@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/families/godot-web/files/export_presets.cfg

@@ -0,0 +1,44 @@
+; Godot 4.3 export preset for the Web target. The editor will extend
+; this file on first save, but the skeleton below is enough for `godot
+; --headless --export-release 'Web' exports/web/index.html` in CI.
+
+[preset.0]
+
+name="Web"
+platform="Web"
+runnable=true
+advanced_options=false
+dedicated_server=false
+custom_features=""
+export_filter="all_resources"
+include_filter=""
+exclude_filter=""
+export_path="exports/web/index.html"
+encryption_include_filters=""
+encryption_exclude_filters=""
+encrypt_pck=false
+encrypt_directory=false
+script_export_mode=2
+
+[preset.0.options]
+
+custom_template/debug=""
+custom_template/release=""
+variant/extensions_support=false
+variant/thread_support=true
+vram_texture_compression/for_desktop=true
+vram_texture_compression/for_mobile=false
+html/export_icon=true
+html/custom_html_shell=""
+html/head_include=""
+html/canvas_resize_policy=2
+html/focus_canvas_on_start=true
+html/experimental_virtual_keyboard=false
+progressive_web_app/enabled=false
+progressive_web_app/offline_page=""
+progressive_web_app/display=1
+progressive_web_app/orientation=0
+progressive_web_app/icon_144x144=""
+progressive_web_app/icon_180x180=""
+progressive_web_app/icon_512x512=""
+progressive_web_app/background_color=Color(0, 0, 0, 1)

package/registry/families/godot-web/files/icon.svg

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="128" height="128" viewBox="0 0 128 128" xmlns="http://www.w3.org/2000/svg">
+  <rect width="128" height="128" rx="24" fill="#0b0d10"/>
+  <circle cx="64" cy="64" r="36" fill="#6ea8ff"/>
+  <circle cx="52" cy="58" r="6" fill="#0b0d10"/>
+  <circle cx="76" cy="58" r="6" fill="#0b0d10"/>
+</svg>

package/registry/families/godot-web/files/project.godot

@@ -0,0 +1,28 @@
+; Godot 4.3 project file. Do not hand-edit sections Godot owns
+; (`config/features`, `rendering/`) unless you know what you're doing;
+; opening the project in the editor will re-stamp them.
+
+config_version=5
+
+[application]
+
+config/name="{{serviceName}}"
+config/description="Godot 4.3 HTML5 starter — web-first scene with scene-agnostic main script."
+run/main_scene="res://scenes/main.tscn"
+config/features=PackedStringArray("4.3", "GL Compatibility")
+config/icon="res://icon.svg"
+
+[display]
+
+window/size/viewport_width=1152
+window/size/viewport_height=648
+window/stretch/mode="canvas_items"
+window/stretch/aspect="keep"
+
+[rendering]
+
+; GL Compatibility driver works on the widest set of browsers/WebGL
+; targets. Switch to "forward_plus" only if you have confirmed the
+; target audience is on desktop Chrome/Edge 113+ with WebGPU enabled.
+renderer/rendering_method="gl_compatibility"
+renderer/rendering_method.mobile="gl_compatibility"

package/registry/families/godot-web/files/validate-godot-web.mjs

@@ -0,0 +1,46 @@
+// Structural validator for godot-web. Does NOT run the Godot editor or
+// attempt an export — both require the Godot binary plus matching export
+// templates. Confirms the project + scene + script wiring is consistent
+// and the Web export preset is present.
+
+import fs from "node:fs/promises";
+
+const [projectFile, exportPresets, mainTscn, mainGd] = await Promise.all([
+  fs.readFile("project.godot", "utf8"),
+  fs.readFile("export_presets.cfg", "utf8"),
+  fs.readFile("scenes/main.tscn", "utf8"),
+  fs.readFile("scripts/main.gd", "utf8"),
+]);
+
+if (!projectFile.includes("config_version=5")) {
+  throw new Error("project.godot must declare config_version=5 (Godot 4.x)");
+}
+if (!projectFile.includes('run/main_scene="res://scenes/main.tscn"')) {
+  throw new Error('project.godot must point run/main_scene to res://scenes/main.tscn');
+}
+if (!/config\/features=PackedStringArray\(.*"4\.3".*\)/.test(projectFile)) {
+  throw new Error('project.godot must list "4.3" in config/features');
+}
+
+if (!exportPresets.includes('platform="Web"')) {
+  throw new Error('export_presets.cfg must declare a Web platform preset');
+}
+if (!exportPresets.includes('export_path="exports/web/index.html"')) {
+  throw new Error('export_presets.cfg Web preset must target exports/web/index.html');
+}
+
+if (!mainTscn.startsWith("[gd_scene")) {
+  throw new Error("scenes/main.tscn must be a Godot scene file (starts with [gd_scene ...])");
+}
+if (!mainTscn.includes("scripts/main.gd")) {
+  throw new Error("scenes/main.tscn must reference scripts/main.gd as a script resource");
+}
+
+if (!mainGd.includes("extends")) {
+  throw new Error("scripts/main.gd must extend a Node type (e.g. `extends Node2D`)");
+}
+if (!/func\s+_ready\s*\(\s*\)/.test(mainGd)) {
+  throw new Error("scripts/main.gd must implement _ready()");
+}
+
+console.log("godot-web starter ok");

package/registry/families/godot-web/manifest.json

@@ -0,0 +1,172 @@
+{
+  "id": "godot-web",
+  "description": "Godot 4.3 HTML5 export scaffold — project.godot, a minimal scene with a label + sprite, a _ready/_process script, and an export_presets.cfg pointed at exports/web/. Open in Godot 4.3+, press Export → HTML5, ship the resulting dist. Foundation for Godot browser games, prototypes, and jam entries.",
+  "tags": [
+    "frontend",
+    "gdscript",
+    "godot",
+    "game-engine",
+    "html5"
+  ],
+  "taxonomy": {
+    "language": "gdscript",
+    "runtime": "godot",
+    "surface": "frontend"
+  },
+  "defaults": {
+    "projectType": "frontend",
+    "serviceName": "starter-foundry-godot-web",
+    "port": 8060
+  },
+  "files": [
+    {
+      "source": "files/project.godot",
+      "target": "project.godot"
+    },
+    {
+      "source": "files/export_presets.cfg",
+      "target": "export_presets.cfg"
+    },
+    {
+      "source": "files/icon.svg",
+      "target": "icon.svg"
+    },
+    {
+      "source": "files/README.md",
+      "target": "README.md"
+    },
+    {
+      "source": "files/validate-godot-web.mjs",
+      "target": "validate-godot-web.mjs"
+    },
+    {
+      "source": "files/.gitignore",
+      "target": ".gitignore"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "project.godot"
+    },
+    {
+      "type": "file-exists",
+      "path": "export_presets.cfg"
+    },
+    {
+      "type": "file-exists",
+      "path": "scenes/main.tscn"
+    },
+    {
+      "type": "file-exists",
+      "path": "scripts/main.gd"
+    },
+    {
+      "type": "command-success",
+      "command": [
+        "node",
+        "validate-godot-web.mjs"
+      ],
+      "expect": "godot-web starter ok"
+    }
+  ],
+  "contextHints": {
+    "commands": [
+      "godot --editor .",
+      "godot --headless --export-release 'Web' exports/web/index.html"
+    ],
+    "entrypoints": [
+      "project.godot",
+      "scenes/main.tscn",
+      "scripts/main.gd",
+      "export_presets.cfg"
+    ],
+    "preview": {
+      "path": "/"
+    },
+    "extensionPoints": [
+      "scenes/main.tscn",
+      "scripts/main.gd"
+    ]
+  },
+  "keywords": [
+    "godot",
+    "godot web",
+    "godot html5",
+    "godot 4",
+    "gdscript game",
+    "godot browser",
+    "godot export",
+    "godot engine"
+  ],
+  "scoring": {
+    "boost": {
+      "godot": 5,
+      "godot web": 5,
+      "godot html5": 5,
+      "godot 4": 4,
+      "gdscript game": 4
+    }
+  },
+  "tieredKeywords": {
+    "tier1": [
+      "godot",
+      "godot web",
+      "godot html5",
+      "godot 4",
+      "gdscript game"
+    ],
+    "tier2": [
+      "godot browser",
+      "godot export",
+      "godot engine",
+      "godot jam",
+      "godot prototype"
+    ],
+    "archetypes": [
+      "godot browser game",
+      "godot jam entry",
+      "godot 2d platformer web",
+      "godot card game",
+      "godot interactive fiction",
+      "godot puzzle demo",
+      "godot incremental game",
+      "godot shader demo",
+      "godot visual novel",
+      "godot tile-based roguelike"
+    ]
+  },
+  "buildHints": {
+    "whenToUse": "Godot-authored games or interactive content targeting the browser. This scaffold gives you the project skeleton and export preset; you still open Godot 4.3+ to iterate and to actually export. Pick bevy-web for Rust-first games or threejs-game for JavaScript-first 3D content.",
+    "firstSteps": [
+      "Install Godot 4.3+ from godotengine.org (or via `brew install --cask godot` on macOS). Command-line builds additionally require the matching Web export templates — download via Editor → Manage Export Templates.",
+      "Open the project: `godot --editor .` from the project root, or drag `project.godot` onto the Godot executable.",
+      "Inspect `scenes/main.tscn` — one Node2D root with a Sprite2D and a Label; `scripts/main.gd` attaches to the root and drives a simple _process animation. Press F5 to run in the editor.",
+      "Export to web: Project → Export → select `Web` → Export Project. Output lands in `exports/web/` as `index.html` + `index.js` + `index.wasm` + `index.pck`. Ship that directory to any static host.",
+      "Headless CI export: `godot --headless --export-release 'Web' exports/web/index.html` from the project root once export templates are installed."
+    ],
+    "gotchas": [
+      "Godot 4 HTML5 builds require SharedArrayBuffer, which browsers only expose when the page is served with `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`. Without these headers the export loads to a blank canvas — configure your static host (Cloudflare Pages, Vercel, nginx) to emit them for the exports/web/ directory.",
+      "Web export templates must match the Godot editor version exactly (e.g. 4.3-stable editor needs 4.3-stable templates). Downloading a `dev` template for a `stable` editor silently fails at export time.",
+      "The `.godot/` directory is editor-generated cache — do NOT commit it. The supplied .gitignore excludes it.",
+      "Godot's HTML5 threading requires WebAssembly threads, which are behind the COOP/COEP gate above AND require the browser to have threads enabled (all modern browsers do, but some mobile browsers in lockdown modes don't).",
+      "Audio autoplay is blocked in every browser until the user interacts — wire audio start to a click/keypress or the first frame will have no sound.",
+      "Export presets live in `export_presets.cfg` and are version-controlled; they reference absolute paths in your editor on first save — the supplied preset uses relative paths (`exports/web/index.html`) to keep the repo portable."
+    ],
+    "architectureNotes": [
+      "Scenes are the primary unit of composition — prefer many small scenes instanced into a parent over one god-scene.",
+      "Attach scripts to scene roots only when a node truly owns state; pure utility logic belongs in autoloads (singletons) configured in project.godot.",
+      "For web builds specifically, preload assets aggressively — Godot streams from the .pck but first-touch latency on large scenes is visible."
+    ],
+    "placeholders": [
+      {
+        "path": "scenes/main.tscn",
+        "description": "Main scene with a Node2D root, a centered Sprite2D using the default icon, and a Label. Replace with the real game scene; keep the top-level Node2D if other scenes attach the same `main.gd` script."
+      },
+      {
+        "path": "scripts/main.gd",
+        "description": "GDScript attached to the Node2D root — _ready prints engine version, _process rotates the sprite. Replace the process logic with real input handling and game-loop systems."
+      }
+    ]
+  }
+}

package/registry/families/hardhat-contracts/files/package.json

@@ -9,7 +9,15 @@
   "devDependencies": {
     "hardhat": "^2.22.0",
     "@nomicfoundation/hardhat-toolbox": "^5.0.0",
-    "@types/node": "^20.0.0",
-    "typescript": "^5.7.0"
+    "@types/node": "^20.17.0",
+    "typescript": "^5.9.0"
+  },
+  "overrides": {
+    "vite": "^6.4.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "vite": "^6.4.2"
+    }
   }
 }

package/registry/families/healthcare-hipaa-backend/files/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "node --watch --experimental-strip-types src/server.ts",
+    "start": "node --experimental-strip-types src/server.ts",
+    "validate": "node validate-hipaa.mjs",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.36.0",
+    "postgres": "^3.4.5"
+  },
+  "devDependencies": {
+    "drizzle-kit": "^0.30.0",
+    "typescript": "^5.9.0",
+    "@types/node": "^20.17.0"
+  },
+  "overrides": {
+    "vite": "^6.4.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "vite": "^6.4.2"
+    }
+  }
+}

package/registry/families/healthcare-hipaa-backend/files/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "allowImportingTsExtensions": false,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true
+  },
+  "include": ["src/**/*.ts"]
+}

package/registry/families/healthcare-hipaa-backend/files/validate-hipaa.mjs

@@ -0,0 +1,35 @@
+import fs from "node:fs/promises";
+import { stripTypeScriptTypes } from "node:module";
+
+const paths = [
+  "src/server.ts",
+  "src/db/schema.ts",
+  "src/encryption.ts",
+  "src/api/phi-access.ts",
+];
+
+const sources = await Promise.all(paths.map((p) => fs.readFile(p, "utf8")));
+const [server, schema, enc, phiAccess] = sources;
+
+for (const [p, s] of paths.map((p, i) => [p, sources[i]])) {
+  stripTypeScriptTypes(s);
+}
+
+if (!schema.includes("patients") || !schema.includes("encounters") || !schema.includes("providers") || !schema.includes("audit_logs") && !schema.includes("auditLogs")) {
+  throw new Error("src/db/schema.ts missing required tables (patients, encounters, providers, audit_logs)");
+}
+
+if (!enc.includes("aes-256-gcm") && !enc.includes("AES-256-GCM")) {
+  throw new Error("src/encryption.ts must use AES-256-GCM for PHI field encryption");
+}
+
+if (!phiAccess.includes("auditLog") && !phiAccess.includes("audit_log")) {
+  throw new Error("src/api/phi-access.ts must write to audit_logs on every PHI read");
+}
+
+if (!server.includes('/health')) {
+  throw new Error("src/server.ts missing /health route");
+}
+
+JSON.parse(await fs.readFile("package.json", "utf8"));
+console.log("hipaa starter ok");

package/registry/families/healthcare-hipaa-backend/manifest.json

@@ -0,0 +1,145 @@
+{
+  "id": "healthcare-hipaa-backend",
+  "description": "HIPAA-aligned healthcare backend — patients / encounters / providers schema, append-only audit log, field-level PHI encryption, PHI-access middleware.",
+  "tags": [
+    "healthcare",
+    "hipaa",
+    "api",
+    "backend",
+    "typescript"
+  ],
+  "taxonomy": {
+    "language": "typescript",
+    "runtime": "node",
+    "surface": "api"
+  },
+  "slots": {
+    "database": {
+      "options": [
+        "database:sqlite",
+        "database:postgres"
+      ],
+      "default": "database:postgres"
+    },
+    "auth": {
+      "options": [
+        "auth:none",
+        "auth:better-auth",
+        "auth:clerk"
+      ],
+      "default": "auth:better-auth"
+    }
+  },
+  "defaults": {
+    "projectType": "api",
+    "serviceName": "starter-foundry-healthcare",
+    "port": 8100,
+    "databaseProvider": "postgres",
+    "encryptionKeyEnv": "PHI_ENCRYPTION_KEY"
+  },
+  "files": [
+    {
+      "source": "files/package.json",
+      "target": "package.json"
+    },
+    {
+      "source": "files/tsconfig.json",
+      "target": "tsconfig.json"
+    },
+    {
+      "source": "files/validate-hipaa.mjs",
+      "target": "validate-hipaa.mjs"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "src/server.ts"
+    },
+    {
+      "type": "file-exists",
+      "path": "src/db/schema.ts"
+    },
+    {
+      "type": "file-exists",
+      "path": "src/encryption.ts"
+    },
+    {
+      "type": "file-exists",
+      "path": "src/api/phi-access.ts"
+    },
+    {
+      "type": "file-exists",
+      "path": "config/hipaa.md"
+    },
+    {
+      "type": "command-success",
+      "command": [
+        "node",
+        "validate-hipaa.mjs"
+      ],
+      "expect": "hipaa starter ok"
+    }
+  ],
+  "contextHints": {
+    "commands": [
+      "pnpm install",
+      "pnpm dev",
+      "pnpm drizzle-kit generate",
+      "pnpm drizzle-kit migrate"
+    ],
+    "entrypoints": [
+      "src/server.ts",
+      "src/db/schema.ts",
+      "src/encryption.ts",
+      "src/api/phi-access.ts",
+      "config/hipaa.md"
+    ],
+    "preview": {
+      "path": "/health"
+    },
+    "extensionPoints": [
+      "src/db/schema.ts",
+      "src/api/",
+      "config/hipaa.md"
+    ]
+  },
+  "keywords": [
+    "hipaa",
+    "healthcare api",
+    "phi",
+    "patient records",
+    "medical backend",
+    "healthcare compliance",
+    "ehr",
+    "emr",
+    "protected health information",
+    "telemedicine backend",
+    "patient portal api"
+  ],
+  "scoring": {
+    "boost": {
+      "hipaa": 4,
+      "phi": 4
+    }
+  },
+  "tieredKeywords": {
+    "tier1": [
+      "hipaa",
+      "phi",
+      "protected health information",
+      "healthcare api",
+      "patient records",
+      "medical backend",
+      "ehr",
+      "emr"
+    ],
+    "tier2": [
+      "healthcare compliance",
+      "telemedicine backend",
+      "patient portal api",
+      "clinical data api",
+      "encounter records"
+    ]
+  }
+}

package/registry/families/hipaa-compliance-pack/files/docs/BAA-template.md

@@ -0,0 +1,60 @@
+# Business Associate Agreement — Template
+
+> **This is a template, not legal advice.** Your legal team MUST review and
+> customize before execution. This document exists so product teams have a
+> starting point — do not ship it as-is.
+
+## Parties
+
+- **Covered Entity**: [Name, address, Tax ID]
+- **Business Associate**: [Name, address, Tax ID]
+- **Effective Date**: [Date]
+
+## 1. Definitions
+
+Terms used but not defined have the meaning assigned in 45 CFR Part 160
+and Part 164 (the HIPAA Rules).
+
+## 2. Permitted uses and disclosures
+
+Business Associate may use or disclose PHI:
+
+- To perform the services described in the underlying Services Agreement.
+- For the proper management and administration of Business Associate's business.
+- To provide data aggregation services relating to the health care operations of the Covered Entity.
+
+All other uses and disclosures are prohibited.
+
+## 3. Business Associate obligations
+
+Business Associate agrees to:
+
+- Not use or disclose PHI other than as permitted by this agreement or as required by law.
+- Use appropriate safeguards, including technical safeguards under §164.312.
+- Report to the Covered Entity any use or disclosure not provided for by this agreement within [5] business days of discovery.
+- Ensure any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions.
+- Make PHI available to the Covered Entity as required for §164.524 (access), §164.526 (amendment), and §164.528 (accounting of disclosures).
+- At termination, return or destroy all PHI received from the Covered Entity and retain no copies in any form.
+
+## 4. Security incident notification
+
+Business Associate shall notify the Covered Entity of any security incident
+of which it becomes aware within [2] business days. Security incident has
+the meaning set forth in §164.304.
+
+## 5. Breach notification
+
+Following the discovery of a breach of Unsecured PHI, Business Associate
+shall notify the Covered Entity without unreasonable delay and in no case
+later than 60 calendar days after discovery.
+
+## 6. Term and termination
+
+- **Term**: This agreement is effective as of the Effective Date and continues until all PHI is returned or destroyed.
+- **Termination for cause**: The Covered Entity may terminate upon 30 days notice for material breach uncured within that period.
+
+## Signatures
+
+Covered Entity: _____________________ Date: _______
+
+Business Associate: _____________________ Date: _______

package/registry/families/hipaa-compliance-pack/files/docs/HIPAA-controls.md

@@ -0,0 +1,58 @@
+# HIPAA Security Rule — Control Surface
+
+This pack implements the technical safeguards of the HIPAA Security Rule
+(45 CFR §164.312). Each control below maps to a file in this scaffold.
+Admin + physical safeguards (§164.308, §164.310) are process + infrastructure
+concerns outside the scope of this pack.
+
+## Technical safeguards covered
+
+| Citation | Control | Implementation |
+|---|---|---|
+| §164.312(a)(1) | Access control — unique user identification | `src/phi-access.ts` — audit row carries `actorUserId` + `actorRole` |
+| §164.312(a)(2)(i) | Emergency access procedure | Operational — document your break-glass process |
+| §164.312(a)(2)(iii) | Automatic logoff | Application-layer session timeout (middleware in your framework) |
+| §164.312(a)(2)(iv) | Encryption and decryption | `src/encryption.ts` — AES-256-GCM at column level |
+| §164.312(b) | Audit controls | `src/audit-log.ts` — append-only; `withPhiAccess` emits before response |
+| §164.312(c)(1) | Integrity controls | Audit tag (AES-GCM auth tag) + DB-level append-only constraint on `audit_logs` |
+| §164.312(d) | Person or entity authentication | Use your existing auth layer; pack requires `actorUserId` in every call |
+| §164.312(e)(1) | Transmission security | TLS 1.2+ on the network layer; not enforced at application level |
+| §164.312(e)(2)(i) | Integrity controls (transmission) | TLS + request signing where applicable |
+| §164.312(e)(2)(ii) | Encryption (transmission) | TLS required in production |
+
+## Administrative + physical pointers
+
+These live outside this pack but are required for compliance:
+
+- **§164.316(b)(2)(i)** — Retention: documentation ≥ 6 years. Applies to audit logs + policies. Plan storage accordingly.
+- **§164.316(a)** — Policies and procedures: you need a written Security Management Process. This is PROSE, not code.
+- **§164.308(a)(1)(ii)(A)** — Risk analysis: document + date + sign. Repeat at least annually.
+- **§164.404** — Breach notification: 60-day clock from discovery. Incident-response playbook needed.
+
+## Minimum-necessary policy (§164.502(b))
+
+`src/phi-access.ts` exports `DEFAULT_PHI_POLICY` — a map of `table → role →
+allowed_fields`. Extend per product. The `filterByMinimumNecessary()`
+helper enforces it at the row-shape level so the API never leaks a field
+the caller's role shouldn't see.
+
+## De-identification (§164.514)
+
+Two methods are allowed:
+
+1. **Safe Harbor** — remove all 18 specified identifiers. Pack provides a
+   stub (`safeHarborRedact()`) — extend for free-text fields.
+2. **Expert Determination** — a qualified statistician attests there's
+   "very small" risk of re-identification. Requires a signed letter.
+
+Most products use Safe Harbor. If yours does, the redactor must run on
+every export + analytics path.
+
+## What this pack does NOT do
+
+- **Authentication**: bring your own (better-auth, clerk, custom JWT).
+- **DB-level append-only enforcement**: you must add a trigger or DENY the
+  UPDATE/DELETE privileges on the audit table at the DB user.
+- **TLS termination**: infra concern; use Cloudflare, AWS ALB, or your own.
+- **BAA signature storage**: `docs/BAA-template.md` is the template; store
+  signed copies wherever your legal team mandates.