@stackwright-pro/launch-stackwright-pro 0.4.0-alpha.15 → 0.4.0-alpha.150

package/LICENSE

@@ -0,0 +1,21 @@
+PROPRIETARY SOFTWARE LICENSE
+
+Copyright (c) 2024-2026 Per Aspera LLC. All Rights Reserved.
+
+This software and associated documentation files (the "Software") are the
+proprietary and confidential property of Per Aspera LLC ("Company").
+
+RESTRICTIONS: You may not use, copy, modify, merge, publish, distribute,
+sublicense, sell, or otherwise exploit this Software or any portion thereof
+without the express prior written consent of the Company.
+
+GOVERNMENT USE: Use, duplication, or disclosure by the U.S. Government is
+subject to restrictions as set forth in FAR 52.227-19 (Commercial Computer
+Software - Restricted Rights) and DFARS 252.227-7013 (Rights in Technical
+Data and Computer Software), as applicable.
+
+THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL THE COMPANY BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE.
+
+For licensing inquiries: legal@peraspera.com

package/README.md

@@ -21,10 +21,14 @@ to automatically wire up Pro features:
 ## Quick Start
 
 ```bash
-pnpx @stackwright-pro/launch-stackwright-pro my-app -y
+# Works — project created in $cwd/my-app
+pnpx @stackwright-pro/launch-stackwright-pro --name my-app -y
 # Dependencies install automatically (~7s)
 cd my-app
-uvx stackwright-pro-raft   # Start the otter raft
+npx @stackwright-pro/raft   # Start the otter raft
+
+# Equivalent explicit form
+pnpx @stackwright-pro/launch-stackwright-pro my-app --name my-app -y
 ```
 
 ### With an OpenAPI Spec
@@ -72,7 +76,7 @@ Options:
   --force              Overwrite existing directory
   --skip-otters        Skip otter raft setup
   -y, --yes            Skip prompts, use defaults
-  --spec <path>        Path to an OpenAPI spec (YAML or JSON)
+  --spec <paths...>    Paths to OpenAPI specs (can be specified multiple times)
   --spec-name <name>   Name for the API integration (default: derived from filename)
   -V, --version        Output the version number
   -h, --help           Display help
@@ -120,24 +124,11 @@ for architecture details, auth deep-dives, and deployment guides.
 
 ## Starting the Otter Raft
 
-The otter raft runs in two modes:
-
-### Interactive Mode (Default)
-
 ```bash
-python -m stackwright_pro.raft.cli_adapter foreman --spawn
+cd my-app
+npx @stackwright-pro/raft
 ```
 
-This spawns code-puppy with the foreman system prompt. The foreman:
-
-- Asks questions about your project via TUI
-- Coordinates specialist otters (brand, theme, api, auth, page)
-- Uses certificate pinning to ensure only approved otters are invoked
-
-### Phases Mode (Debugging)
-
-```bash
-python -m stackwright_pro.raft.cli_adapter foreman --phases
-```
+The raft verifies otter integrity, loads project context from `.stackwright/init-context.json`, and spawns code-puppy in foreman mode. Tell the foreman about your specs in natural language — it coordinates the API, auth, data, and page otters to build your app.
 
-Executes phases sequentially via the Python state machine. Useful for debugging.
+All state lives in `.stackwright/` — you can interrupt and resume at any time.

package/dist/index.js

@@ -31,9 +31,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@stackwright-pro/launch-stackwright-pro",
-      version: "0.4.0-alpha.15",
+      version: "0.4.0-alpha.150",
       description: "Launch a new Stackwright Pro project with OpenAPI integration, auth, and the otter raft",
-      license: "MIT",
+      license: "SEE LICENSE IN LICENSE",
       publishConfig: {
         access: "public"
       },
@@ -69,21 +69,21 @@ var require_package = __commonJS({
         "@stackwright-pro/mcp": "workspace:*",
         "@stackwright-pro/openapi": "workspace:*",
         "@stackwright-pro/otters": "workspace:*",
-        "@stackwright-pro/scaffold-hooks": "latest",
-        "@stackwright/cli": "^0.7.1-alpha.0",
-        "@stackwright/scaffold-core": "^0.1.0",
+        "@stackwright-pro/scaffold-hooks": "workspace:*",
+        "@stackwright/cli": "^0.9.0",
+        "@stackwright/scaffold-core": "^0.3.3",
         chalk: "^5.6.2",
-        commander: "^14.0.3",
-        "fs-extra": "^11.3",
-        "js-yaml": "^4.1.0"
+        commander: "^15.0.0",
+        "fs-extra": "^11.3.5",
+        "js-yaml": "^4.2.0"
       },
       devDependencies: {
         "@types/fs-extra": "^11.0",
         "@types/js-yaml": "^4.0.9",
-        "@types/node": "^24.0.0",
-        typescript: "^5.0",
-        tsup: "^8.5",
-        vitest: "^4.0.18"
+        "@types/node": "catalog:",
+        tsup: "catalog:",
+        typescript: "catalog:",
+        vitest: "catalog:"
       }
     };
   }
@@ -91,89 +91,93 @@ var require_package = __commonJS({
 
 // src/index.ts
 var import_commander = require("commander");
-var import_path = __toESM(require("path"));
+var import_path2 = __toESM(require("path"));
 var import_os = __toESM(require("os"));
-var import_fs_extra = __toESM(require("fs-extra"));
+var import_fs_extra2 = __toESM(require("fs-extra"));
 var import_chalk = __toESM(require("chalk"));
-var import_js_yaml = __toESM(require("js-yaml"));
 var import_child_process = require("child_process");
 var import_cli = require("@stackwright/cli");
 var import_scaffold_core = require("@stackwright/scaffold-core");
 var import_scaffold_hooks = require("@stackwright-pro/scaffold-hooks");
 
+// src/scaffold.ts
+var import_fs_extra = __toESM(require("fs-extra"));
+var import_js_yaml = __toESM(require("js-yaml"));
+var import_path = __toESM(require("path"));
+
 // src/generated/workspace-versions.ts
 var PRO_VERSIONS = {
-  "@stackwright-pro/auth": "0.1.1-alpha.1",
-  "@stackwright-pro/auth-nextjs": "0.1.1-alpha.1",
-  "@stackwright-pro/mcp": "0.2.0-alpha.4",
-  "@stackwright-pro/openapi": "0.2.2-alpha.3",
-  "@stackwright-pro/otters": "1.0.0-alpha.14"
+  "@stackwright-pro/auth": "0.2.0-alpha.24",
+  "@stackwright-pro/auth-nextjs": "0.3.0-alpha.13",
+  "@stackwright-pro/build-scripts-plugins": "0.1.0-alpha.13",
+  "@stackwright-pro/cesium": "0.1.0-alpha.2",
+  "@stackwright-pro/display-components": "0.2.0-alpha.11",
+  "@stackwright-pro/mcp": "0.2.0-alpha.112",
+  "@stackwright-pro/openapi": "0.3.0-alpha.39",
+  "@stackwright-pro/otters": "1.0.0-alpha.76",
+  "@stackwright-pro/pulse": "0.3.0-alpha.36",
+  "@stackwright-pro/workflow": "0.1.0-alpha.27",
+  "@stackwright-pro/workflow-components": "0.1.0-alpha.29"
 };
 var OSS_VERSIONS = {
-  "@stackwright/build-scripts": "^0.4.0",
-  "@stackwright/core": "^0.7.0",
-  "@stackwright/icons": "^0.3.0",
-  "@stackwright/mcp": "^0.2.0",
-  "@stackwright/nextjs": "^0.3.1",
-  "@stackwright/otters": "^0.2.0",
-  "@stackwright/ui-shadcn": "^0.1.0"
+  "@stackwright/build-scripts": "0.10.0-alpha.1",
+  "@stackwright/collections": "^0.1.2",
+  "@stackwright/core": "^0.10.1",
+  "@stackwright/icons": "^0.5.2",
+  "@stackwright/mcp": "^0.5.0",
+  "@stackwright/nextjs": "^0.6.0",
+  "@stackwright/otters": "^0.2.2",
+  "@stackwright/types": "^1.7.0",
+  "@stackwright/ui-shadcn": "^0.1.3"
 };
 
-// src/index.ts
-(0, import_scaffold_hooks.registerProScaffoldHooks)();
-var { version } = require_package();
-async function copyProTemplate(templateName, destPath) {
-  const src = import_path.default.resolve(__dirname, "..", "templates", "pro", templateName);
-  await import_fs_extra.default.copy(src, destPath);
-}
-async function addAuthToStackwrightYml(targetDir) {
-  const ymlPath = import_path.default.join(targetDir, "stackwright.yml");
-  const content = await import_fs_extra.default.readFile(ymlPath, "utf-8");
-  const config = import_js_yaml.default.load(content, { schema: import_js_yaml.default.CORE_SCHEMA });
-  config.auth = {
-    type: "pki",
-    profile: "dod_cac",
-    source: "gateway_headers",
-    roles: [
-      { name: "ADMIN", permissions: ["*"] },
-      { name: "ANALYST", permissions: ["data:read", "data:write"] },
-      { name: "VIEWER", permissions: ["data:read"] }
-    ],
-    protected_routes: [{ path: "/*", roles: ["VIEWER", "ANALYST", "ADMIN"] }],
-    public_routes: ["/", "/getting-started"]
-  };
-  await import_fs_extra.default.writeFile(ymlPath, import_js_yaml.default.dump(config, { lineWidth: 120 }));
-}
+// src/scaffold.ts
 async function addProDepsToPackageJson(targetDir) {
   const pkgPath = import_path.default.join(targetDir, "package.json");
   const content = await import_fs_extra.default.readFile(pkgPath, "utf-8");
   const pkg = JSON.parse(content);
-  const dependencies = pkg.dependencies || {};
-  const devDependencies = pkg.devDependencies || {};
-  const scripts = pkg.scripts || {};
+  const dependencies = typeof pkg.dependencies === "object" && pkg.dependencies !== null ? { ...pkg.dependencies } : {};
+  const devDependencies = typeof pkg.devDependencies === "object" && pkg.devDependencies !== null ? { ...pkg.devDependencies } : {};
+  const scripts = typeof pkg.scripts === "object" && pkg.scripts !== null ? { ...pkg.scripts } : {};
   for (const [pkgName, pinnedVersion] of Object.entries(OSS_VERSIONS)) {
-    if (dependencies[pkgName] === "workspace:*") {
+    if (pkgName in dependencies) {
       dependencies[pkgName] = pinnedVersion;
     }
-    if (devDependencies[pkgName] === "workspace:*") {
+    if (pkgName in devDependencies) {
       devDependencies[pkgName] = pinnedVersion;
     }
   }
   Object.assign(dependencies, {
-    "@stackwright-pro/mcp": PRO_VERSIONS["@stackwright-pro/mcp"],
-    "@stackwright-pro/otters": PRO_VERSIONS["@stackwright-pro/otters"],
-    "@stackwright-pro/openapi": PRO_VERSIONS["@stackwright-pro/openapi"],
     "@stackwright-pro/auth": PRO_VERSIONS["@stackwright-pro/auth"],
     "@stackwright-pro/auth-nextjs": PRO_VERSIONS["@stackwright-pro/auth-nextjs"],
-    zod: "^3.23.0"
+    "@stackwright-pro/build-scripts-plugins": PRO_VERSIONS["@stackwright-pro/build-scripts-plugins"],
+    // SBOM compliance — every Pro raft is a compliance product (swp-ryqz)
+    "@stackwright-pro/sbom-enterprise": "latest",
+    "@stackwright/sbom-generator": "^0.2.2",
+    // Cesium is the Pro default map provider (PR #368). The providers.tsx emitter
+    // unconditionally imports @stackwright-pro/cesium — both it and its peer dep
+    // must be present or next dev blows up on every fresh scaffold.
+    "@stackwright-pro/cesium": PRO_VERSIONS["@stackwright-pro/cesium"],
+    cesium: "^1.122.0",
+    "@stackwright-pro/display-components": PRO_VERSIONS["@stackwright-pro/display-components"],
+    "@stackwright-pro/mcp": PRO_VERSIONS["@stackwright-pro/mcp"],
+    "@stackwright-pro/openapi": PRO_VERSIONS["@stackwright-pro/openapi"],
+    "@stackwright-pro/otters": PRO_VERSIONS["@stackwright-pro/otters"],
+    "@stackwright-pro/pulse": PRO_VERSIONS["@stackwright-pro/pulse"],
+    "@stackwright-pro/workflow": PRO_VERSIONS["@stackwright-pro/workflow"],
+    "@stackwright-pro/workflow-components": PRO_VERSIONS["@stackwright-pro/workflow-components"],
+    "@stackwright/build-scripts": OSS_VERSIONS["@stackwright/build-scripts"],
+    zod: "^4.0.0"
   });
   Object.assign(devDependencies, {
-    "@stoplight/prism-cli": "^5.14.2"
+    "@stoplight/prism-cli": "^5.15.10",
+    concurrently: "^9.0.0"
   });
   Object.assign(scripts, {
-    "dev:admin": "MOCK_USER=admin next dev",
-    "dev:analyst": "MOCK_USER=analyst next dev",
-    "dev:viewer": "MOCK_USER=viewer next dev",
+    mock: "node scripts/start-mocks.js",
+    "dev:admin": 'concurrently "pnpm mock" "NEXT_PUBLIC_MOCK_BACKEND=true MOCK_USER=admin next dev"',
+    "dev:analyst": 'concurrently "pnpm mock" "NEXT_PUBLIC_MOCK_BACKEND=true MOCK_USER=analyst next dev"',
+    "dev:viewer": 'concurrently "pnpm mock" "NEXT_PUBLIC_MOCK_BACKEND=true MOCK_USER=viewer next dev"',
     prebuild: "node scripts/prebuild.js",
     predev: "node scripts/prebuild.js"
   });
@@ -182,6 +186,13 @@ async function addProDepsToPackageJson(targetDir) {
   pkg.scripts = scripts;
   await import_fs_extra.default.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
 }
+async function addAuthToStackwrightYml(targetDir) {
+  const ymlPath = import_path.default.join(targetDir, "stackwright.yml");
+  const content = await import_fs_extra.default.readFile(ymlPath, "utf-8");
+  const config = import_js_yaml.default.load(content, { schema: import_js_yaml.default.CORE_SCHEMA });
+  config.auth = {};
+  await import_fs_extra.default.writeFile(ymlPath, import_js_yaml.default.dump(config, { lineWidth: 120 }));
+}
 async function addIntegrationToStackwrightYml(targetDir, specName, specFilename, mockUrl) {
   const ymlPath = import_path.default.join(targetDir, "stackwright.yml");
   const content = await import_fs_extra.default.readFile(ymlPath, "utf-8");
@@ -195,20 +206,100 @@ async function addIntegrationToStackwrightYml(targetDir, specName, specFilename,
   if (mockUrl) {
     integration.mockUrl = mockUrl;
   }
-  config.integrations = [integration];
+  config.integrations = [
+    ...Array.isArray(config.integrations) ? config.integrations : [],
+    integration
+  ];
   await import_fs_extra.default.writeFile(ymlPath, import_js_yaml.default.dump(config, { lineWidth: 120 }));
 }
-async function handleSpec(targetDir, specPath, specName) {
-  const resolvedSpec = import_path.default.resolve(specPath);
-  if (!import_fs_extra.default.existsSync(resolvedSpec)) {
-    throw new Error(`Spec file not found: ${resolvedSpec}`);
+var SBOM_SIDECAR_CONTENT = `# stackwright.sbom.yml \u2014 supply-chain compliance config
+# Consumed by @stackwright-pro/sbom-enterprise at build time via pnpm prebuild.
+# See packages/sbom-enterprise/README.md for full option reference.
+#
+# API key is env-only \u2014 set SBOM_ENTERPRISE_OSV_API_KEY in .env.local (optional).
+# Without the key, public OSV.dev rate limits apply (still functional).
+features:
+  cveEnrichment: true   # OSV.dev CVE enrichment \u2014 works without API key (rate-limited)
+  signing: false         # Requires Sigstore OIDC token; opt-in via CI env
+  provenance: false      # SLSA L3 requires CI build infra; opt-in
+  publishing: false      # No registry writes by default
+compliance:
+  frameworks:
+    - nist80053
+    - fedramp
+  outputFormats:
+    - oscal
+    - markdown
+    - csv
+  outputDir: .stackwright/compliance
+  impactLevel: Moderate
+`;
+async function emitSbomSidecar(targetDir) {
+  const sidecarPath = import_path.default.join(targetDir, "stackwright.sbom.yml");
+  if (await import_fs_extra.default.pathExists(sidecarPath)) {
+    return;
+  }
+  await import_fs_extra.default.writeFile(sidecarPath, SBOM_SIDECAR_CONTENT, "utf-8");
+}
+async function scaffoldWorkspaceConfig(targetDir) {
+  const workspaceDir = import_path.default.join(targetDir, ".code_puppy");
+  await import_fs_extra.default.ensureDir(workspaceDir);
+  const workspaceStats = await import_fs_extra.default.lstat(workspaceDir);
+  if (workspaceStats.isSymbolicLink()) {
+    throw new Error(".code_puppy/ is a symlink \u2014 refusing to write. Check for tampering.");
+  }
+  const agentsDir = import_path.default.join(workspaceDir, "agents");
+  await import_fs_extra.default.ensureDir(agentsDir);
+  if (await import_fs_extra.default.pathExists(agentsDir)) {
+    const agentsStats = await import_fs_extra.default.lstat(agentsDir);
+    if (agentsStats.isSymbolicLink()) {
+      throw new Error(".code_puppy/agents is a symlink \u2014 refusing to write. Check for tampering.");
+    }
+  }
+  const configPath = import_path.default.join(workspaceDir, "config.json");
+  let existingConfig = {};
+  if (import_fs_extra.default.existsSync(configPath)) {
+    try {
+      existingConfig = JSON.parse(await import_fs_extra.default.readFile(configPath, "utf-8"));
+    } catch {
+    }
+  }
+  if (await import_fs_extra.default.pathExists(configPath)) {
+    const configStats = await import_fs_extra.default.lstat(configPath);
+    if (configStats.isSymbolicLink()) {
+      throw new Error(
+        ".code_puppy/config.json is a symlink \u2014 refusing to write. Check for tampering."
+      );
+    }
+  }
+  await import_fs_extra.default.writeFile(
+    configPath,
+    JSON.stringify({ ...existingConfig, projectOnly: true }, null, 2) + "\n",
+    "utf-8"
+  );
+  const mcpServersPath = import_path.default.join(workspaceDir, "mcp_servers.json");
+  if (await import_fs_extra.default.pathExists(mcpServersPath)) {
+    const mcpStats = await import_fs_extra.default.lstat(mcpServersPath);
+    if (mcpStats.isSymbolicLink()) {
+      throw new Error(
+        ".code_puppy/mcp_servers.json is a symlink \u2014 refusing to write. Check for tampering."
+      );
+    }
+  }
+  if (!import_fs_extra.default.existsSync(mcpServersPath)) {
+    const mcpConfig = {
+      mcp_servers: {
+        "stackwright-pro-mcp": {
+          type: "stdio",
+          command: "pnpm",
+          args: ["exec", "stackwright-pro-mcp"],
+          enabled: true,
+          cwd: "${PROJECT_ROOT}"
+        }
+      }
+    };
+    await import_fs_extra.default.writeFile(mcpServersPath, JSON.stringify(mcpConfig, null, 2) + "\n", "utf-8");
   }
-  const specFilename = import_path.default.basename(resolvedSpec);
-  const derivedName = specName || import_path.default.basename(specFilename, import_path.default.extname(specFilename));
-  const specsDir = import_path.default.join(targetDir, "specs");
-  await import_fs_extra.default.ensureDir(specsDir);
-  await import_fs_extra.default.copy(resolvedSpec, import_path.default.join(specsDir, specFilename));
-  return { specFilename, derivedName };
 }
 function generateReadme(options) {
   const { projectName, hasSpec, specName, specFilename, hasOtters, hasMock } = options;
@@ -231,7 +322,7 @@ export const EquipmentSchema = z.object({
 export type Equipment = z.infer<typeof EquipmentSchema>;
 
 // src/generated/${specName}/client.ts
-export class ${specName.charAt(0).toUpperCase() + specName.slice(1)}Client {
+export class ${(specName ?? "api").charAt(0).toUpperCase() + (specName ?? "api").slice(1)}Client {
   async getEquipment(id: string): Promise<Equipment> {
     // Auto-wired with auth, validation, error handling
   }
@@ -244,10 +335,10 @@ export class ${specName.charAt(0).toUpperCase() + specName.slice(1)}Client {
 3. You import and use it:
 
 \`\`\`typescript
-import { ${specName.charAt(0).toUpperCase() + specName.slice(1)}Client } from '@/generated/${specName}/client';
+import { ${(specName ?? "api").charAt(0).toUpperCase() + (specName ?? "api").slice(1)}Client } from '@/generated/${specName}/client';
 import type { Equipment } from '@/generated/${specName}/types';
 
-const client = new ${specName.charAt(0).toUpperCase() + specName.slice(1)}Client();
+const client = new ${(specName ?? "api").charAt(0).toUpperCase() + (specName ?? "api").slice(1)}Client();
 const gear: Equipment = await client.getEquipment('123');
 \`\`\`
 
@@ -283,12 +374,10 @@ Your project includes **SIX specialized AI agents** in \`node_modules/@stackwrig
 **Start the otter raft:**
 
 \`\`\`bash
-uvx stackwright-pro-raft
+npx @stackwright-pro/raft
 \`\`\`
 
-> **Local dev (before PyPI publish):** \`python -m stackwright_pro.raft.cli_adapter foreman\`
-
-The raft is a Python state machine with a Rich terminal UI \u2014 it asks questions about your brand, auth, and data preferences, then coordinates specialist otters to build your app. All user interaction happens in the terminal; code-puppy is called as a one-shot subprocess for creative tasks only.
+The raft verifies otter integrity, writes project context, and spawns code-puppy in foreman mode. The foreman asks questions about your brand, auth, and data preferences, then coordinates specialist otters to build your app. All state lives in \`.stackwright/\` \u2014 interrupt and resume anytime.
 
 **Example session prompt:**
 
@@ -331,12 +420,16 @@ ${mockSection}## \u{1F4C1} Project Structure
 
 \`\`\`
 .
+\u251C\u2500\u2500 app/
+\u2502   \u251C\u2500\u2500 layout.tsx             # Root layout (StackwrightLayout + Providers)
+\u2502   \u251C\u2500\u2500 page.tsx               # Home page (renders root content)
+\u2502   \u251C\u2500\u2500 [...slug]/
+\u2502   \u2502   \u2514\u2500\u2500 page.tsx           # Dynamic pages from YAML content
+\u2502   \u2514\u2500\u2500 _components/
+\u2502       \u251C\u2500\u2500 providers.tsx      # Pro: AuthProvider + component registration
+\u2502       \u2514\u2500\u2500 page-client.tsx    # Client-side page renderer
 \u251C\u2500\u2500 pages/
-\u2502   \u251C\u2500\u2500 _app.tsx               # Pro version with AuthProvider + shadcn
-\u2502   \u251C\u2500\u2500 index.tsx              # Home page (auto-generated by Stackwright)
-\u2502   \u251C\u2500\u2500 about/
-\u2502   \u2502   \u2514\u2500\u2500 content.yml        # Page content in YAML
-\u2502   \u2514\u2500\u2500 ...
+\u2502   \u2514\u2500\u2500 content.yml            # Root page content in YAML
 \u251C\u2500\u2500 lib/
 \u2502   \u2514\u2500\u2500 mock-auth.ts           # Dev-only auth mocking (no backend needed)
 \u251C\u2500\u2500 scripts/
@@ -356,7 +449,7 @@ ${mockSection}## \u{1F4C1} Project Structure
 \`\`\`
 
 **Key Files:**
-- \`pages/_app.tsx\` - Wraps your app with \`AuthProvider\` for RBAC
+- \`app/_components/providers.tsx\` - Wraps your app with \`AuthProvider\` for RBAC
 - \`stackwright.yml\` - Single source of truth for theme, auth roles, and API wiring
 - \`lib/mock-auth.ts\` - Mocks CAC/PIV headers locally so you can test auth flows
 - \`scripts/prebuild.js\` - Runs before dev/build to generate types from your OpenAPI spec
@@ -466,8 +559,28 @@ ${aiAgentsSection}## \u{1F4DA} Learn More
 **Questions?** File an issue or ping us in the discussions. We're here to help you ship faster.
 `;
 }
+
+// src/index.ts
+(0, import_scaffold_hooks.registerProScaffoldHooks)();
+var { version } = require_package();
+async function copyProTemplate(templateName, destPath) {
+  const src = import_path2.default.resolve(__dirname, "..", "templates", "pro", templateName);
+  await import_fs_extra2.default.copy(src, destPath);
+}
+async function handleSpec(targetDir, specPath, specName) {
+  const resolvedSpec = import_path2.default.resolve(specPath);
+  if (!import_fs_extra2.default.existsSync(resolvedSpec)) {
+    throw new Error(`Spec file not found: ${resolvedSpec}`);
+  }
+  const specFilename = import_path2.default.basename(resolvedSpec);
+  const derivedName = specName || import_path2.default.basename(specFilename, import_path2.default.extname(specFilename));
+  const specsDir = import_path2.default.join(targetDir, "specs");
+  await import_fs_extra2.default.ensureDir(specsDir);
+  await import_fs_extra2.default.copy(resolvedSpec, import_path2.default.join(specsDir, specFilename));
+  return { specFilename, derivedName };
+}
 async function launch(targetDir, options) {
-  const dirName = import_path.default.basename(targetDir);
+  const dirName = import_path2.default.basename(targetDir);
   console.log(import_chalk.default.cyan.bold("\n\u{1F6A2} Launching Stackwright Pro...\n"));
   const scaffoldOpts = {
     name: options.name || dirName,
@@ -483,11 +596,11 @@ async function launch(targetDir, options) {
   await addProDepsToPackageJson(targetDir);
   console.log(import_chalk.default.green("\u{1F9A6} Pro packages added to package.json"));
   const verifyPkg = JSON.parse(
-    await import_fs_extra.default.readFile(import_path.default.join(targetDir, "package.json"), "utf-8")
+    await import_fs_extra2.default.readFile(import_path2.default.join(targetDir, "package.json"), "utf-8")
   );
-  const proDepCount = Object.keys(verifyPkg.dependencies || {}).filter(
-    (k) => k.startsWith("@stackwright-pro")
-  ).length;
+  const proDepCount = Object.keys(
+    typeof verifyPkg.dependencies === "object" && verifyPkg.dependencies !== null ? verifyPkg.dependencies : {}
+  ).filter((k) => k.startsWith("@stackwright-pro")).length;
   console.log(import_chalk.default.dim(`  \u2192 package.json verified: ${proDepCount} @stackwright-pro/* deps ready`));
   console.log(import_chalk.default.cyan("\n\u{1F4E6} Installing dependencies (this takes a moment)..."));
   if (!options.skipInstall) {
@@ -522,33 +635,53 @@ async function launch(targetDir, options) {
   const dependencyMode = "standalone";
   await (0, import_scaffold_core.runScaffoldHooks)("postInstall", {
     targetDir,
-    projectName: options.name || import_path.default.basename(targetDir),
-    siteTitle: options.title || options.name || import_path.default.basename(targetDir),
+    projectName: options.name || import_path2.default.basename(targetDir),
+    siteTitle: options.title || options.name || import_path2.default.basename(targetDir),
     themeId: options.theme || "corporate",
     packageJson: {},
     dependencyMode
   });
-  await copyProTemplate("_app.tsx", import_path.default.join(targetDir, "pages", "_app.tsx"));
-  await copyProTemplate("content.yml", import_path.default.join(targetDir, "pages", "content.yml"));
-  await copyProTemplate("next.config.js", import_path.default.join(targetDir, "next.config.js"));
-  await import_fs_extra.default.ensureDir(import_path.default.join(targetDir, "lib"));
-  await copyProTemplate("mock-auth.ts", import_path.default.join(targetDir, "lib", "mock-auth.ts"));
-  await copyProTemplate("yaml.d.ts", import_path.default.join(targetDir, "yaml.d.ts"));
-  await import_fs_extra.default.ensureDir(import_path.default.join(targetDir, "scripts"));
-  await copyProTemplate("prebuild.js", import_path.default.join(targetDir, "scripts", "prebuild.js"));
-  console.log(import_chalk.default.green("\u{1F510} Auth integration added (RBAC with 3 roles)"));
+  await copyProTemplate(
+    "pro-providers.tsx",
+    import_path2.default.join(targetDir, "app", "_components", "providers.tsx")
+  );
+  await copyProTemplate("content.yml", import_path2.default.join(targetDir, "pages", "content.yml"));
+  await copyProTemplate("next.config.js", import_path2.default.join(targetDir, "next.config.js"));
+  await import_fs_extra2.default.ensureDir(import_path2.default.join(targetDir, "lib"));
+  await copyProTemplate("mock-auth.ts", import_path2.default.join(targetDir, "lib", "mock-auth.ts"));
+  await copyProTemplate("yaml.d.ts", import_path2.default.join(targetDir, "yaml.d.ts"));
+  await import_fs_extra2.default.ensureDir(import_path2.default.join(targetDir, "scripts"));
+  await copyProTemplate("prebuild.js", import_path2.default.join(targetDir, "scripts", "prebuild.js"));
+  await copyProTemplate(
+    "scripts/pro-content-plugin.js",
+    import_path2.default.join(targetDir, "scripts", "pro-content-plugin.js")
+  );
+  await copyProTemplate(
+    "scripts/start-mocks.js",
+    import_path2.default.join(targetDir, "scripts", "start-mocks.js")
+  );
+  await import_fs_extra2.default.ensureDir(import_path2.default.join(targetDir, "app", "[...slug]"));
+  await copyProTemplate(
+    "app/slug-page/page.tsx",
+    import_path2.default.join(targetDir, "app", "[...slug]", "page.tsx")
+  );
+  console.log(import_chalk.default.green(" Auth integration added (App Router providers + RBAC)"));
   await addAuthToStackwrightYml(targetDir);
+  await emitSbomSidecar(targetDir);
+  console.log(import_chalk.default.green("\u{1F512} stackwright.sbom.yml emitted (NIST 800-53 + FedRAMP defaults)"));
   let specInfo = null;
   const MOCK_URL = "http://localhost:4010";
-  if (options.spec) {
-    specInfo = await handleSpec(targetDir, options.spec, options.specName);
-    await addIntegrationToStackwrightYml(
-      targetDir,
-      specInfo.derivedName,
-      specInfo.specFilename,
-      options.mock ? MOCK_URL : void 0
-    );
-    console.log(import_chalk.default.green("\u{1F4E1} OpenAPI integration wired up"));
+  if (options.spec && options.spec.length > 0) {
+    for (const specPath of options.spec) {
+      specInfo = await handleSpec(targetDir, specPath, options.specName);
+      await addIntegrationToStackwrightYml(
+        targetDir,
+        specInfo.derivedName,
+        specInfo.specFilename,
+        options.mock ? MOCK_URL : void 0
+      );
+    }
+    console.log(import_chalk.default.green(`\u{1F4E1} ${options.spec.length} OpenAPI integration(s) wired up`));
     if (options.mock) {
       console.log(import_chalk.default.green("\u{1F3AD} Prism mock server configured"));
     }
@@ -558,9 +691,9 @@ async function launch(targetDir, options) {
         "\u26A0\uFE0F  No spec provided with --mock. Using sample Petstore spec for demo. Replace with your API spec."
       )
     );
-    const specsDir = import_path.default.join(targetDir, "specs");
-    await import_fs_extra.default.ensureDir(specsDir);
-    await copyProTemplate("petstore.yaml", import_path.default.join(specsDir, "petstore.yaml"));
+    const specsDir = import_path2.default.join(targetDir, "specs");
+    await import_fs_extra2.default.ensureDir(specsDir);
+    await copyProTemplate("petstore.yaml", import_path2.default.join(specsDir, "petstore.yaml"));
     specInfo = { specFilename: "petstore.yaml", derivedName: "petstore" };
     await addIntegrationToStackwrightYml(
       targetDir,
@@ -579,13 +712,33 @@ async function launch(targetDir, options) {
     hasOtters: !options.skipOtters,
     hasMock: !!options.mock
   });
-  await import_fs_extra.default.writeFile(import_path.default.join(targetDir, "README.md"), readmeContent);
+  await import_fs_extra2.default.writeFile(import_path2.default.join(targetDir, "README.md"), readmeContent);
   console.log(import_chalk.default.green("\u{1F4C4} README.md created"));
-  const relDir = import_path.default.relative(process.cwd(), targetDir) || ".";
+  const initContext = {
+    projectRoot: targetDir,
+    projectName: options.name || dirName,
+    generatedBy: "launch-stackwright-pro",
+    version: "1.0"
+  };
+  if (specInfo) {
+    initContext.specPath = `specs/${specInfo.specFilename}`;
+    initContext.specName = specInfo.derivedName;
+  }
+  initContext.theme = options.theme || "corporate";
+  const stackwrightDir = import_path2.default.join(targetDir, ".stackwright");
+  await import_fs_extra2.default.ensureDir(stackwrightDir);
+  await import_fs_extra2.default.writeFile(
+    import_path2.default.join(stackwrightDir, "init-context.json"),
+    JSON.stringify(initContext, null, 2) + "\n",
+    "utf-8"
+  );
+  await scaffoldWorkspaceConfig(targetDir);
+  console.log(import_chalk.default.green("\u{1F43E} .code_puppy/ workspace scaffolded (projectOnly: true)"));
+  const relDir = import_path2.default.relative(process.cwd(), targetDir) || ".";
   console.log(import_chalk.default.cyan.bold("\n\u{1F389} All set! Here's what to do next:\n"));
   console.log(import_chalk.default.white(`  1. cd ${relDir}`));
-  console.log(import_chalk.default.white("  2. uvx stackwright-pro-raft"));
-  console.log(import_chalk.default.dim("     (local dev: python -m stackwright_pro.raft.cli_adapter foreman)"));
+  console.log(import_chalk.default.white("  2. npx @stackwright-pro/raft"));
+  console.log(import_chalk.default.dim("     (use --verbose for troubleshooting)"));
   if (specInfo) {
     console.log(import_chalk.default.cyan(`
 \u{1F4E1} Your API spec was copied to specs/${specInfo.specFilename}`));
@@ -603,8 +756,8 @@ async function launch(targetDir, options) {
 async function main() {
   const program = new import_commander.Command();
   program.name("launch-stackwright-pro").description("\u{1F6A2} Launch a new Stackwright Pro project with auth, OpenAPI, and the otter raft").version(version).argument("[directory]", "Project directory", ".").option("--name <name>", "Project name (used in package.json)").option("--title <title>", "Site title shown in the app bar and browser tab").option("--theme <themeId>", "Theme ID (e.g., corporate, creative, minimal)").option("--force", "Launch even if the target directory is not empty").option("--skip-otters", "Skip copying otter raft configs").option("-y, --yes", "Skip all prompts, use defaults").option("--mock", "Configure Prism mock server for API development (runs on port 4010)").option(
-    "--spec <path>",
-    "Path to an OpenAPI spec (YAML or JSON) \u2014 copies into project and wires up integration"
+    "--spec <paths...>",
+    "Paths to OpenAPI specs (YAML or JSON) \u2014 copies into project and wires up integrations (can be specified multiple times)"
   ).option(
     "--spec-name <name>",
     "Name for the API integration (default: derived from spec filename)"
@@ -613,8 +766,8 @@ async function main() {
     "Skip automatic pnpm install (useful in CI or when using a different package manager)"
   ).action(async (directory, options) => {
     const homeDir = import_os.default.homedir();
-    const targetDir = import_path.default.resolve(directory);
-    if (!targetDir.startsWith(homeDir + import_path.default.sep) && targetDir !== homeDir) {
+    const targetDir = directory !== "." ? import_path2.default.resolve(process.cwd(), directory) : options.name ? import_path2.default.resolve(process.cwd(), options.name) : process.cwd();
+    if (!targetDir.startsWith(homeDir + import_path2.default.sep) && targetDir !== homeDir) {
       console.warn(import_chalk.default.yellow(`\u26A0\uFE0F  Scaffolding outside your home directory: ${targetDir}`));
     }
     await launch(targetDir, options);