@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/families/ollama-server/manifest.json

@@ -0,0 +1,101 @@
+{
+  "id": "ollama-server",
+  "description": "Ollama self-hosted LLM starter — Docker Compose + thin TS client. Local-first, llama.cpp-backed, GGUF models. Port 11434, OpenAI-compatible /api/generate + /api/chat.",
+  "tags": ["inference", "llm", "ollama", "docker", "typescript"],
+  "taxonomy": {
+    "language": "typescript",
+    "runtime": "node",
+    "surface": "inference"
+  },
+  "defaults": {
+    "projectType": "inference",
+    "serviceName": "starter-foundry-ollama",
+    "port": 11434
+  },
+  "files": [
+    { "source": "files/docker-compose.yml", "target": "docker-compose.yml" },
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/Modelfile", "target": "Modelfile" },
+    { "source": "files/README.md", "target": "README.md" },
+    { "source": "files/validate-ollama.mjs", "target": "validate-ollama.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "docker-compose.yml" },
+    { "type": "file-exists", "path": "src/client.ts" },
+    { "type": "file-exists", "path": "Modelfile" },
+    {
+      "type": "command-success",
+      "command": ["node", "validate-ollama.mjs"],
+      "expect": "ollama starter ok"
+    }
+  ],
+  "contextHints": {
+    "commands": [
+      "docker compose up -d",
+      "docker compose exec ollama ollama pull llama3.2",
+      "pnpm install",
+      "pnpm dev"
+    ],
+    "entrypoints": ["src/client.ts", "Modelfile", "docker-compose.yml"],
+    "preview": { "path": "/api/tags", "port": "11434" },
+    "extensionPoints": ["Modelfile", "src/client.ts", "docker-compose.yml"]
+  },
+  "keywords": [
+    "ollama",
+    "ollama server",
+    "local llm",
+    "llama.cpp",
+    "gguf",
+    "self-hosted llm",
+    "on-device llm",
+    "llama3",
+    "mistral local",
+    "qwen local"
+  ],
+  "scoring": {
+    "boost": { "ollama": 5, "local llm": 3, "gguf": 3 }
+  },
+  "tieredKeywords": {
+    "tier1": ["ollama", "ollama local", "local llm", "gguf"],
+    "tier2": ["llama.cpp", "self-hosted inference", "on-device llm", "ollama modelfile"],
+    "archetypes": [
+      "local llm chat",
+      "private rag",
+      "offline coding assistant",
+      "self-hosted autocomplete",
+      "ollama-backed agent",
+      "on-prem llm api"
+    ]
+  },
+  "buildHints": {
+    "whenToUse": "Self-hosted / local LLM inference where privacy, offline operation, or zero-vendor-cost matter more than absolute throughput. Pick over vllm-server when targeting laptops, edge, or air-gapped deploys; pick vllm-server for production GPU serving at scale.",
+    "firstSteps": [
+      "Start the server: `docker compose up -d` — binds 11434 on host. CPU-only by default; uncomment the GPU block in docker-compose.yml to use CUDA.",
+      "Pull a model (one-time): `docker compose exec ollama ollama pull llama3.2` (or qwen2.5, mistral, gemma3 — see https://ollama.com/library). First pull is ~2-8 GB.",
+      "Install client deps: `pnpm install`. The TS client in `src/client.ts` calls `POST /api/generate` and streams JSON lines.",
+      "Customize the model: edit `Modelfile` (FROM llama3.2, SYSTEM prompt, PARAMETER temperature ...), then `ollama create <name> -f Modelfile` inside the container.",
+      "Verify: `curl http://localhost:11434/api/tags` lists loaded models. `pnpm dev` runs the example client call."
+    ],
+    "gotchas": [
+      "Models are pulled at runtime, NOT baked into the image. A fresh container has zero models — the first request on an unpulled model returns a clear error, not a hang.",
+      "The Ollama streaming response is newline-delimited JSON (NDJSON), NOT SSE. Parse line-by-line with a decoder that handles partial lines across chunks — naive JSON.parse on chunks will corrupt.",
+      "`ollama run <model>` is an interactive REPL inside the container — do NOT use it from scripts. Use the HTTP API for programmatic calls.",
+      "GPU inference requires `deploy.resources.reservations.devices` in docker-compose.yml AND nvidia-container-toolkit on the host. Missing either silently falls back to CPU (slow)."
+    ],
+    "architectureNotes": [
+      "Ollama wraps llama.cpp — inference runs in a single process; parallelism is limited. For multi-tenant high-QPS, put a queue in front or move to vllm-server.",
+      "Model storage lives in the `ollama` named volume — survive container recreation, but a volume `docker volume rm` deletes everything. Back up before upgrades."
+    ],
+    "placeholders": [
+      {
+        "path": "src/client.ts",
+        "description": "Example client hitting /api/generate with a default prompt. Replace the prompt + streaming handler with the product's actual LLM call flow."
+      },
+      {
+        "path": "Modelfile",
+        "description": "Model customization (base, system prompt, temperature, stop tokens). Replace SYSTEM with the product's actual persona/constraints."
+      }
+    ]
+  }
+}

package/registry/families/pci-dss-compliance-pack/files/docs/PCI-DSS-controls.md

@@ -0,0 +1,43 @@
+# PCI DSS 4.0 — Control Surface
+
+This pack ships the technical primitives that reduce PCI scope for an
+e-commerce backend. The scope-reduction strategy is Stripe-first: use
+Stripe Elements / Checkout so the PAN never touches your servers, then
+use the `pm_...` token for all downstream operations.
+
+## Scope reduction via tokenization (PCI 3.4)
+
+- Raw PAN / CVV / track data: **must not touch your servers**. Use Stripe Elements, Checkout, or Payment Request Button.
+- `assertNoChdInRef()` (in `src/tokenize.ts`) enforces this at the code layer.
+- Last-4 + brand are safe to store and display.
+
+## Requirements mapped to code
+
+| Req | Name | Artifact |
+|---|---|---|
+| PCI 1 | Network segmentation | Infra concern — gate CHD-adjacent services behind a separate VPC |
+| PCI 2 | No default passwords | Secret management (AWS Secrets Manager / Vault) |
+| PCI 3 | Protect stored CHD | **Do not store CHD** — use `pm_...` tokens instead |
+| PCI 3.4 | Render PAN unreadable | `redactPan()` + tokenization above |
+| PCI 4 | Encrypt CHD in transit | TLS 1.2+ — infra concern |
+| PCI 6 | Secure software dev | SCA + SAST (the CVE sweep in `.github/workflows/cve-sweep.yml`) |
+| PCI 8 | Auth + access control | App auth layer |
+| **PCI 10** | Log + monitor access | CHD audit log (this pack's audit store) |
+| PCI 11 | Regular security testing | Pen test (annual) + vuln scans (quarterly) |
+
+## PCI 3.2.1 — Forbidden data
+
+- CVV / CVC / CVV2: **never** store post-authorization.
+- Full magnetic stripe: **never** store.
+- PIN / PIN block: **never** store.
+- PAN: only store if you MUST — and if you do, encrypt at rest, segment network, add to SAQ-D scope.
+
+## Log hygiene
+
+- Never log request/response bodies on payment endpoints without `redactPanInObject()`.
+- Error tracers (Sentry, Datadog) default to capturing request bodies. Install the redaction as a hook BEFORE the SDK captures.
+- Test with a Luhn-valid test card in dev — the redactor should replace it with `<pan-redacted:****NNNN>`.
+
+## SAQ scope
+
+Typical with Stripe Elements: **SAQ-A-EP** (JavaScript-embedded iframe). This is the lightest questionnaire. If you deviate (e.g. accept raw card data via your own form), scope jumps to SAQ-D.

package/registry/families/pci-dss-compliance-pack/files/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "validate": "node validate-hipaa-pack.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/registry/families/pci-dss-compliance-pack/files/src/pan-redact.ts

@@ -0,0 +1,50 @@
+// PAN redaction. Any log sink or error tracer that serializes request bodies
+// MUST pass through this filter. One raw PAN in Sentry = PCI scope failure.
+
+// Matches 13-19 digit strings with optional spacing/hyphens between groups
+// of 4. Luhn check narrows to real-looking card numbers so we don't
+// over-redact random numeric IDs.
+const PAN_PATTERN = /\b(?:\d[ -]?){12,18}\d\b/g
+
+function luhnValid(digits: string): boolean {
+  let sum = 0
+  let alt = false
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let n = Number(digits[i])
+    if (alt) {
+      n *= 2
+      if (n > 9) n -= 9
+    }
+    sum += n
+    alt = !alt
+  }
+  return sum % 10 === 0
+}
+
+/** Replace any PAN-like substring with `<pan-redacted>` preserving the last 4. */
+export function redactPan(input: string): string {
+  return input.replace(PAN_PATTERN, (match) => {
+    const digits = match.replace(/[^\d]/g, '')
+    if (digits.length < 13 || digits.length > 19) return match
+    if (!luhnValid(digits)) return match
+    const last4 = digits.slice(-4)
+    return `<pan-redacted:****${last4}>`
+  })
+}
+
+/** Deep-redact an object before serialization. */
+export function redactPanInObject<T>(value: T): T {
+  if (typeof value === 'string') return redactPan(value) as unknown as T
+  if (value === null || typeof value !== 'object') return value
+  if (Array.isArray(value)) return value.map((v) => redactPanInObject(v)) as unknown as T
+  const out: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    // Fields that should always be redacted regardless of format.
+    if (/^(cvv|cvc|pan|card.?number|account.?number)$/i.test(k)) {
+      out[k] = '<redacted>'
+    } else {
+      out[k] = redactPanInObject(v)
+    }
+  }
+  return out as T
+}

package/registry/families/pci-dss-compliance-pack/files/src/tokenize.ts

@@ -0,0 +1,39 @@
+// Stripe-backed CHD tokenization. The client-side Stripe Elements SDK
+// collects the PAN in Stripe's iframe; the server only ever sees the
+// resulting PaymentMethod id (`pm_...`). This module is the server-side
+// contract for storing + charging the token.
+
+export interface StripePaymentMethodRef {
+  /** `pm_...` — the tokenized reference. Never contains CHD. */
+  paymentMethodId: string
+  /** Last 4 digits of the card (safe to store + display). */
+  last4: string
+  /** Card brand (visa, mastercard, etc.). */
+  brand: string
+  /** Stripe customer id the payment method is attached to. */
+  customerId?: string
+}
+
+/** Asserts the ref has no CHD-shaped fields. Throws if a raw PAN leaks in. */
+export function assertNoChdInRef(ref: unknown): asserts ref is StripePaymentMethodRef {
+  if (ref === null || typeof ref !== 'object') {
+    throw new Error('payment-method ref must be an object')
+  }
+  const r = ref as Record<string, unknown>
+  if (typeof r['paymentMethodId'] !== 'string' || !r['paymentMethodId'].startsWith('pm_')) {
+    throw new Error('paymentMethodId must be a Stripe pm_ token')
+  }
+  for (const forbidden of ['pan', 'cardNumber', 'fullCardNumber', 'cvv', 'cvc', 'pin']) {
+    if (forbidden in r) {
+      throw new Error(`PCI scope violation: ref contains forbidden field '${forbidden}'`)
+    }
+  }
+  if (typeof r['last4'] !== 'string' || r['last4'].length !== 4) {
+    throw new Error('last4 must be a 4-char string')
+  }
+}
+
+/** Build a safe-to-log summary of a payment method reference. */
+export function summarizePaymentMethod(ref: StripePaymentMethodRef): string {
+  return `${ref.brand} ****${ref.last4} (${ref.paymentMethodId})`
+}

package/registry/families/pci-dss-compliance-pack/files/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "declaration": true,
+    "lib": ["ES2022"]
+  },
+  "include": ["src"]
+}

package/registry/families/pci-dss-compliance-pack/files/validate-pci-pack.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+for (const rel of ['src/pan-redact.ts', 'src/tokenize.ts', 'docs/PCI-DSS-controls.md']) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+
+const redact = readFileSync(join(here, 'src/pan-redact.ts'), 'utf8')
+if (!redact.includes('luhnValid')) throw new Error('pan-redact.ts missing Luhn check')
+if (!redact.includes('redactPan')) throw new Error('pan-redact.ts missing redactPan export')
+
+const tokenize = readFileSync(join(here, 'src/tokenize.ts'), 'utf8')
+if (!tokenize.includes('assertNoChdInRef')) throw new Error('tokenize.ts missing assertNoChdInRef')
+if (!tokenize.includes("pm_")) throw new Error('tokenize.ts missing Stripe pm_ token assertion')
+
+console.log('pci-pack ok')

package/registry/families/pci-dss-compliance-pack/manifest.json

@@ -0,0 +1,50 @@
+{
+  "id": "pci-dss-compliance-pack",
+  "description": "PCI DSS 4.0 compliance overlay — cardholder-data tokenization via Stripe, PAN redaction middleware, secure-delete helpers, CHD-scoped audit logs. Composes onto ecommerce-headless / api-service.",
+  "tags": ["compliance", "pci", "pci-dss", "payments"],
+  "taxonomy": { "language": "typescript", "runtime": "node", "surface": "api" },
+  "defaults": { "projectType": "compliance-pack", "serviceName": "starter-foundry-pci-pack" },
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/src/pan-redact.ts", "target": "src/pan-redact.ts" },
+    { "source": "files/src/tokenize.ts", "target": "src/tokenize.ts" },
+    { "source": "files/docs/PCI-DSS-controls.md", "target": "docs/PCI-DSS-controls.md" },
+    { "source": "files/validate-pci-pack.mjs", "target": "validate-pci-pack.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "src/pan-redact.ts" },
+    { "type": "command-success", "command": ["node", "validate-pci-pack.mjs"], "expect": "pci-pack ok" }
+  ],
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm build"],
+    "entrypoints": ["src/pan-redact.ts", "src/tokenize.ts"],
+    "preview": null,
+    "extensionPoints": []
+  },
+  "keywords": ["pci", "pci dss", "pci-dss", "pci compliant", "pan redaction", "cardholder data"],
+  "scoring": { "boost": { "pci dss": 5, "pci compliant": 4 } },
+  "tieredKeywords": {
+    "tier1": ["pci dss", "pci-dss compliant", "pci 4.0", "cardholder data environment"],
+    "tier2": ["pan redaction", "card tokenization", "pci scope"]
+  },
+  "buildHints": {
+    "whenToUse": "Adding PCI DSS 4.0 primitives (CHD tokenization, PAN redaction) to a commerce backend. Reduces SAQ scope when paired with Stripe Checkout.",
+    "firstSteps": [
+      "Use Stripe Checkout or Stripe Elements — CHD never touches your servers. This pack's tokenize.ts wraps Stripe's createPaymentMethod.",
+      "Wire `redactPan()` from `src/pan-redact.ts` onto every log + error tracer. One raw PAN in Sentry = SAQ failure.",
+      "Audit log scope: only CHD-access events go to the PCI audit store; general app audit stays in its own store.",
+      "Never store full PAN, CVV, or PIN. If you need to reference a card, store the Stripe payment_method id (`pm_...`) — it's a token, not CHD."
+    ],
+    "gotchas": [
+      "CVV must NEVER be stored post-authorization — PCI DSS 3.2.1 prohibits it. Even in encrypted form.",
+      "PAN in URL query strings is a violation — always POST.",
+      "Test card numbers in fixtures (e.g. 4242...) still count as CHD in the scope assessment. Quarantine test data.",
+      "Stripe's restricted key patterns: use a restricted key scoped to PaymentIntents only for server-side code; never ship the full secret key.",
+      "DO NOT log request/response bodies on payment endpoints without redaction — the log sink often ingests them unfiltered."
+    ],
+    "placeholders": [
+      { "path": "src/pan-redact.ts", "description": "PAN-redaction regex. Extend for BINs your processor uses outside the standard Luhn range." }
+    ]
+  }
+}

package/registry/families/phaser-game/files/index.html

@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>{{serviceName}}</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; background: #0b0d10; overflow: hidden; }
+      body { display: flex; align-items: center; justify-content: center; }
+      #game { line-height: 0; }
+    </style>
+  </head>
+  <body>
+    <div id="game"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

package/registry/families/phaser-game/files/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "validate": "node validate-phaser.mjs"
+  },
+  "dependencies": {
+    "phaser": "^3.87.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "vite": "^6.4.2"
+  }
+}

package/registry/families/phaser-game/files/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "jsx": "preserve",
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "allowImportingTsExtensions": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src"]
+}

package/registry/families/phaser-game/files/validate-phaser.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// Minimal structural validator for the phaser-game starter.
+// Asserts: package.json has phaser + vite, entrypoints exist, config files present.
+
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+const pkg = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
+if (!pkg.dependencies?.phaser) throw new Error('phaser not in dependencies')
+if (!pkg.devDependencies?.vite) throw new Error('vite not in devDependencies')
+
+for (const rel of ['index.html', 'tsconfig.json', 'vite.config.ts', 'src/main.ts']) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+
+console.log('phaser game starter ok')

package/registry/families/phaser-game/files/vite.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vite'
+
+export default defineConfig({
+  server: {
+    port: 5173,
+    host: true,
+  },
+  build: {
+    target: 'es2022',
+  },
+})

package/registry/families/phaser-game/manifest.json

@@ -0,0 +1,91 @@
+{
+  "id": "phaser-game",
+  "description": "Phaser 3 2D game starter on Vite — arcade physics, one scene, sprite-first game loop with input + update + resize wired from first render.",
+  "tags": ["frontend", "typescript", "phaser", "game", "2d"],
+  "taxonomy": {
+    "language": "typescript",
+    "runtime": "node",
+    "surface": "frontend"
+  },
+  "defaults": {
+    "projectType": "frontend",
+    "serviceName": "starter-foundry-phaser",
+    "port": 5173
+  },
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/vite.config.ts", "target": "vite.config.ts" },
+    { "source": "files/index.html", "target": "index.html" },
+    { "source": "files/validate-phaser.mjs", "target": "validate-phaser.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "index.html" },
+    { "type": "file-exists", "path": "src/main.ts" },
+    { "type": "file-exists", "path": "package.json" },
+    {
+      "type": "command-success",
+      "command": ["node", "validate-phaser.mjs"],
+      "expect": "phaser game starter ok"
+    }
+  ],
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm dev", "pnpm build"],
+    "entrypoints": ["src/main.ts", "src/scenes/MainScene.ts", "index.html"],
+    "preview": { "path": "/" },
+    "extensionPoints": ["src/main.ts", "src/scenes", "public"]
+  },
+  "keywords": [
+    "phaser",
+    "phaser 3",
+    "2d game",
+    "arcade game",
+    "platformer",
+    "sprite",
+    "tilemap",
+    "html5 game"
+  ],
+  "scoring": {
+    "boost": { "phaser": 4 }
+  },
+  "tieredKeywords": {
+    "tier1": ["phaser", "phaser 3", "2d arcade game", "html5 game"],
+    "tier2": ["platformer", "tilemap", "sprite sheet", "shmup", "tower defense"],
+    "archetypes": [
+      "2d platformer",
+      "top-down arcade",
+      "tower defense",
+      "shmup",
+      "endless runner",
+      "match-3 puzzle",
+      "tile-based roguelike",
+      "physics sandbox"
+    ]
+  },
+  "buildHints": {
+    "whenToUse": "2D browser games — platformers, arcade, tower defense, match-3, tile-based roguelikes. Pick this over three.js when the primary surface is a 2D canvas with sprites + physics, not 3D geometry.",
+    "firstSteps": [
+      "Install: `pnpm install` then `pnpm dev` — Vite serves on 5173. The starter shows a bouncing sprite in a single Scene.",
+      "Add new scenes under `src/scenes/` and register them in the `scene` array of the Phaser.Game config in `src/main.ts`.",
+      "Put art assets in `public/assets/` and load them with `this.load.image('key', 'assets/foo.png')` inside a Scene's `preload()`.",
+      "Arcade physics is enabled by default — enable per-body via `this.physics.add.sprite(x, y, key)`.",
+      "Build: `pnpm build` emits static assets to `dist/` — ship to any static host."
+    ],
+    "gotchas": [
+      "`this` inside `preload/create/update` is the Scene, not the Game. If you extract callbacks, bind or use arrow functions — losing `this` silently breaks asset loading.",
+      "Phaser clamps `update(time, delta)` delta — you cannot assume 1/60s between frames on throttled tabs. Always scale movement by `delta / 1000`.",
+      "Sprite textures are cached by key — loading the same key twice is a no-op after the first. Use distinct keys per asset or call `this.textures.remove(key)` before reloading.",
+      "Canvas size is controlled by the Phaser.Game config `scale` property, NOT by CSS. Setting CSS width/height stretches the canvas and breaks pointer coordinates."
+    ],
+    "architectureNotes": [
+      "One Phaser.Game instance per page. Scenes are the unit of composition — add, switch, pause, resume.",
+      "Keep game state in the Scene (or a Scene's Registry); do NOT attach it to window/global. Scene transitions clear local state."
+    ],
+    "placeholders": [
+      {
+        "path": "src/scenes/MainScene.ts",
+        "description": "Default scene with a bouncing sprite + input handler. Replace the sprite + logic with the product's actual game loop; keep the scene lifecycle hooks (preload/create/update)."
+      }
+    ]
+  }
+}

package/registry/families/pixijs-game/files/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>{{serviceName}}</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; background: #0b0d10; overflow: hidden; }
+      canvas { display: block; width: 100vw; height: 100vh; }
+    </style>
+  </head>
+  <body>
+    <canvas id="stage"></canvas>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

package/registry/families/pixijs-game/files/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "validate": "node validate-pixi.mjs"
+  },
+  "dependencies": {
+    "pixi.js": "^8.5.2"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "vite": "^6.4.2"
+  }
+}

package/registry/families/pixijs-game/files/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src"]
+}

package/registry/families/pixijs-game/files/validate-pixi.mjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const pkg = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
+if (!pkg.dependencies?.['pixi.js']) throw new Error('pixi.js not in dependencies')
+if (!pkg.devDependencies?.vite) throw new Error('vite not in devDependencies')
+
+for (const rel of ['index.html', 'tsconfig.json', 'vite.config.ts', 'src/main.ts']) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+console.log('pixi game starter ok')

package/registry/families/pixijs-game/files/vite.config.ts

@@ -0,0 +1,6 @@
+import { defineConfig } from 'vite'
+
+export default defineConfig({
+  server: { port: 5173, host: true },
+  build: { target: 'es2022' },
+})