@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/layers/framework/fintech-ledger-backend/files/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "noEmit": true
+  },
+  "include": ["src/**/*.ts"]
+}

package/registry/layers/framework/fintech-ledger-backend/manifest.json

@@ -0,0 +1,82 @@
+{
+  "id": "fintech-ledger-backend",
+  "description": "Double-entry ledger framework layer — accounts/transactions/entries schema, atomic post_transaction with debit=credit invariant, as-of-timestamp balance query.",
+  "appliesTo": ["fintech-ledger-backend"],
+  "files": [
+    { "source": "files/server.ts", "target": "src/server.ts" },
+    { "source": "files/schema.ts", "target": "src/db/schema.ts" },
+    { "source": "files/db.ts", "target": "src/db/client.ts" },
+    { "source": "files/post.ts", "target": "src/ledger/post.ts" },
+    { "source": "files/ledger/query.ts", "target": "src/ledger/query.ts" },
+    { "source": "files/money.ts", "target": "src/ledger/money.ts" },
+    { "source": "files/transactions-api.ts", "target": "src/api/transactions.ts" },
+    { "source": "files/drizzle.config.ts", "target": "drizzle.config.ts" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" }
+  ],
+  "packageDeps": {
+    "dependencies": {
+      "fastify": "^5.0.0",
+      "drizzle-orm": "^0.36.0",
+      "postgres": "^3.4.5",
+      "decimal.js": "^10.4.3"
+    },
+    "devDependencies": {
+      "drizzle-kit": "^0.30.0",
+      "typescript": "^5.9.0",
+      "@types/node": "^20.17.0"
+    }
+  },
+  "buildHints": {
+    "whenToUse": "When you need a production-grade double-entry ledger API: fintech, accounting, payments reconciliation, or any backend that must track money with strict debit=credit invariants.",
+    "firstSteps": [
+      "Run `pnpm install` then `DATABASE_URL=postgres://user:pass@host/db pnpm dev` — the server listens on PORT (default 3000) with /health, POST /api/transactions, and GET /api/accounts/:id/balance.",
+      "Run `pnpm db:generate && pnpm db:migrate` to create the accounts, transactions, and entries tables in Postgres.",
+      "Seed accounts by inserting rows into the accounts table (code, name, type, currency); then POST /api/transactions with at least two balanced entries (one debit, one credit) to verify the ledger.",
+      "Run `pnpm validate` to confirm all required files exist and the debit=credit invariant is present in the source."
+    ],
+    "gotchas": [
+      "NEVER use JavaScript number (float) for money — 0.1 + 0.2 !== 0.3. All arithmetic goes through decimal.js; amounts stored as NUMERIC(20,4) in Postgres.",
+      "Debit MUST equal credit per transaction, per currency. postTransaction enforces this before and after insert; the DB transaction rolls back on any mismatch.",
+      "Reversing an entry is NOT deleting it — post a new transaction with opposite direction. Audit trail requires immutability.",
+      "Idempotency keys are mandatory on external-facing endpoints; a retried POST without one duplicates the posting.",
+      "Account balance sign depends on type: asset/expense = debits - credits; liability/equity/income = credits - debits. Getting this backward is the #1 accounting bug.",
+      "As-of balance queries filter by posted_at <= asOf, not created_at — backdated corrections are real."
+    ],
+    "architectureNotes": [
+      "Every transaction is N entries where sum(debits) == sum(credits) per currency — enforced in src/ledger/post.ts before and after insert.",
+      "A single DB transaction wraps every posting; partial inserts leave an unbalanced ledger which is a business-critical corruption.",
+      "src/db/schema.ts owns the Drizzle table definitions; src/ledger/post.ts owns the invariant; src/ledger/query.ts owns balance semantics."
+    ],
+    "placeholders": [
+      {
+        "path": "src/server.ts",
+        "description": "Minimal http.createServer router. Wire in authentication middleware and rate-limiting before exposing to the internet."
+      },
+      {
+        "path": "src/db/client.ts",
+        "description": "Postgres connection using DATABASE_URL env var. Adjust pool size (max) for your expected concurrency."
+      }
+    ]
+  },
+  "contextHints": {
+    "commands": [
+      "pnpm install",
+      "DATABASE_URL=postgres://user:pass@host/db PORT=3000 HOST=0.0.0.0 pnpm dev",
+      "pnpm db:generate",
+      "pnpm db:migrate",
+      "pnpm validate"
+    ],
+    "entrypoints": [
+      "src/server.ts",
+      "src/db/schema.ts",
+      "src/ledger/post.ts",
+      "src/ledger/query.ts"
+    ],
+    "preview": { "path": "/health" },
+    "extensionPoints": [
+      "src/db/schema.ts",
+      "src/ledger/",
+      "src/api/"
+    ]
+  }
+}

package/registry/layers/framework/flutter-app/files/main.dart

@@ -0,0 +1,189 @@
+import 'package:dio/dio.dart';
+import 'package:flutter/material.dart';
+import 'package:go_router/go_router.dart';
+import 'package:provider/provider.dart';
+
+void main() {
+  runApp(const StarterFoundryApp());
+}
+
+/// App-wide session state. Swap for Riverpod / BLoC as product complexity
+/// grows; Provider keeps the surface small for the starter.
+class SessionModel extends ChangeNotifier {
+  bool _authenticated = false;
+  String? _userEmail;
+
+  bool get authenticated => _authenticated;
+  String? get userEmail => _userEmail;
+
+  void signIn(String email) {
+    _authenticated = true;
+    _userEmail = email;
+    notifyListeners();
+  }
+
+  void signOut() {
+    _authenticated = false;
+    _userEmail = null;
+    notifyListeners();
+  }
+}
+
+/// HTTP client surface. Auth-refresh + logging interceptors plug in here.
+class ApiClient {
+  ApiClient({String baseUrl = 'https://api.example.com'})
+      : _dio = Dio(BaseOptions(baseUrl: baseUrl, connectTimeout: const Duration(seconds: 10)));
+
+  final Dio _dio;
+
+  Future<Map<String, dynamic>> health() async {
+    final response = await _dio.get<Map<String, dynamic>>('/health');
+    return response.data ?? <String, dynamic>{};
+  }
+}
+
+final GoRouter _router = GoRouter(
+  initialLocation: '/',
+  routes: <RouteBase>[
+    GoRoute(
+      path: '/',
+      builder: (BuildContext context, GoRouterState state) => const HomeScreen(),
+    ),
+    GoRoute(
+      path: '/auth',
+      builder: (BuildContext context, GoRouterState state) => const AuthScreen(),
+    ),
+    GoRoute(
+      path: '/billing',
+      builder: (BuildContext context, GoRouterState state) => const BillingScreen(),
+    ),
+  ],
+);
+
+class StarterFoundryApp extends StatelessWidget {
+  const StarterFoundryApp({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return MultiProvider(
+      providers: [
+        ChangeNotifierProvider<SessionModel>(create: (_) => SessionModel()),
+        Provider<ApiClient>(create: (_) => ApiClient()),
+      ],
+      child: MaterialApp.router(
+        title: '{{projectName}}',
+        theme: ThemeData(
+          colorScheme: ColorScheme.fromSeed(seedColor: const Color(0xFF4F46E5)),
+          useMaterial3: true,
+        ),
+        routerConfig: _router,
+      ),
+    );
+  }
+}
+
+class HomeScreen extends StatelessWidget {
+  const HomeScreen({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    final SessionModel session = context.watch<SessionModel>();
+    return Scaffold(
+      appBar: AppBar(title: const Text('{{headline}}')),
+      body: SafeArea(
+        child: Padding(
+          padding: const EdgeInsets.all(24.0),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.stretch,
+            children: <Widget>[
+              Text(
+                '{{subheadline}}',
+                style: Theme.of(context).textTheme.titleMedium,
+              ),
+              const SizedBox(height: 24),
+              _SectionCard(
+                title: 'Auth',
+                body: session.authenticated
+                    ? 'Signed in as ${session.userEmail ?? 'unknown'}'
+                    : 'Wire sign-in + account recovery at lib/services/auth.',
+                onTap: () => context.go('/auth'),
+              ),
+              const SizedBox(height: 12),
+              _SectionCard(
+                title: 'Billing',
+                body: 'Attach premium purchase / subscription flows.',
+                onTap: () => context.go('/billing'),
+              ),
+              const SizedBox(height: 12),
+              const _SectionCard(
+                title: 'Wallet',
+                body: 'Connect a mobile wallet or partner SDK here.',
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
+
+class AuthScreen extends StatelessWidget {
+  const AuthScreen({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(title: const Text('Sign in')),
+      body: Center(
+        child: FilledButton(
+          onPressed: () {
+            context.read<SessionModel>().signIn('demo@{{packageName}}.app');
+            context.go('/');
+          },
+          child: const Text('Demo sign in'),
+        ),
+      ),
+    );
+  }
+}
+
+class BillingScreen extends StatelessWidget {
+  const BillingScreen({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(title: const Text('Billing')),
+      body: const Center(child: Text('Payments slot renders here.')),
+    );
+  }
+}
+
+class _SectionCard extends StatelessWidget {
+  const _SectionCard({required this.title, required this.body, this.onTap});
+
+  final String title;
+  final String body;
+  final VoidCallback? onTap;
+
+  @override
+  Widget build(BuildContext context) {
+    return Card(
+      clipBehavior: Clip.antiAlias,
+      child: InkWell(
+        onTap: onTap,
+        child: Padding(
+          padding: const EdgeInsets.all(16.0),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: <Widget>[
+              Text(title, style: Theme.of(context).textTheme.titleMedium),
+              const SizedBox(height: 6),
+              Text(body, style: Theme.of(context).textTheme.bodyMedium),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}

package/registry/layers/framework/flutter-app/manifest.json

@@ -0,0 +1,15 @@
+{
+  "id": "flutter-app",
+  "description": "Flutter + Dart framework layer — main.dart with MaterialApp.router, GoRouter, Provider, and an example home screen.",
+  "appliesTo": ["flutter-app"],
+  "defaults": {
+    "headline": "Starter Foundry Flutter App",
+    "subheadline": "A Flutter mobile shell with GoRouter, Provider, and Dio wired for auth, billing, and wallet seams."
+  },
+  "files": [
+    {
+      "source": "files/main.dart",
+      "target": "lib/main.dart"
+    }
+  ]
+}

package/registry/layers/framework/forge-foundation/files/foundry.toml

@@ -7,21 +7,10 @@ script = "script"
 solc_version = "0.8.28"
 optimizer = true
 optimizer_runs = 200
-via_ir = false
-auto_detect_solc = false
-fs_permissions = [{ access = "read-write", path = "./" }]
-gas_reports = ["*"]
-verbosity = 2
 
-[profile.ci]
-verbosity = 4
-fuzz = { runs = 1000 }
-invariant = { runs = 256 }
-
-[fmt]
-line_length = 100
-tab_width = 4
-bracket_spacing = false
-int_types = "long"
+remappings = [
+  "@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/",
+  "forge-std/=lib/forge-std/src/"
+]
 
 # See more at https://book.getfoundry.sh/reference/config/overview

package/registry/layers/framework/fraud-ops-console/manifest.json

@@ -0,0 +1,8 @@
+{
+  "id": "fraud-ops-console",
+  "description": "node framework layer for fraud-ops-console.",
+  "appliesTo": [
+    "fraud-ops-console"
+  ],
+  "files": []
+}

package/registry/layers/framework/gdpr-compliance-pack/files/AGENTS.md

@@ -0,0 +1,40 @@
+# GDPR Compliance Pack — Agent Guide
+
+## What this pack provides
+
+Four TypeScript modules + one React component implementing the core GDPR / CPRA obligations:
+
+| File | Purpose |
+|------|---------|
+| `src/consent.ts` | Art. 4(11) consent primitives — `ConsentRecord`, `InMemoryConsentStore`, `validateConsentRequest` |
+| `src/data-subject-rights.ts` | Art. 15 export (`collectExport`) + Art. 17 erasure (`honorErasure`) with documented exceptions |
+| `src/data-inventory.ts` | Art. 30 Record of Processing Activities (RoPA) — `EXAMPLE_ROPA`, `validateRoPA` |
+| `src/components/CookieBanner.tsx` | GDPR-compliant cookie banner — consent BEFORE non-essential cookies, opt-in only |
+| `docs/GDPR-controls.md` | Article-by-article control mapping |
+| `docs/DPIA-template.md` | Art. 35 Data Protection Impact Assessment template |
+
+## First steps after `pnpm install`
+
+1. **Run `pnpm validate`** — confirms all required files and key exports are present.
+2. **Run `pnpm build`** — `tsc --noEmit` typechecks the full pack; zero errors expected.
+3. **Wire consent store** — replace `InMemoryConsentStore` with a DB-backed implementation before production.
+4. **Mount API routes** in your framework:
+   - `POST /api/consent` → `validateConsentRequest` + `store.record(...)`
+   - `GET  /api/export-my-data` → `collectExport(userId, collectors)` — must respond within 30 days (Art. 12(3))
+   - `POST /api/delete-my-data` → `honorErasure(request, erasers, retentionChecks)`
+5. **Drop `<CookieBanner>`** at root layout — pass `policyVersion` matching your privacy notice version so the banner re-surfaces on policy changes.
+6. **Extend `EXAMPLE_ROPA`** in `src/data-inventory.ts` with your actual data categories, legal bases, and retention periods.
+
+## Key invariants (do not break)
+
+- Consent must be **affirmative** — pre-ticked boxes are invalid (Art. 4(11)). `validateConsentRequest` enforces this.
+- `honorErasure` checks `retentionChecks` before erasing — pass all Art. 17(3) exception checkers here.
+- `collectExport` fans out to per-category collectors and wraps errors in `{ __error }` rather than failing the whole export.
+- `CookieBanner` reads `localStorage` for prior consent; it re-shows if `policyVersion` changes.
+
+## Validation
+
+```bash
+pnpm validate   # node validate-gdpr-pack.mjs → "gdpr-pack ok"
+pnpm build      # tsc --noEmit → exit 0
+```

package/registry/layers/framework/gdpr-compliance-pack/files/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "gdpr-compliance-pack",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "validate": "node validate-gdpr-pack.mjs"
+  },
+  "dependencies": {
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "typescript": "^5.9.0"
+  }
+}

package/registry/layers/framework/gdpr-compliance-pack/files/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "lib": ["ES2022", "DOM"]
+  },
+  "include": ["src"]
+}

package/registry/layers/framework/gdpr-compliance-pack/manifest.json

@@ -0,0 +1,60 @@
+{
+  "id": "gdpr-compliance-pack",
+  "description": "GDPR + CPRA compliance layer — consent capture, data subject rights (export/erase), cookie banner, and Record of Processing Activities. Composes onto fullstack-ts / nextjs-ts / ecommerce-headless.",
+  "appliesTo": ["gdpr-compliance-pack"],
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/AGENTS.md", "target": "AGENTS.md" }
+  ],
+  "packageDeps": {
+    "dependencies": {
+      "react": "^18.3.1",
+      "react-dom": "^18.3.1"
+    },
+    "devDependencies": {
+      "@types/node": "^22.0.0",
+      "@types/react": "^18.3.0",
+      "@types/react-dom": "^18.3.0",
+      "typescript": "^5.9.0"
+    }
+  },
+  "buildHints": {
+    "whenToUse": "Shipping to EU / CA / other jurisdictions with data-subject rights obligations. Bolt onto an existing fullstack/api backend.",
+    "firstSteps": [
+      "Run `pnpm validate` — confirms required files and key exports are present.",
+      "Run `pnpm build` — `tsc --noEmit` typechecks the full pack; zero errors expected.",
+      "Extend `EXAMPLE_ROPA` in `src/data-inventory.ts` with your actual data categories, legal bases, and retention periods.",
+      "Wire `/api/export-my-data` using `collectExport` from `src/data-subject-rights.ts` — must respond within 30 days per Art. 12(3).",
+      "Wire `/api/delete-my-data` using `honorErasure` — must honor erasure within 30 days unless an Art. 17(3) exception applies.",
+      "Drop `<CookieBanner>` at the root layout — consent MUST be gathered BEFORE setting any non-essential cookies.",
+      "Fill out `docs/DPIA-template.md` if you process high-risk categories (Art. 35)."
+    ],
+    "gotchas": [
+      "'Consent' as a legal basis has SIX requirements per Art. 4(11) — freely given, specific, informed, unambiguous, affirmative, withdrawable. Pre-ticked boxes are invalid.",
+      "Legitimate interest (Art. 6(1)(f)) is often a better basis than consent for operational processing — but requires a documented LIA (Legitimate Interest Assessment).",
+      "Right-to-delete is NOT absolute. Exceptions: legal obligation, public interest, establishment of legal claims (Art. 17(3)). Document which exception applies when refusing.",
+      "Data breaches must be reported to the supervisory authority within 72 HOURS per Art. 33.",
+      "CPRA (California) has parallel but not identical rules — this pack covers the shared 80%; add CPRA-specific flows as needed."
+    ],
+    "architectureNotes": [
+      "Replace `InMemoryConsentStore` with a DB-backed implementation before production — the in-memory store does not survive restarts.",
+      "`collectExport` fans out to per-category collectors; each collector returns its slice of the user's data. Add one collector per table/service that holds PII.",
+      "`honorErasure` runs `retentionChecks` before any erasers — pass all Art. 17(3) exception checkers there so refusals are documented before data is touched."
+    ],
+    "placeholders": [
+      { "path": "src/data-inventory.ts", "description": "RoPA seed (`EXAMPLE_ROPA`). Extend with your actual data categories, legal bases, and retention periods." },
+      { "path": "docs/DPIA-template.md", "description": "DPIA template. Fill before processing high-risk categories (Art. 35)." }
+    ]
+  },
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm build", "pnpm validate"],
+    "entrypoints": ["src/consent.ts", "src/data-subject-rights.ts", "src/data-inventory.ts"],
+    "preview": null,
+    "extensionPoints": [
+      "src/data-inventory.ts",
+      "src/consent.ts",
+      "src/components/CookieBanner.tsx"
+    ]
+  }
+}

package/registry/layers/framework/godot-web/files/export_presets.cfg

@@ -0,0 +1,5 @@
+[preset.0]
+name="Web"
+platform="Web"
+runnable=true
+export_path="export/web/index.html"

package/registry/layers/framework/godot-web/files/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "godot-web-starter",
+  "version": "0.1.0",
+  "description": "Godot 4 web export starter scaffold",
+  "private": true,
+  "scripts": {
+    "typecheck": "tsc",
+    "build": "echo 'Run: godot --headless --export-release Web exports/web/index.html'",
+    "dev": "npx serve exports/web"
+  },
+  "devDependencies": {
+    "serve": "^14.2.0",
+    "typescript": "^5.4.0"
+  }
+}

package/registry/layers/framework/godot-web/files/project.godot

@@ -0,0 +1,5 @@
+; Engine configuration file.
+[gd_resource type="ProjectSettings" format=3]
+[application]
+config/name="GodotWebStarter"
+config/features=PackedStringArray("4.2", "Web")

package/registry/layers/framework/godot-web/files/scenes/main.tscn

@@ -0,0 +1,19 @@
+[gd_scene load_steps=3 format=3 uid="uid://c5starter0foundry"]
+
+[ext_resource type="Script" path="res://scripts/main.gd" id="1_main"]
+[ext_resource type="Texture2D" path="res://icon.svg" id="2_icon"]
+
+[node name="Main" type="Node2D"]
+script = ExtResource("1_main")
+
+[node name="Sprite2D" type="Sprite2D" parent="."]
+position = Vector2(576, 324)
+texture = ExtResource("2_icon")
+
+[node name="Label" type="Label" parent="."]
+offset_left = 32.0
+offset_top = 32.0
+offset_right = 1120.0
+offset_bottom = 72.0
+text = "godot-web starter — press F5 in the editor, or export via Project → Export → Web."
+horizontal_alignment = 1

package/registry/layers/framework/godot-web/files/scripts/main.gd

@@ -0,0 +1,29 @@
+extends Node2D
+
+# Main scene root. _ready runs once when the scene enters the tree;
+# _process runs every frame with the frame delta. Replace the body of
+# both with real game logic as the project grows.
+
+@onready var _sprite: Sprite2D = $Sprite2D
+@onready var _label: Label = $Label
+
+var _elapsed: float = 0.0
+
+func _ready() -> void:
+	# Surface engine + renderer info so web exports are diagnosable when
+	# something blanks out. Log shows up in the browser devtools console.
+	var version := Engine.get_version_info()
+	var renderer := RenderingServer.get_rendering_device() != null
+	print("godot-web ready · %s · rendering_device=%s" % [version.string, renderer])
+
+	# On web, a SharedArrayBuffer failure presents as everything loading
+	# but no rendering happening. If that's the symptom, check COOP/COEP
+	# headers on the serving host.
+
+func _process(delta: float) -> void:
+	_elapsed += delta
+	# Gentle spin so the scene is visibly alive.
+	_sprite.rotation = _elapsed * 0.6
+	# Breathe the scale between 0.9x and 1.1x.
+	var s := 1.0 + sin(_elapsed * 2.0) * 0.1
+	_sprite.scale = Vector2(s, s)

package/registry/layers/framework/godot-web/files/src/main.ts

@@ -0,0 +1,2 @@
+// Godot Web Export entry — loaded after Godot engine initializes
+export {};

package/registry/layers/framework/godot-web/files/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "noEmit": true,
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2020", "DOM"]
+  },
+  "include": ["src/**/*"]
+}

package/registry/layers/framework/godot-web/manifest.json

@@ -0,0 +1,62 @@
+{
+  "id": "godot-web",
+  "description": "Godot 4.3 HTML5 framework layer — main scene (Node2D + Sprite2D + Label) with a typed GDScript driving _ready diagnostics and a _process animation loop. Composes with the godot-web family to form a complete web-export scaffold.",
+  "appliesTo": ["godot-web"],
+  "files": [
+    { "source": "files/scenes/main.tscn", "target": "scenes/main.tscn" },
+    { "source": "files/scripts/main.gd", "target": "scripts/main.gd" },
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/src/main.ts", "target": "src/main.ts" },
+    { "source": "files/exports/web/.gitkeep", "target": "exports/web/.gitkeep" }
+  ],
+  "packageDeps": {
+    "devDependencies": {
+      "serve": "^14.2.0",
+      "typescript": "^5.4.0"
+    }
+  },
+  "buildHints": {
+    "whenToUse": "Any project using the godot-web family. This layer supplies the scene and script that project.godot points at as the main scene — without it the project opens to an empty editor with no runnable scene.",
+    "firstSteps": [
+      "After composing, open the project: `godot --editor .` from the project root. The editor resolves scenes/main.tscn and scripts/main.gd automatically.",
+      "Press F5 (or the Play button) to run in the editor — the sprite spins and the label shows the Godot version string.",
+      "Validate the file structure without Godot: `node validate-godot-web.mjs` — should print `godot-web starter ok`.",
+      "Export for the web: Project → Export → select Web → Export Project. Output lands in exports/web/ as index.html + index.js + index.wasm + index.pck.",
+      "Serve exports/web/ with any static host. Browsers require COOP/COEP headers (see gotchas) — use `npx serve exports/web` for local preview."
+    ],
+    "gotchas": [
+      "Godot 4 HTML5 builds require SharedArrayBuffer. Browsers only expose it when the page is served with `Cross-Origin-Opener-Policy: same-origin` AND `Cross-Origin-Embedder-Policy: require-corp`. Without these headers the canvas stays blank — configure your static host to emit them for the exports/web/ directory.",
+      "The @onready annotations in main.gd resolve at scene-tree entry. If you reparent or free Sprite2D or Label before _ready fires, the @onready vars will be null and _process will crash. Always modify the scene tree after super._ready() when overriding in subclasses.",
+      "The uid on the [gd_scene] header (`uid://c5starter0foundry`) is a stable placeholder. Godot will replace it with a generated UID the first time you save the scene in the editor — that change is safe to commit.",
+      "Do not commit the .godot/ directory — it is editor-generated cache. The family-supplied .gitignore already excludes it."
+    ],
+    "architectureNotes": [
+      "This layer provides exactly one scene (scenes/main.tscn) and one script (scripts/main.gd). For real projects, add scenes as sibling files and instance them into main.tscn; don't grow main.tscn into a monolith.",
+      "main.gd uses static typing (@onready var _sprite: Sprite2D). Keep types explicit — GDScript's static analyser catches type errors at editor load rather than at runtime.",
+      "The _process loop mutates sprite transform only. Keep heavy work (file I/O, network, heavy math) out of _process; use async signals or threads instead."
+    ],
+    "placeholders": [
+      {
+        "path": "scenes/main.tscn",
+        "description": "Bootstrap scene with Node2D root, centred Sprite2D using the default icon, and a Label. Replace with your real game scene; keep the top-level Node2D if scripts/main.gd remains attached to the root."
+      },
+      {
+        "path": "scripts/main.gd",
+        "description": "GDScript attached to the Node2D root — _ready logs engine version and rendering device, _process rotates the sprite. Replace _process body with real input handling and game-loop logic; preserve _ready for diagnostics."
+      }
+    ]
+  },
+  "contextHints": {
+    "commands": [
+      "pnpm install",
+      "pnpm typecheck",
+      "godot --editor .",
+      "node validate-godot-web.mjs",
+      "godot --headless --export-release 'Web' exports/web/index.html"
+    ],
+    "entrypoints": ["scenes/main.tscn", "scripts/main.gd"],
+    "preview": { "path": "/" },
+    "extensionPoints": ["scenes/main.tscn", "scripts/main.gd"]
+  }
+}

package/registry/layers/framework/healthcare-hipaa-backend/files/db.ts

@@ -0,0 +1,13 @@
+import postgres from 'postgres'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import * as schema from './schema.ts'
+
+const url = process.env.DATABASE_URL
+if (!url) {
+  throw new Error('DATABASE_URL is required (postgres://user:pass@host/db)')
+}
+
+// ssl: 'require' is intentional — PHI in flight MUST be over TLS, even
+// to a same-VPC Postgres. Downgrading this is a HIPAA compliance issue.
+const client = postgres(url, { ssl: 'require', max: 10 })
+export const db = drizzle(client, { schema })