — a strong default when
+      Groundplan scaffolds a frontend and backend into one repo.
+    whatToAvoid: >-
+      This is the framework repository, not a starter — do not vendor `src/`. Take the
+      dependency from npm and generate application code instead; the real scaffold source is
+      `create-hono`, whose templates live in the separate honojs/starter repo. The
+      multi-runtime promise leaks: `hono/node-server` is a separate adapter package, and
+      Workers-targeted code assumes the Workers `fetch`/`env` binding model, so a template
+      genuinely has to pick a runtime rather than pretend to be portable. RPC-mode type
+      inference degrades badly on large route trees (slow tsserver, occasional `any`
+      collapse), so do not make `hc` the default above roughly 50 routes.
+    proposedLayerIds:
+      - api-hono
+      - validation-zod
+      - api-openapi-swagger
+      - deploy-cloudflare-workers
+      - infra-docker-compose
+
+  - name: expressjs/express
+    url: https://github.com/expressjs/express
+    stack: nodejs
+    complexity: simple
+    stars: 69223
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-12"
+    whatToBorrow: >-
+      Value here is entirely in `examples/`, which is a set of small, self-contained, MIT
+      apps that read like reference templates. Three are worth adapting directly and were
+      confirmed present: `examples/mvc/index.js` (a controller-autoloading layout that is a
+      good "simple" file structure without a framework's opinions), `examples/auth/index.js`
+      (session login with hashed passwords and a `restrict` middleware — the minimum viable
+      auth flow to strip down), and `examples/error-pages/index.js` (content-negotiated error
+      handling, which is the piece most hand-rolled Express templates get wrong). Express 5
+      is the version to target: async route handlers now propagate rejections to the error
+      middleware automatically, so the `express-async-errors` shim and every try/catch wrapper
+      that older boilerplates carry can be deleted.
+    whatToAvoid: >-
+      Express is unopinionated to a fault — it ships no project structure, no validation, no
+      DI, no config layer, so an Express template is mostly code Groundplan must author itself.
+      Do not seed a 2026 template from the ecosystem's popular boilerplates: the well-known
+      ones (hagopj13, danielfsousa, w3tecch) are all 2+ years stale and still on Express 4.
+      The `examples/` code is deliberately terse teaching code — CommonJS, no types, no
+      graceful shutdown, no structured logging — so treat it as a pattern reference, not a
+      drop-in. Also note Express 5 quietly changed the path-matching syntax (no bare `*`,
+      optional-param syntax differs), which silently breaks routes copied from Express 4 blogs.
+    proposedLayerIds:
+      - api-express
+      - auth-jwt
+      - obs-health-checks
+      - test-jest-e2e
+      - infra-docker-compose
+
+  - name: fastapi/fastapi
+    url: https://github.com/fastapi/fastapi
+    stack: python
+    complexity: simple
+    stars: 100631
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    whatToBorrow: >-
+      `docs_src/` is an underused asset: several hundred tiny, individually runnable, MIT
+      example apps, each isolating exactly one concern, which is close to a ready-made layer
+      library. Confirmed useful anchors are `docs_src/security/tutorial005_an_py310.py`
+      (full OAuth2 password flow with JWT, scopes, and hashed passwords — the canonical
+      `auth-oauth2-password` layer) and `docs_src/sql_databases/tutorial001_py310.py` (the
+      current SQLModel-based persistence pattern that replaced the older raw-SQLAlchemy one).
+      The `_an_` filename suffix marks the `Annotated` variants — always take those, since
+      `Annotated[X, Depends(y)]` is the only dependency style that stays correct under
+      modern type checkers. The dependency-injection system itself is the pattern worth
+      standardizing on: a `get_current_user` dependency composed into an `APIRouter(
+      dependencies=[...])` is how auth should attach to a whole route group.
+    whatToAvoid: >-
+      Framework repo, not a starter — nothing here is a project skeleton, and each example is
+      a single file with no config, migrations, tests, or containerization. Examples are
+      versioned by Python floor (`_py39`, `_py310`) so a naive copy can pull in outdated
+      syntax; pick the highest suffix present. Everything is a toy: in-memory fake user dicts,
+      hardcoded `SECRET_KEY` constants, and no refresh-token handling in the OAuth2 example —
+      that hardcoded secret must be migrated to a settings layer before it ever lands in a
+      generated repo. For an actual project skeleton use the full-stack template entry below.
+    proposedLayerIds:
+      - api-fastapi
+      - auth-oauth2-password
+      - validation-pydantic
+      - db-postgres-sqlalchemy
+      - api-openapi-swagger
+
+  # ---------------------------------------------------------------- standard
+  - name: nestjs/nest
+    url: https://github.com/nestjs/nest
+    stack: typescript
+    complexity: standard
+    stars: 76141
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    whatToBorrow: >-
+      The `sample/` directory is the real prize — 30+ numbered, independently runnable,
+      MIT-licensed mini-applications that map almost one-to-one onto scaffolder layers.
+      Confirmed present and directly adaptable: `sample/01-cats-app` (the canonical
+      module/controller/service/DTO layout that every Nest template should start from),
+      `sample/05-sql-typeorm` (TypeORM wiring with `forRootAsync` + `forFeature`, the correct
+      async-config pattern), and `sample/22-graphql-prisma`. Because each sample is isolated,
+      you can diff two of them to extract exactly the delta a layer needs to apply. The
+      architectural pattern worth carrying everywhere is the dynamic module: `register()` /
+      `registerAsync()` returning a `DynamicModule` with `useFactory` + `inject` is how a
+      generated module should take configuration, and it composes cleanly with layering.
+    whatToAvoid: >-
+      Framework repo — vendor nothing from `packages/`. Nest's DI is reflection-based, so it
+      is welded to `experimentalDecorators` + `emitDecoratorMetadata` and therefore to tsc:
+      esbuild and SWC need explicit plugin support, and this is the single biggest source of
+      "works in dev, breaks in build" in Nest templates. Budget for it or pin the toolchain.
+      Samples are minimal by design — no auth, no migrations, no observability, no Docker —
+      and several still use `@nestjs/typeorm`, whose upstream (TypeORM) has had thin
+      maintenance; prefer Prisma or Drizzle for a new default persistence layer. The
+      framework's weight (modules, providers, decorators, RxJS in the interceptor pipeline)
+      is real overhead for a small service — do not make Nest the "simple" rung.
+    proposedLayerIds:
+      - api-nestjs
+      - db-postgres-typeorm
+      - db-postgres-prisma
+      - api-graphql
+      - validation-class-validator
+      - test-jest-e2e
+
+  - name: litestar-org/litestar
+    url: https://github.com/litestar-org/litestar
+    stack: python
+    complexity: standard
+    stars: 8342
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-16"
+    whatToBorrow: >-
+      The strongest argument for a second Python rung, because it supplies natively the
+      pieces every FastAPI template hand-rolls. Borrow the layered-parameters model:
+      dependencies, guards, and middleware declared at app / router / controller / handler
+      level and merged down the tree, which is a much better fit for a layering scaffolder
+      than FastAPI's flat per-route `Depends`. Borrow the DTO system (`SQLAlchemyDTO` with
+      include/exclude config) — it solves the model-vs-schema duplication that forces FastAPI
+      projects to maintain parallel Pydantic classes. Also take the class-based
+      `Controller` pattern for grouping routes, and the built-in SQLAlchemy plugin, which
+      wires session lifecycle and transaction-per-request without the `get_db` generator
+      boilerplate. `litestar/app.py` is the composition root to read.
+    whatToAvoid: >-
+      Ecosystem risk is the honest downside: roughly an order of magnitude fewer stars than
+      FastAPI, far fewer third-party integrations, and a much smaller pool of answers, so a
+      generated project inherits a thinner support surface. The project renamed from Starlite
+      in 2023, so a lot of surviving documentation and blog code uses the old import paths
+      and will not run. The API has been willing to break across majors — pin the major
+      version in any generated `pyproject.toml`. Do not offer it as the default Python
+      backend; offer it as the opinionated alternative for teams that specifically want
+      batteries-included DTOs and hierarchical DI.
+    proposedLayerIds:
+      - api-litestar
+      - db-postgres-sqlalchemy
+      - db-migrations-alembic
+      - validation-pydantic
+      - api-openapi-swagger
+      - test-pytest
+
+  - name: amitshekhariitbhu/go-backend-clean-architecture
+    url: https://github.com/amitshekhariitbhu/go-backend-clean-architecture
+    stack: go
+    complexity: standard
+    stars: 6120
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    licenseNotes: >-
+      Apache-2.0 — vendorable, but the license and NOTICE requirements attach: generated
+      repos that copy files must retain the license text and state that changes were made.
+    maintained: true
+    lastCommit: "2026-02-05"
+    whatToBorrow: >-
+      The clearest small Go clean-architecture layout of the current crop, and every layer is
+      one obvious directory, which is exactly what a scaffolder wants to add or omit. Verified
+      structure: `domain/` holds both entities and the interfaces (`domain/user.go` declares
+      the entity plus its `UserRepository` and matching usecase interface — interface-with-
+      consumer, the correct Go idiom), `repository/user_repository.go` is the Mongo-backed
+      implementation, `usecase/login_usecase.go` is business logic with a timeout injected per
+      usecase, `api/controller/login_controller.go` is the Gin HTTP edge, and `cmd/main.go` is
+      the composition root. Borrow the explicit constructor wiring in `cmd/main.go` — no DI
+      container, no code generation, just `NewXUsecase(NewXRepository(db), timeout)`, which
+      stays readable in generated output and is trivially diffable when a layer is toggled.
+      `.env.example` is present and the config is read through an env struct rather than
+      scattered literals.
+    whatToAvoid: >-
+      MongoDB is hardwired as the datastore even though the repository interfaces are clean,
+      so a Postgres variant means rewriting every file under `repository/`. It is coupled to
+      Gin specifically at the controller layer. Auth is JWT access+refresh with no rotation,
+      revocation, or blocklist — acceptable as a starting point, not as a finished
+      `auth-jwt` layer. Test coverage is thin and leans on hand-written mocks. At ~5 months
+      since last push it is the least actively maintained entry here, though comfortably
+      inside the staleness window. Apache-2.0 attribution is a real obligation, not a
+      formality — wire it into the generator's NOTICE handling.
+    proposedLayerIds:
+      - api-go-gin
+      - arch-clean-architecture
+      - db-mongo-go
+      - auth-jwt
+      - infra-docker-compose
+      - test-testify
+
+  - name: realworld-apps/realworld
+    url: https://github.com/realworld-apps/realworld
+    formerName: gothinkster/realworld
+    stack: polyglot
+    complexity: standard
+    stars: 83859
+    spdx: MIT
+    licenseClass: vendorable
+    licenseNotes: >-
+      GitHub API reports NOASSERTION because the LICENSE file carries two copyright lines
+      (Thinkster 2021, c4ffein 2026). Re-verified 2026-07-18 by fetching
+      raw.githubusercontent.com/realworld-apps/realworld/main/LICENSE: verbatim, unmodified
+      MIT body. Classified vendorable on the strength of the primary source, not the
+      API's classifier. Note the repo moved from gothinkster/realworld to realworld-apps/
+      realworld; the old URL 301-redirects but should not be recorded as canonical.
+    maintained: true
+    lastCommit: "2026-06-15"
+    whatToBorrow: >-
+      Not a starter — a fixed specification plus an index of implementations of the same
+      medium-clone API across roughly every backend stack. Its value to a scaffolder is
+      calibration and testing, and that value is high. Borrow the API contract itself: the
+      frozen OpenAPI spec at `specs/api/openapi.yml` plus the conformance suite beside it.
+      Note the tooling changed — the suite is now Hurl (`specs/api/hurl/`, driven by
+      `specs/api/run-api-tests-hurl.sh`) with a generated Bruno mirror (`specs/api/bruno/`,
+      `run-api-tests-bruno.sh`); the Postman/Newman collection that older write-ups reference
+      no longer exists. `specs/e2e/` adds Playwright specs covering auth, articles, comments,
+      social, null-field handling, and XSS. That gives Groundplan a stack-agnostic acceptance test
+      — generate a NestJS app and a Go app from the same layer set, run the same suite
+      against both, and any behavioural divergence is a template bug. Also use the per-stack
+      implementations as a cross-stack diff: they solve identical problems, so comparing the
+      NestJS and FastAPI implementations isolates what is genuinely stack-specific in a layer.
+    whatToAvoid: >-
+      The individual implementations are third-party repos under their own separate licenses —
+      the MIT here covers the spec and this repo, and grants you nothing over any linked
+      implementation. Check each one independently before copying a line. Quality varies from
+      excellent to abandoned demo, and many linked repos are dead or years stale. The domain
+      model is deliberately simple and misses everything enterprise templates must handle
+      (multi-tenancy, RBAC, background jobs, file upload, money), so passing the RealWorld
+      suite proves correctness of the basics only. Treat it as a conformance harness, never as
+      a source of application code.
+    proposedLayerIds:
+      - test-contract-conformance
+      - api-openapi-swagger
+      - auth-jwt
+
+  # ---------------------------------------------------------------- professional
+  - name: fastapi/full-stack-fastapi-template
+    url: https://github.com/fastapi/full-stack-fastapi-template
+    stack: python
+    complexity: professional
+    stars: 44304
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-14"
+    whatToBorrow: >-
+      The official, actively maintained Python reference and the highest-signal source in this
+      category. Verified layout: `backend/app/main.py`, `backend/app/api/deps.py`,
+      `backend/app/core/config.py`, `backend/app/core/security.py`, `backend/Dockerfile`, and
+      `compose.yml` at the root. Take `core/config.py` wholesale — it is `pydantic-settings`
+      with typed fields, computed properties, and validators that hard-fail at boot on a
+      default secret, which is the single best config-layer pattern in this whole list and
+      directly satisfies a no-hardcoded-values rule. Take `api/deps.py` for the
+      `SessionDep` / `CurrentUser` annotated-dependency aliases that collapse repetitive
+      signatures. It uses SQLModel so one class serves as both table and schema, with
+      separate `*Create` / `*Public` models at the boundary. Also borrow the generated
+      TypeScript client pipeline (OpenAPI -> `@hey-api/openapi-ts`) for typed frontends, and
+      the Traefik-based compose stack with per-service labels.
+    whatToAvoid: >-
+      It is full-stack — React, Traefik, Playwright, and Sentry come along with it — so
+      extracting a backend-only template means deliberately deleting the `frontend/` tree and
+      the proxy layer rather than getting a clean API skeleton. SQLModel is Ramírez's own
+      project with a small maintainer pool relative to its blast radius, and its type
+      inference degrades on complex relationships; a project needing sophisticated queries
+      will end up on raw SQLAlchemy anyway. The compose stack targets Docker Swarm-style
+      deployment with Traefik labels, which is a poor fit if the target is Kubernetes or a
+      PaaS. Auth is JWT-only with no refresh tokens, no OAuth providers, and no MFA.
+    proposedLayerIds:
+      - api-fastapi
+      - db-postgres-sqlalchemy
+      - db-migrations-alembic
+      - auth-jwt
+      - validation-pydantic
+      - mail-smtp-templates
+      - infra-docker-compose
+      - deploy-github-actions
+      - test-pytest
+
+  - name: ardalis/CleanArchitecture
+    url: https://github.com/ardalis/CleanArchitecture
+    stack: dotnet
+    complexity: professional
+    stars: 18343
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-16"
+    whatToBorrow: >-
+      The most disciplined .NET clean-architecture reference and the better of the two for
+      DDD-shaped domains. Verified anchors: `src/Clean.Architecture.Core/ContributorAggregate/
+      Contributor.cs`, `src/Clean.Architecture.Web/Program.cs`, plus root `Directory.Packages.props`
+      and `global.json`. Borrow the aggregate folder convention — an aggregate root, its value
+      objects, its domain events, and its specifications all live in one folder named for the
+      aggregate, which gives a scaffolder a single unit to stamp out per entity. Borrow the
+      specification pattern (Ardalis.Specification) that keeps query logic in the Core project
+      instead of leaking EF `Include` chains into handlers, and the domain-event dispatch that
+      fires on `SaveChangesAsync`. The `Result<T>` type (Ardalis.Result) mapped to HTTP status
+      codes at the endpoint is the cleanest no-exceptions-for-control-flow pattern in .NET.
+      `Directory.Packages.props` is Central Package Management — adopt that for every generated
+      multi-project .NET solution, and `global.json` for SDK pinning.
+    whatToAvoid: >-
+      Heavily invested in the author's own Ardalis.* package family (Specification, Result,
+      GuardClauses, SmartEnum, ApiEndpoints). They are good MIT libraries but they are a
+      single-maintainer dependency cluster and they shape the code enough that removing them
+      later is a rewrite, so make that an explicit template choice rather than a silent
+      default. The four-project split plus Specification plus MediatR is genuine ceremony for
+      a small CRUD service — do not offer this as the .NET default, offer it when the domain
+      warrants it. MediatR's move to a commercial license for v13+ is the live license trap in
+      the .NET ecosystem: pin to the last MIT version or plan a swap to a free dispatcher.
+    proposedLayerIds:
+      - api-dotnet-minimal
+      - arch-clean-architecture
+      - arch-ddd-aggregates
+      - db-postgres-efcore
+      - db-migrations-efcore
+      - cqrs-mediatr
+      - validation-fluentvalidation
+      - test-xunit-integration
+
+  - name: jasontaylordev/CleanArchitecture
+    url: https://github.com/jasontaylordev/CleanArchitecture
+    stack: dotnet
+    complexity: professional
+    stars: 20343
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    whatToBorrow: >-
+      The pragmatic counterpart to Ardalis and the better default for most .NET teams, largely
+      because it ships as a real `dotnet new ca-sln` template — so it is already proof that
+      this architecture can be parameterized, which is precisely Groundplan's problem. Verified
+      anchors: `src/Web/Program.cs`, `src/Application/DependencyInjection.cs`,
+      `src/Domain/Entities/TodoItem.cs`, `Directory.Packages.props`. Borrow the
+      `DependencyInjection.cs`-per-project convention: each layer exposes one
+      `AddApplication()` / `AddInfrastructure()` extension method, which gives a scaffolder a
+      single, unambiguous insertion point per layer — the most directly reusable idea in this
+      file. Borrow the MediatR pipeline-behaviour stack (validation, authorization, logging,
+      performance, unhandled-exception) as ordered cross-cutting layers. Its template also
+      demonstrates conditional scaffolding via `.template.config` — study that before
+      designing Groundplan's own option system.
+    whatToAvoid: >-
+      Same MediatR license exposure as Ardalis, and here it is deeper: the pipeline behaviours
+      are load-bearing, so an unlicensed MediatR is not a swap but a redesign. Verify the
+      pinned version. The default template still assumes SQL Server and includes ASP.NET Core
+      Identity plus a SPA (Angular or React) unless explicitly opted out, so a Postgres,
+      API-only variant needs deliberate stripping. CQRS with a command, handler, and validator
+      per operation is a lot of files for simple CRUD — the classic failure mode is generating
+      three files to read one row.
+    proposedLayerIds:
+      - api-dotnet-webapi
+      - arch-clean-architecture
+      - cqrs-mediatr
+      - db-postgres-efcore
+      - db-migrations-efcore
+      - auth-aspnet-identity
+      - validation-fluentvalidation
+      - test-xunit-integration
+
+  - name: evrone/go-clean-template
+    url: https://github.com/evrone/go-clean-template
+    stack: go
+    complexity: professional
+    stars: 7633
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    whatToBorrow: >-
+      The most production-shaped Go template in this list and the most actively maintained
+      (pushed today). Verified anchors: `cmd/app/main.go`, `internal/app/app.go`,
+      `pkg/httpserver/server.go`, `Makefile`, `docker-compose.yml`. The organizing idea worth
+      stealing is the `internal/` vs `pkg/` split: `internal/` is application code the Go
+      compiler physically prevents other modules from importing, `pkg/` holds genuinely
+      reusable infrastructure adapters. That maps exactly onto a scaffolder's distinction
+      between generated app code and vendored layer code. Borrow `pkg/httpserver/server.go`
+      for its graceful-shutdown contract — a `Notify()` channel plus `Shutdown()` with a
+      timeout, wired to signal handling in `app.go` — which is the piece almost every hand-
+      rolled Go template omits and the one that actually matters in production. `internal/app/
+      app.go` is a clean composition root, and the `Makefile` carries the full dev loop
+      (migrate, mock, lint, integration-test) worth reproducing per stack.
+    whatToAvoid: >-
+      The repo has been restructured more than once, so paths in older blog posts and forks no
+      longer resolve — verify against the current tree rather than trusting secondary sources.
+      The HTTP transport is now Fiber v2, not Gin; most secondary write-ups (and an earlier
+      draft of this catalog) still say Gin, which would mis-target the router layer.
+      It ships multiple transports (HTTP, gRPC, RabbitMQ RPC) in one template, which is
+      instructive but is more than most services need, so treat the transports as separately
+      selectable layers rather than a baseline. Config comes from YAML plus env with a
+      `cleanenv` dependency, so the config layer needs normalizing against whatever Groundplan
+      standardizes on. Documentation is thinner than the code quality deserves, and the
+      maintainer is an agency rather than a foundation — bus-factor risk, though the commit
+      cadence is currently strong.
+    proposedLayerIds:
+      # Verified against go.mod on 2026-07-18: gofiber/fiber v2, jackc/pgx v5,
+      # golang-migrate v4, rabbitmq/amqp091-go, grpc, rs/zerolog, otel.
+      - api-go-fiber
+      - arch-clean-architecture
+      - db-postgres-pgx
+      - db-migrations-golang-migrate
+      - msg-rabbitmq
+      - api-grpc
+      - obs-structured-logging
+      - obs-opentelemetry
+      - infra-docker-compose
+      - test-integration-go
+
+  - name: goravel/goravel
+    url: https://github.com/goravel/goravel
+    stack: go
+    complexity: professional
+    stars: 4789
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-05"
+    whatToBorrow: >-
+      A genuinely different point in the design space: a Laravel-shaped, batteries-included Go
+      application skeleton rather than a bare layout. Confirmed to be the skeleton and not the
+      framework core — `go.mod` declares `module goravel` on Go 1.25, with `main.go`,
+      `config/app.go`, and `routes/web.go` present (the framework itself lives in
+      goravel/framework). Borrow the config convention: one file per concern under `config/`,
+      each reading env with a typed default in exactly one place, which is a clean, enforceable
+      answer to configuration sprawl. Borrow the service-provider registration model in
+      `config/app.go` — providers are an ordered list, so a scaffolder adds a layer by
+      appending one line, which is about as low-friction as layer composition gets. It also
+      ships ORM, migrations, queues, scheduling, mail, cache, and auth as first-party pieces,
+      so a "professional Go" template needs far less assembly than the clean-architecture route.
+    whatToAvoid: >-
+      The core trade-off is that this is a framework lock-in in a community that culturally
+      prefers the standard library plus small packages — Goravel code is not idiomatic Go and
+      Go developers will notice. Smallest star count and thinnest contributor base of the Go
+      entries, and much of the documentation is translated from Chinese with uneven coverage.
+      Being a Laravel port means it inherits Laravel's facade/magic style, which fights Go's
+      explicitness and makes static analysis less useful. Version churn has been brisk; pin
+      the framework version in generated projects. Offer it as an explicit opinionated choice,
+      never as the default Go template.
+    proposedLayerIds:
+      - api-go-goravel
+      - db-postgres-gorm
+      - db-migrations-goravel
+      - auth-jwt
+      - jobs-background-queue
+      - cache-redis
+      - mail-smtp-templates
+      - infra-docker-compose
+
+  - name: brocoders/nestjs-boilerplate
+    url: https://github.com/brocoders/nestjs-boilerplate
+    stack: typescript
+    complexity: professional
+    stars: 4348
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    whatToBorrow: >-
+      The most complete NestJS starter still under active maintenance, and unusually
+      well-suited to a layering tool because it was built to be database-agnostic. Verified
+      anchors: `src/main.ts`, `src/auth/auth.service.ts`, `src/database/data-source.ts`,
+      `docker-compose.yaml`, and — the important pair — `env-example-relational` and
+      `env-example-document`. That split is the pattern to copy: a persistence abstraction
+      with parallel relational (TypeORM/Postgres) and document (Mongoose/MongoDB)
+      implementations behind one repository interface, plus separate env templates per
+      choice, which is exactly a `db-*` layer boundary drawn correctly. Borrow the full auth
+      module — email/password with confirmation, password reset, refresh-token sessions, and
+      social sign-in for Google, Facebook, and Apple — since that is the single biggest chunk
+      of work a generated backend can skip. Also borrow the i18n, file-upload (local and S3
+      drivers behind one interface), and mail-templating modules as clean, self-contained
+      layer candidates.
+    whatToAvoid: >-
+      The dual-database abstraction is the reason to use it and also its main cost: every
+      entity exists twice (schema plus mapper per persistence mode), so a team that will only
+      ever use Postgres carries real duplication and indirection for nothing — strip the
+      unused half at generation time rather than shipping both. It is a community project on
+      a modest contributor base relative to how much surface it covers. TypeORM underneath
+      brings its own thin-maintenance and migration-generation quirks. Volume is the other
+      hazard: the amount of pre-built functionality means a generated project starts with a
+      lot of code nobody on the team has read, which is exactly the failure mode a scaffolder
+      should be avoiding — prune aggressively by layer selection.
+    proposedLayerIds:
+      - api-nestjs
+      - db-postgres-typeorm
+      - db-mongo-mongoose
+      - auth-jwt-refresh
+      - auth-social-google
+      - auth-social-apple
+      - mail-smtp-templates
+      - files-s3-upload
+      - i18n-backend
+      - test-jest-e2e
+
+  # ---------------------------------------------------------------- enterprise
+  - name: dotnet/eShop
+    url: https://github.com/dotnet/eShop
+    stack: dotnet
+    complexity: enterprise
+    stars: 10687
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-06-08"
+    whatToBorrow: >-
+      Microsoft's own current reference application and the best available model of what a
+      serious multi-service .NET system looks like in 2026. Verified anchors:
+      `src/eShop.AppHost/Program.cs`, `src/Catalog.API/Program.cs`, root
+      `Directory.Packages.props`, and `eShop.Web.slnf`. The highest-value single file is
+      `src/eShop.AppHost/Program.cs` — the Aspire composition root where Postgres, Redis,
+      RabbitMQ, and every service are declared in C# with explicit `WithReference` edges. That
+      one file replaces a hand-written docker-compose plus the connection-string wiring in
+      every service, and it is the strongest argument for making Aspire the default .NET
+      infra layer. Borrow the per-service vertical-slice structure (each `*.API` owns its
+      data, no shared database), the integration-event bus over RabbitMQ with an outbox for
+      reliable publishing, and `.slnf` solution filters as a way to make a large generated
+      solution navigable. Central Package Management via `Directory.Packages.props` is again
+      the right multi-project default.
+    whatToAvoid: >-
+      Massively over-scoped for almost any real starting point — microservices, an event bus,
+      a Blazor storefront, a .NET MAUI mobile client, an AI/vector-search feature, and Duende
+      IdentityServer. Do not vendor it wholesale; mine individual services as patterns. The
+      real license trap sits inside it: Duende IdentityServer is commercially licensed above a
+      revenue threshold despite living in an MIT repo, so any auth layer derived from eShop
+      must swap it for Keycloak, OpenIddict, or a managed IdP — the repo's MIT license does
+      not extend to that dependency. It also tracks the newest .NET and Aspire previews
+      closely, so it can require a preview SDK. Distributed-system complexity (eventual
+      consistency, sagas, per-service migrations) is a genuine cost — never emit this shape
+      as a default.
+    proposedLayerIds:
+      - arch-microservices
+      - infra-aspire-apphost
+      - msg-rabbitmq
+      - msg-integration-events-outbox
+      - db-postgres-efcore
+      - cache-redis
+      - auth-openiddict
+      - auth-keycloak
+      - obs-opentelemetry
+      - api-grpc
+      - resilience-polly
+
+  - name: microsoft/aspire
+    url: https://github.com/microsoft/aspire
+    formerName: dotnet/aspire
+    stack: dotnet
+    complexity: enterprise
+    stars: 6172
+    spdx: MIT
+    licenseClass: vendorable
+    licenseNotes: >-
+      Repo moved from dotnet/aspire to microsoft/aspire; the old URL 301-redirects but is not
+      canonical. License re-verified 2026-07-18 at the new location: license.spdx_id = MIT,
+      not archived.
+    maintained: true
+    lastCommit: "2026-07-18"
+    whatToBorrow: >-
+      Not an API template — the orchestration and local-dev layer that a .NET (and
+      increasingly polyglot) template should sit on, pushed today and evolving fast. Borrow
+      the AppHost model: infrastructure declared as typed C# (`builder.AddPostgres("db")
+      .AddDatabase("catalogdb")`), with service references injected as connection strings via
+      `WithReference`, so no generated project needs a connection string in a config file at
+      all — service discovery resolves it. That is a materially better answer to configuration
+      than compose plus `.env`, and it is worth designing the .NET infra layer around. Borrow
+      the ServiceDefaults project pattern — one shared `AddServiceDefaults()` extension that
+      wires OpenTelemetry traces/metrics/logs, health checks at `/health` and `/alive`, and
+      HTTP resilience handlers in a single call, applied uniformly to every service. Its
+      integration packages (Postgres, Redis, RabbitMQ, Kafka, Azure services) each pair a
+      hosting-side and client-side component, which is a clean model for how a Groundplan layer
+      should be structured.
+    whatToAvoid: >-
+      Fast-moving with a history of breaking API changes between versions — pin exactly, and
+      expect maintenance on generated projects. The gravitational pull toward Azure is real:
+      `azd`-based deployment is the smoothest path and other targets are less well trodden, so
+      treat Azure affinity as a soft lock-in to call out. AppHost is a local-development and
+      composition tool, not a production runtime — Kubernetes or Container Apps still need
+      real manifests, and templates should not imply otherwise. It only makes sense for .NET-
+      centric shops; polyglot support exists but is thinner. Adds a whole extra project and
+      concept layer to the solution, which is unjustifiable for a single service with no
+      dependencies.
+    proposedLayerIds:
+      - infra-aspire-apphost
+      - obs-opentelemetry
+      - obs-health-checks
+      - resilience-polly
+      - cache-redis
+      - db-postgres-efcore
+      - deploy-azure-container-apps
+
+# ---------------------------------------------------------------------------
+# Dropped candidates — recorded so they are not re-proposed in a later pass.
+# Every one was checked against the GitHub API on 2026-07-18.
+# ---------------------------------------------------------------------------
+droppedCandidates:
+  - >-
+    golang-standards/project-layout — 56314 stars, pushed 2026-04-28, NOT archived, but the
+    GitHub API returns license.spdx_id = NOASSERTION. Fetched LICENSE.md directly from
+    raw.githubusercontent.com: its complete text is "Hacker license!". That is not a license,
+    grants no rights, and makes the repo legally all-rights-reserved. EXCLUDED — do not copy a
+    line from it despite its popularity. Its directory conventions (cmd/, internal/, pkg/) are
+    widely independently documented and can be applied as common knowledge, but not sourced here.
+  - >-
+    zhanymkanov/fastapi-best-practices — 17728 stars, pushed 2026-05-03, license.spdx_id = null.
+    Probed LICENSE, LICENSE.md, LICENSE.txt, and COPYING on both master and main: all 404.
+    No license means all rights reserved. EXCLUDED. It is prose guidance rather than code, but
+    the rule is the rule.
+  - >-
+    Netflix/dispatch — 6496 stars, Apache-2.0, but archived: true (last push 2025-09-03).
+    Archived upstream means no security patches; dropped.
+  - >-
+    dotnet-architecture/eShopOnWeb — 10689 stars, MIT, but archived: true and last pushed
+    2025-01-13, which is outside the 18-month window. Superseded by dotnet/eShop, which is
+    included above. Dropped as stale + archived.
+  - >-
+    bxcodec/go-clean-arch — 10139 stars, MIT, last pushed 2024-04-24 (~27 months). Historically
+    the most influential Go clean-architecture article/repo, but stale by the rule and its
+    layout is superseded by evrone/go-clean-template. Dropped.
+  - >-
+    Sairyss/domain-driven-hexagon — 14787 stars, MIT, last pushed 2024-06-11 (~25 months).
+    Excellent DDD/hexagonal write-up but stale, and its NestJS code targets older versions.
+  - >-
+    hagopj13/node-express-boilerplate — 7654 stars, MIT, last pushed 2024-07-08 (~24 months).
+    Still Express 4. Stale.
+  - >-
+    danielfsousa/express-rest-boilerplate — 2364 stars, MIT, last pushed 2024-06-30 (~25 months). Stale.
+  - >-
+    w3tecch/express-typescript-boilerplate — 3420 stars, MIT, last pushed 2023-05-07 (~38 months).
+    Badly stale. Dropped.
+  - >-
+    amantinband/clean-architecture — 1932 stars, MIT, last pushed 2024-07-14 (~24 months).
+    Good teaching repo, stale, and covered by the two included .NET clean-architecture entries.
+  - >-
+    nestjs/awesome-nestjs — 13070 stars, license.spdx_id = null, and it is a link list rather
+    than code. Excluded on license and irrelevant as source material.
+  - >-
+    gin-gonic/gin (88926), labstack/echo (32533), go-chi/chi (22552), Kludex/uvicorn (formerly
+    encode/uvicorn; the old path redirects) —
+    all MIT/BSD-3-Clause, all actively maintained, all verified. Dropped not on quality but on
+    kind: they are routers and servers, i.e. dependencies a template declares, not starter
+    repositories with adaptable structure. They are already reached transitively through the
+    Go and Python entries above.