@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/types/triage.d.ts

@@ -0,0 +1,135 @@
+export type TriageStatus = "triage" | "promoted" | "dismissed" | "snoozed";
+export type TriageSeverity = "critical" | "high" | "medium" | "low" | "info";
+export type TriageKind = "bug" | "feature" | "improvement" | "compliance" | "maintenance";
+export type TriagePriority = "P0" | "P1" | "P2" | "P3";
+/** Resolved item shape (one entry per triage id, last-status-wins by file order). */
+export interface TriageItem {
+    id: string;
+    ts: string;
+    originalTs: string;
+    source: string;
+    severity: TriageSeverity;
+    kind: TriageKind;
+    title: string;
+    detail: string;
+    evidencePath: string | null;
+    runId: string | null;
+    commit: string | null;
+    dedupKey: string | null;
+    /**
+     * Producer-generated ready-to-paste block (slash command + context +
+     * URL) introduced by shipwright iterate-2026-05-20-triage-launch-surface
+     * (PR #41). Frozen at first append by the producer. Legacy producers
+     * may omit the field entirely; iterate-2026-05-20-triage-launch-surface-webui
+     * surfaces it in the Triage Detail modal as a copy-into-Claude block.
+     * Optional in the type so legacy on-disk events still load.
+     */
+    launchPayload?: string | null;
+    status: TriageStatus;
+    suggestedPriority: TriagePriority;
+    suggestedDomain: string;
+    statusBy: string | null;
+    statusReason: string | null;
+    promotedTaskId: string | null;
+    /**
+     * FR-01.33 server-side enrichment (NOT a triage.py wire field): when a
+     * campaign in this project has `expandsTriage == this item's id`, the GET
+     * /api/triage route annotates the item with that campaign's slug + lifecycle
+     * status. Drives the Triage "Start Campaign" action. Optional — null/absent
+     * for non-campaign items. Derived per request; never persisted to
+     * triage.jsonl, so `readAllItems()` (the parity-tested resolver) never sets it.
+     */
+    campaignSlug?: string | null;
+    campaignStatus?: "draft" | "active" | "complete" | null;
+    /**
+     * Mirror of the monorepo `triage_cli.py list --json` wire field
+     * (shipwright PR #177, trg-e2a0ebb3), set per request by the GET
+     * /api/triage route via `enrichPendingDelivery` — NOT a `read_all_items`
+     * wire field, so `readAllItems()` (the parity-tested resolver) never
+     * sets it. `true` iff the item's `append` lives ONLY in the gitignored
+     * per-tree `triage.outbox.jsonl` buffer (TRACKED-PREFERRED: present in
+     * both files → false): the item ships with the next iterate's sweep.
+     * Optional in the type for store-level absence; the list route always
+     * emits a concrete boolean.
+     */
+    pendingDelivery?: boolean;
+    /**
+     * Monorepo P2.03 (iterate-2026-08-01-triage-defer-lifecycle,
+     * CONTRACT_VERSION 2) parked-entry lifecycle — mirrors upstream
+     * `read_all_items`'s `revisitAt`/`revisitDue` overlay, which every item
+     * gains (not just `snoozed` ones): the day a parked entry returns
+     * (`YYYY-MM-DD`), or `null` when the item isn't parked, or is parked with
+     * no date set (the WebUI's own Snooze action leaves this unset unless the
+     * operator fills in the optional Revisit-date field — "parked-not-due").
+     */
+    revisitAt: string | null;
+    /**
+     * Computed, never stored: has this entry's park come due? Always `false`
+     * for a non-`snoozed` item. A `snoozed` item whose date has arrived is
+     * ALREADY resolved back to `status: "triage"` by the time this is set
+     * (see `core/triage-defer.ts`), so within an actually-parked
+     * (`status === "snoozed"`) view this reads `false` by construction — it
+     * exists so a consumer never has to parse the date itself to answer
+     * "did this just return?".
+     */
+    revisitDue: boolean;
+    /**
+     * Amend-event overlay (iterate-2026-08-08-triage-amend-reader, mirrors
+     * `lib/triage_amend.AMENDED_BY_FIELD`/`AMENDED_AT_FIELD`): who/when this
+     * item was last corrected in place via an `amend` event. `null` until a
+     * valid amend lands. Unlike `status`/`statusBy`, `ts` itself is NOT
+     * touched by an amend — it still means "time of the last status decision".
+     */
+    amendedBy: string | null;
+    amendedAt: string | null;
+}
+/** On-disk status event line shape. */
+export interface TriageStatusEvent {
+    event: "status";
+    id: string;
+    ts: string;
+    newStatus: TriageStatus;
+    by: string;
+    reason: string | null;
+    promotedTaskId: string | null;
+    /**
+     * Park semantics (monorepo P2.03) — present ONLY on a `newStatus:
+     * "snoozed"` event; absent (never `null`) on every other status, mirroring
+     * the monorepo wire format where the field simply doesn't exist there.
+     */
+    revisitAt?: string;
+}
+/**
+ * On-disk amend event line shape (iterate-2026-08-08-triage-amend-reader,
+ * mirrors `lib/triage_amend.build_amend_event`). Every amendable field is
+ * OPTIONAL — a real event always carries at least one (writer-enforced;
+ * `has_amend_content` on the Python side), but the wire type itself does not
+ * encode that constraint.
+ */
+export interface TriageAmendEvent {
+    event: "amend";
+    id: string;
+    ts: string;
+    by: string;
+    title?: string;
+    detail?: string;
+    severity?: TriageSeverity;
+    kind?: TriageKind;
+}
+/** Wire shape for promote/dismiss/snooze response bodies. */
+export interface TriageActionResponse {
+    triageId: string;
+    newStatus: TriageStatus;
+}
+export interface TriagePromoteResponse extends TriageActionResponse {
+    task: {
+        taskId: string;
+        promotedFromTriageId?: string;
+    };
+    newStatus: "promoted";
+    /** True when the route reused an existing back-ref task (idempotent retry). */
+    recovered: boolean;
+    /** The CLI's resolved post-transition item; never reconstituted by the route. */
+    item: TriageItem | Record<string, unknown>;
+}
+//# sourceMappingURL=triage.d.ts.map

package/server/dist/types/triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../src/types/triage.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAC3E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,UAAU,GAClB,KAAK,GACL,SAAS,GACT,aAAa,GACb,YAAY,GACZ,aAAa,CAAC;AAClB,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,cAAc,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IAExB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,IAAI,CAAC;IACxD;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;;OAQG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,YAAY,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,SAAS,EAAE,UAAU,CAAC;IACtB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C"}

package/server/dist/types/triage.js

@@ -0,0 +1,15 @@
+/*
+ * triage.ts — TS shapes verbatim from `shared/scripts/triage.py` wire format.
+ *
+ * Canonical origin: `shared/scripts/triage.py` STATUSES / SEVERITIES /
+ * KINDS enums + the resolved-view `read_all_items()` return shape.
+ *
+ * Drift protection: `core/triage-store.test.ts` parity test reads the
+ * Python-generated fixture (`server/src/test/fixtures/triage-resolved.json`)
+ * and asserts `readAllItems()` produces deep-equal output. When triage.py
+ * adds/removes a field, regenerate via
+ * `uv run server/scripts/regen-triage-fixtures.py` and update the types
+ * here in lockstep.
+ */
+export {};
+//# sourceMappingURL=triage.js.map

package/server/dist/types/triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../src/types/triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/server/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "shipwright-command-center-server",
+  "version": "0.23.0",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch --env-file-if-exists=../.env.local src/index.ts",
+    "dev:fresh": "node ../scripts/dev-restart.js",
+    "build": "tsc && node scripts/copy-assets.mjs",
+    "start": "node dist/index.js",
+    "test": "vitest",
+    "lint": "oxlint .",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=20.12.0"
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.14.0",
+    "@hono/node-ws": "^1.3.1",
+    "@lydell/node-pty": "^1.1.0",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/headless": "6.0.0",
+    "cron-parser": "^5.5.0",
+    "hono": "^4.12.34",
+    "ignore": "^5.3.2",
+    "p-queue": "^9.2.0",
+    "proper-lockfile": "^4.1.0",
+    "shell-quote": "^1.8.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/proper-lockfile": "^4.1.4",
+    "@types/shell-quote": "^1.7.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "oxlint": "^1.66.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.8"
+  },
+  "overrides": {
+    "ws": "^8.21.0"
+  }
+}

package/server/profiles/PROFILE_SCHEMA_VERSION

@@ -0,0 +1 @@
+1

package/server/profiles/README.md

@@ -0,0 +1,27 @@
+# Bundled stack profiles
+
+This directory holds a **snapshot** of `shared/profiles/*.json` from the
+Shipwright monorepo. The WebUI ships this snapshot so it can run
+standalone — no Shipwright repo required at runtime.
+
+## Lookup order (see `server/src/core/profile-loader.ts::getProfilesDir`)
+
+1. `SHIPWRIGHT_PROFILES_DIR` — explicit user override (absolute path).
+2. `SHIPWRIGHT_MONOREPO_PATH` → `<path>/shared/profiles/` — dev-loop
+   helper: when you're iterating on the Shipwright monorepo itself and
+   want profile edits to take effect without re-syncing the snapshot.
+3. This directory (bundled snapshot) — the default when neither env
+   var is set.
+
+## Keeping the snapshot fresh
+
+The source of truth is `shipwright/shared/profiles/`. When profiles
+change upstream, re-run:
+
+```bash
+npm run sync-profiles    # (from webui/server/)
+```
+
+…or just copy the changed files manually. There is no automatic sync —
+the snapshot-vs-live drift is intentional so Shipwright and the WebUI
+can release independently.

package/server/profiles/python-plugin-monorepo.json

@@ -0,0 +1,35 @@
+{
+  "name": "python-plugin-monorepo",
+  "description": "Python plugin monorepo (uv workspace). Library/framework with no deployable web server. Each subdirectory under plugins/ is its own pyproject.toml-managed package; shared/ holds cross-plugin scripts and profiles. No root dev server, no frontend.",
+  "version": "0.1.0",
+  "stack": {
+    "runtime": {
+      "python": "3.11+"
+    },
+    "frontend": {},
+    "backend": {}
+  },
+  "dev_server": null,
+  "services": [],
+  "testing": {
+    "unit": "pytest",
+    "command": "uv run pytest"
+  },
+  "linting": {
+    "tool": "ruff",
+    "command": "uv run ruff check"
+  },
+  "deploy": null,
+  "folder_structure": {
+    "plugins/": "Per-SDLC-phase Claude Code plugins (each with .claude-plugin/, hooks/, skills/, scripts/, tests/, pyproject.toml)",
+    "shared/": "Cross-plugin scripts, profiles, templates, prompts",
+    "docs/": "User-facing documentation (guide.md is canonical)",
+    "integration-tests/": "Cross-plugin integration tests",
+    "scripts/": "Top-level developer scripts (install.sh, update-marketplace.sh)"
+  },
+  "required_env_vars": {
+    "build": [],
+    "deploy": [],
+    "plugin": []
+  }
+}

package/server/profiles/supabase-nextjs.json

@@ -0,0 +1,253 @@
+{
+  "name": "supabase-nextjs",
+  "description": "Full-stack Next.js with Supabase backend, optimized for Jelastic deployment",
+  "version": "1.0.0",
+
+  "stack": {
+    "runtime": {
+      "node": "22.x",
+      "typescript": "^5.9.3"
+    },
+    "frontend": {
+      "next": "^16.2.0",
+      "react": "^19.2.4",
+      "react-dom": "^19.2.4",
+      "tailwindcss": "^4.2.0",
+      "zustand": "^5.0.12"
+    },
+    "backend": {
+      "supabase-js": "@supabase/supabase-js@^2.99.3",
+      "supabase-cli": "^2.82.0"
+    },
+    "auth": {
+      "provider": "supabase-auth",
+      "methods": ["email", "oauth"],
+      "notes": "Supabase Auth with Email + OAuth. Token refresh strategy is project-specific (decision_log)."
+    },
+    "storage": "supabase-storage",
+    "realtime": "supabase-realtime"
+  },
+
+  "design_system": {
+    "name": "untitled-ui",
+    "type": "react",
+    "docs_url": "https://www.untitledui.com/react/components",
+    "mockup_approach": "html-inline-css",
+    "_comment": "Design system for shipwright-design mockups. Implementation uses component_library below."
+  },
+
+  "ui": {
+    "component_library": "shadcn/ui",
+    "shadcn_cli": "^4.0.0",
+    "forms": {
+      "react-hook-form": "^7.71.2",
+      "zod": "^4.3.6"
+    },
+    "patterns": {
+      "auth_flow": "Login/Signup page with social OAuth buttons (shadcn/ui)",
+      "dashboard": "Sidebar navigation + header + content area",
+      "settings": "Tab-based settings page",
+      "lists": "Data tables with sorting, filtering, pagination (shadcn/ui)",
+      "forms": "Multi-step forms with validation (react-hook-form + zod)",
+      "empty_states": "Illustrated empty state with CTA",
+      "error_pages": "404/500 with navigation back"
+    }
+  },
+
+  "dev_server": {
+    "command": "npm run dev",
+    "port": 3000,
+    "ready_timeout_seconds": 60,
+    "ready_path": "/"
+  },
+
+  "testing": {
+    "unit": {
+      "framework": "vitest",
+      "version": "^4.1.0"
+    },
+    "e2e": {
+      "framework": "@playwright/test",
+      "version": "^1.58.2"
+    },
+    "integration": {
+      "framework": "vitest",
+      "config": "vitest.integration.config.ts",
+      "command": "npx vitest run --config vitest.integration.config.ts",
+      "dir": "tests/integration/",
+      "helpers_template": "integration-helpers-supabase.ts.template",
+      "vitest_config_template": "vitest.integration.config.ts.template",
+      "cleanup_strategy": "cascade-delete-test-user",
+      "db_strategy": { "local": "supabase start", "ci": "supabase start", "dev": "supabase start" },
+      "env_file": ".env.test",
+      "url_safety_check": "localhost_only",
+      "requires_env": ["NEXT_PUBLIC_SUPABASE_URL", "NEXT_PUBLIC_SUPABASE_ANON_KEY", "SUPABASE_SERVICE_ROLE_KEY"],
+      "test_users": {
+        "admin": { "env_email": "TEST_ADMIN_EMAIL", "env_password": "TEST_ADMIN_PASSWORD" },
+        "member": { "env_email": "TEST_MEMBER_EMAIL", "env_password": "TEST_MEMBER_PASSWORD" }
+      },
+      "timeout_ms": 30000,
+      "sequential": true,
+      "autofix": {
+        "max_retries": 3,
+        "strategy": "structured-debugging",
+        "fast_fail_patterns": ["ECONNREFUSED", "ETIMEDOUT", "connect ENOENT"],
+        "fast_fail_threshold": 0.5
+      }
+    },
+    "db_tests": {
+      "framework": "pgtap",
+      "command": "supabase test db",
+      "dir": "supabase/tests/database/",
+      "setup_script": "supabase/tests/database/000-setup-tests-hooks.sql",
+      "helpers": "supabase-test-helpers"
+    },
+    "security": {
+      "provider": "auto",
+      "scope": ["sast", "sca", "secret-detection"],
+      "_comment": "provider: 'auto' detects Aikido or OSS tools. Set 'oss' or 'aikido' to force a backend."
+    }
+  },
+
+  "linting": {
+    "eslint": "^10.0.3",
+    "eslint_config": "flat",
+    "prettier": "^3.8.1"
+  },
+
+  "error_tracking": {
+    "provider": "sentry",
+    "package": "@sentry/nextjs@^10.45.0",
+    "tier": "free"
+  },
+
+  "deploy": {
+    "target": "jelastic",
+    "environments": {
+      "dev": {
+        "auto_deploy": true,
+        "branches": ["develop", "feature/*"]
+      },
+      "prod": {
+        "auto_deploy": false,
+        "branches": ["main"],
+        "requires_confirmation": true,
+        "snapshot_before_deploy": true
+      }
+    },
+    "next_config": {
+      "output": "standalone"
+    },
+    "notes": "No ISR on Jelastic — use SSR or client-side fetch. Optional Cloudflare CDN for caching + image optimization."
+  },
+
+  "ci": {
+    "provider": "github-actions",
+    "pipeline": {
+      "on_push": ["develop", "feature/*"],
+      "on_pr": ["main"],
+      "jobs": ["lint", "type-check", "unit-tests", "integration-tests"],
+      "on_pr_jobs": ["aikido-scan"]
+    }
+  },
+
+  "folder_structure": {
+    "src/app/": "Next.js App Router pages",
+    "src/components/": "React components",
+    "src/lib/": "Utility functions",
+    "src/hooks/": "Custom React hooks",
+    "supabase/migrations/": "SQL forward migrations (managed by shipwright-build)",
+    "supabase/migrations/_rollback/": "SQL rollback migrations (not executed by supabase db push)",
+    "supabase/functions/": "Edge Functions",
+    "tests/": "Vitest unit tests",
+    "tests/integration/": "Vitest integration tests (real DB, no mocks, localhost only)",
+    "supabase/tests/database/": "pgTAP database tests (RLS, constraints, DB functions)",
+    "e2e/": "Playwright E2E tests",
+    "public/": "Static assets"
+  },
+
+  "env_files": {
+    ".env.local": "Local development (not committed)",
+    ".env.test": "Integration test environment — localhost Supabase only (not committed)",
+    ".env.example": "Template with all required vars (committed)",
+    "jelastic_dashboard": "DEV/PROD secrets (SUPABASE_URL, SUPABASE_KEY, etc.)"
+  },
+
+  "required_env_vars": {
+    "build": [
+      {"name": "NEXT_PUBLIC_SUPABASE_URL", "description": "Supabase project URL"},
+      {"name": "NEXT_PUBLIC_SUPABASE_ANON_KEY", "description": "Supabase anonymous key"},
+      {"name": "SUPABASE_SERVICE_ROLE_KEY", "description": "Supabase service role key (admin operations: webhooks, role upgrades)"},
+      {"name": "TEST_ADMIN_EMAIL", "description": "Test admin user email for integration tests", "optional": true},
+      {"name": "TEST_ADMIN_PASSWORD", "description": "Test admin user password for integration tests", "optional": true},
+      {"name": "TEST_MEMBER_EMAIL", "description": "Test member user email for integration tests", "optional": true},
+      {"name": "TEST_MEMBER_PASSWORD", "description": "Test member user password for integration tests", "optional": true}
+    ],
+    "deploy": [
+      {"name": "JELASTIC_TOKEN", "description": "Infomaniak Jelastic API token"},
+      {"name": "SUPABASE_ACCESS_TOKEN", "description": "Supabase CLI access token (for migrations)", "optional": true}
+    ],
+    "plugin": [
+      {"name": "OPENROUTER_API_KEY", "description": "OpenRouter API key for external plan review", "optional": true},
+      {"name": "GEMINI_API_KEY", "description": "Google Gemini API key (alternative to OpenRouter)", "optional": true},
+      {"name": "OPENAI_API_KEY", "description": "OpenAI API key (alternative to OpenRouter)", "optional": true},
+      {"name": "AIKIDO_CLIENT_ID", "description": "Aikido Security API client ID", "optional": true},
+      {"name": "AIKIDO_CLIENT_SECRET", "description": "Aikido Security API client secret", "optional": true}
+    ]
+  },
+
+  "architecture_rules": [
+    "Feature modules must not import from other feature modules",
+    "All Supabase calls go through lib/supabase/ — no direct client usage in components",
+    "All API calls go through lib/api/ — no fetch() in components",
+    "Server Components by default — 'use client' only when needed",
+    "No business logic in API routes — use Edge Functions",
+    "All database changes via migrations in supabase/migrations/"
+  ],
+
+  "rules": ["tests", "integration-tests", "api", "migrations", "components", "config"],
+
+  "package_manager": "npm",
+
+  "migrations": {
+    "dev": "supabase db push (automatic)",
+    "prod": "supabase db push --dry-run first, user confirms, then apply",
+    "rollback": "down.sql generated in supabase/migrations/_rollback/ (best-effort, never in migrations/ directly)",
+    "destructive_protection": true,
+    "destructive_patterns": ["DROP TABLE", "DROP COLUMN", "ALTER TYPE"],
+    "dir": "supabase/migrations/",
+    "preflight_cmd": "npx supabase status",
+    "apply_cmd": "npx supabase db push --linked",
+    "dry_run_cmd": "npx supabase db push --linked --dry-run",
+    "list_cmd": "npx supabase migration list",
+    "safe_nonprod_only": true,
+    "supports_idempotent_apply": true,
+    "supports_locking": true,
+    "supports_dry_run": true,
+    "apply_scope": "linked",
+    "rollback_strategy": "manual",
+    "post_apply_manual_steps": [
+      {
+        "trigger_tag": "supabase_auth_hook",
+        "trigger_description": "Auth Hook function created (e.g., custom_access_token_hook)",
+        "action": "Dashboard → Authentication → Hooks → Enable and select function",
+        "note": "Cannot be done via CLI or migration",
+        "blocks_tests_for": ["auth", "session", "token"]
+      },
+      {
+        "trigger_tag": "supabase_webhook",
+        "trigger_description": "Database Webhook / Edge Function created",
+        "action": "Dashboard → Database → Webhooks → Configure",
+        "note": "Edge Function must be deployed first",
+        "blocks_tests_for": ["webhook", "edge-function"]
+      },
+      {
+        "trigger_tag": "supabase_realtime",
+        "trigger_description": "Realtime publication added for a table",
+        "action": "Dashboard → Database → Replication → Enable table",
+        "note": "Required for real-time subscriptions to work",
+        "blocks_tests_for": ["realtime", "subscription"]
+      }
+    ]
+  }
+}

package/server/profiles/vite-hono.json

@@ -0,0 +1,92 @@
+{
+  "name": "vite-hono",
+  "description": "Split Vite+React frontend with Hono backend (npm/tsx). Two services managed in parallel by dev_server.py.",
+  "version": "1.0.0",
+
+  "stack": {
+    "runtime": {
+      "node": "22.x",
+      "typescript": "^5.6.0"
+    },
+    "frontend": {
+      "vite": "^6.0.0",
+      "react": "^19.0.0",
+      "react-dom": "^19.0.0"
+    },
+    "backend": {
+      "hono": "^4.7.0",
+      "@hono/node-server": "^1.14.0",
+      "tsx": "^4.19.0"
+    }
+  },
+
+  "services": [
+    {
+      "name": "backend",
+      "command": "npm --prefix server run dev",
+      "host": "localhost",
+      "scheme": "http",
+      "port": "${PORT:-3847}",
+      "ready_path": "/api/diagnostics",
+      "ready_timeout_seconds": 60
+    },
+    {
+      "name": "frontend",
+      "command": "npm --prefix client run dev",
+      "host": "localhost",
+      "scheme": "http",
+      "port": "${VITE_PORT:-5173}",
+      "ready_path": "/",
+      "ready_timeout_seconds": 60,
+      "depends_on": ["backend"],
+      "primary": true
+    }
+  ],
+
+  "testing": {
+    "unit": {
+      "framework": "vitest",
+      "version": "^3.0.0"
+    },
+    "e2e": {
+      "framework": "@playwright/test",
+      "version": "^1.59.1"
+    },
+    "performance": {
+      "enabled": true,
+      "lighthouse": {
+        "min_score": 85,
+        "lcp_max_ms": 2500,
+        "playwright_cwd": "client"
+      },
+      "bundle": {
+        "max_kb_gz": 250,
+        "build_output_dir": "client/dist/assets"
+      },
+      "gate": "warn",
+      "_comment": "Performance budget gate (Lighthouse via Playwright + bundle gzip-size). Monorepo layout: playwright_cwd points at client/ where Playwright lives. Override per-project via shipwright_test_config.json.performance. Requires Node 22+ (Lighthouse 13 + Playwright 1.50 are ESM/Node-22 only)."
+    }
+  },
+
+  "linting": {
+    "eslint": "^9.0.0"
+  },
+
+  "package_manager": "npm",
+  "rules": ["tests", "components", "config"],
+
+  "folder_structure": {
+    "client/": "Vite frontend (React + TypeScript)",
+    "server/": "Hono backend (Node + TypeScript)",
+    "client/src/": "Frontend source",
+    "server/src/": "Backend source",
+    "e2e/": "Playwright E2E tests (created by /shipwright-adopt or /shipwright-iterate)"
+  },
+
+  "env_files": {
+    ".env.local": "Local development overrides (PORT, VITE_PORT, etc.) — not committed",
+    ".env.example": "Template (committed)"
+  },
+
+  "notes": "This profile assumes Node 20.x + npm 10+. Service commands use `npm --prefix <dir> run dev`; the `--prefix` flag MUST come before the subcommand for unambiguous parsing on modern npm. Frontend `depends_on: backend` ensures the Vite proxy target is up before the SPA shell is considered ready. Frontend is `primary: true` so dev_server.py's top-level `pid`/`url` reflect the browser-facing URL. Ports use `${PORT:-3847}` / `${VITE_PORT:-5173}` placeholders so /shipwright-adopt can override them via env (avoids collisions when a user dev server is already on the defaults — e.g. running adopt from inside the webui)."
+}