create-keboola-app 0.0.0

package/dist/extract.js

@@ -0,0 +1,133 @@
+import { a as isBlockId, i as SHELL_FILES, n as BLOCK_IDS, r as NOT_IN_TEMPLATE, t as BLOCKS } from "./blocks-DYU5Ke29.js";
+import { i as renderRegions, r as blockIdOf } from "./regions-B3r5LhXl.js";
+import { r as scan, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
+import { cpSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/extract.ts
+/** The scripts the emitted app keeps, keyed the way its `package.json` will hold them. */
+const APP_SCRIPTS = {
+	build: "vite build",
+	dev: "vite",
+	lint: "oxfmt --check && oxlint .",
+	"lint:fix": "oxlint --fix . && oxfmt",
+	test: "vitest run",
+	"type-check": "tsc"
+};
+const DROPPED_DEPS = /* @__PURE__ */ new Set(["@keboola/ui-gen-bench"]);
+const TEMPLATE_DOCS = [
+	"README.md",
+	"AGENTS.md",
+	"_gitignore",
+	"_env.example",
+	"_oxfmtrc.json"
+];
+/** Every workspace package's published version, by name. */
+const workspaceVersions = (packagesDir) => new Map(readdirSync(packagesDir).flatMap((entry) => {
+	let manifest;
+	try {
+		manifest = JSON.parse(readFileSync(join(packagesDir, entry, "package.json"), "utf8"));
+	} catch {
+		return [];
+	}
+	const { name, version } = manifest;
+	return name !== void 0 && version !== void 0 ? [[name, version]] : [];
+}));
+/**
+* The decision applied to every region while extracting.
+*
+* - `internal` is dropped: it is the marker for text that is true in the monorepo only.
+* - `block:<id>` is kept **with** its markers — the CLI decides per scaffold.
+* - Anything else throws, so a typo in a marker fails the build instead of shipping a region
+*   nobody will ever keep.
+*/
+const decideRegion = (regionId) => {
+	if (regionId === "internal") return "drop";
+	const id = blockIdOf(regionId);
+	if (id === null || !isBlockId(id)) throw new Error(`unknown region id "${regionId}" — expected "internal" or "block:<blockId>"`);
+	return "keep-with-markers";
+};
+/** Per-file rewrites that turn boilerplate identity into placeholders. */
+const parameterise = (file, text) => {
+	if (file === "index.html") return text.replace(/<title>[^<]*<\/title>/, "<title>__APP_TITLE__</title>");
+	if (file === "src/store.ts") return text.replaceAll(/'boilerplate\/([^']+)'/g, "'__APP_NAME__/$1'");
+	return text;
+};
+const emittedManifest = (boilerplateDir, versions) => {
+	const { dependencies, devDependencies } = JSON.parse(readFileSync(join(boilerplateDir, "package.json"), "utf8"));
+	const workspaceDeps = [];
+	const resolve = (group) => Object.fromEntries(Object.entries(group).filter(([name]) => !DROPPED_DEPS.has(name)).map(([name, range]) => {
+		if (!range.startsWith("workspace:")) return [name, range];
+		const version = versions.get(name);
+		if (version === void 0) throw new Error(`${name} is a workspace dependency with no version on disk`);
+		workspaceDeps.push(name);
+		return [name, `^${version}`];
+	}).sort(([a], [b]) => a.localeCompare(b)));
+	return {
+		manifest: {
+			name: "__APP_NAME__",
+			version: "0.1.0",
+			private: true,
+			type: "module",
+			engines: { node: ">=22.12" },
+			scripts: APP_SCRIPTS,
+			dependencies: resolve(dependencies),
+			devDependencies: resolve(devDependencies)
+		},
+		workspaceDeps: [...new Set(workspaceDeps)].sort()
+	};
+};
+const extractTemplate = (opts) => {
+	const { boilerplateDir, packagesDir, templatesDir, outDir } = opts;
+	const sources = [...SHELL_FILES, ...BLOCK_IDS.flatMap((id) => BLOCKS[id].files)].filter((file) => !NOT_IN_TEMPLATE.includes(file) && file !== "package.json").sort();
+	rmSync(outDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(outDir, { recursive: true });
+	const written = [];
+	for (const file of sources) {
+		const from = join(boilerplateDir, file);
+		const to = join(outDir, file);
+		mkdirSync(dirname(to), { recursive: true });
+		const buffer = readFileSync(from);
+		if (buffer.subarray(0, 8e3).includes(0)) cpSync(from, to);
+		else writeFileSync(to, parameterise(file, renderRegions(buffer.toString("utf8"), decideRegion)));
+		written.push(file);
+	}
+	for (const doc of TEMPLATE_DOCS) {
+		const text = readFileSync(join(templatesDir, doc), "utf8");
+		writeFileSync(join(outDir, doc), renderRegions(text, decideRegion));
+		written.push(doc);
+	}
+	const { manifest, workspaceDeps } = emittedManifest(boilerplateDir, workspaceVersions(packagesDir));
+	writeFileSync(join(outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+	written.push("package.json");
+	writeFileSync(join(outDir, "workspace-deps.json"), `${JSON.stringify(workspaceDeps, null, 2)}\n`);
+	written.push("workspace-deps.json");
+	return {
+		files: written.sort(),
+		workspaceDeps
+	};
+};
+const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
+const main = () => {
+	const outDir = fileURLToPath(new URL("../dist/template/", import.meta.url));
+	const { files, workspaceDeps } = extractTemplate({
+		boilerplateDir: join(REPO_ROOT, "apps", "boilerplate"),
+		packagesDir: join(REPO_ROOT, "packages"),
+		templatesDir: fileURLToPath(new URL("../templates/", import.meta.url)),
+		outDir
+	});
+	const findings = scan(outDir);
+	if (findings.length > 0) {
+		console.error(`✗ ${findings.length} sanitize finding(s) in the extracted template:`);
+		console.error(formatFindings(findings));
+		console.error("  Wrap the text in an `internal` region, or replace it.");
+		process.exit(1);
+	}
+	console.log(`✓ extracted ${files.length} files into dist/template (${workspaceDeps.length} @keboola deps pinned to published ranges)`);
+};
+if (process.argv[1]?.endsWith("extract.js") === true) main();
+//#endregion
+export { extractTemplate };

package/dist/regions-B3r5LhXl.js

@@ -0,0 +1,95 @@
+//#region src/regions.ts
+const MARKER = String.raw`#(region|endregion)\s+(\S+)`;
+new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)#region\s+(\S+)`);
+const MARKER_LINE_RE = new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)${MARKER}`);
+/**
+* The block name in a region id, or `null` for any other shape.
+*
+* - Only an exact `block:<name>` matches. `block:kpi:extra` is a typo, not the `kpi` block —
+*   resolving it to the block whose name it happens to start with would let a malformed
+*   marker decide a real region, which is how a marker leaks into an emitted app.
+* - `internal` and every other id are the caller's business; this answers one question.
+*/
+const blockIdOf = (regionId) => /^block:([^:\s]+)$/.exec(regionId)?.[1] ?? null;
+const markerOf = (line) => {
+	const match = MARKER_LINE_RE.exec(line);
+	if (!match) return null;
+	const [, kind, id] = match;
+	if (kind !== "region" && kind !== "endregion") return null;
+	return {
+		kind,
+		id: id ?? ""
+	};
+};
+/**
+* Removes the blank-line debris a dropped region leaves.
+*
+* - Runs of two or more blank lines collapse to one: dropping an import region between two
+*   groups otherwise leaves a double gap, and the emitted app's `oxfmt --check` fails on it.
+* - A leading blank line is dropped for the same reason.
+*/
+const tidy = (lines) => {
+	const out = [];
+	for (const line of lines) {
+		if (line.trim() === "" && (out.length === 0 || out.at(-1)?.trim() === "")) continue;
+		out.push(line);
+	}
+	return out;
+};
+const renderRegions = (source, decide) => {
+	const lines = source.split("\n");
+	const out = [];
+	let open = null;
+	for (const line of lines) {
+		const marker = markerOf(line);
+		if (marker?.kind === "region") {
+			if (open) throw new Error(`nested region "${marker.id}" inside "${open.id}"`);
+			const decision = decide(marker.id);
+			open = {
+				id: marker.id,
+				decision
+			};
+			if (decision === "keep-with-markers") out.push(line);
+			continue;
+		}
+		if (marker?.kind === "endregion") {
+			if (!open) throw new Error(`#endregion "${marker.id}" with no open region`);
+			if (open.id !== marker.id) throw new Error(`#endregion closes "${marker.id}" while "${open.id}" is open`);
+			if (open.decision === "keep-with-markers") out.push(line);
+			open = null;
+			continue;
+		}
+		if (open?.decision === "drop") continue;
+		out.push(line);
+	}
+	if (open) throw new Error(`unclosed region "${open.id}"`);
+	return tidy(out).join("\n");
+};
+/**
+* Any marker, in any dialect, anywhere on a line.
+*
+* - Deliberately looser than `markerOf`: this is the containment check, so an *unrecognised*
+*   marker — misspelt dialect, indented into a continuation line, left inside a string — has to
+*   match too. `markerOf` would skip exactly those and let them through.
+*/
+const MARKER_RE = /#(?:region|endregion)\b/;
+/**
+* Fails when rendered text still carries a marker.
+*
+* - The invariant: no `#region block:` may reach an emitted app. Markers are a build-time
+*   mechanism, and one surviving into generated source is how that mechanism fails silently —
+*   the app compiles, the region is dead text, and nobody finds out until a reader asks.
+* - Called on every file the scaffolder writes, so a stray, mis-nested or unknown-block marker
+*   aborts the scaffold instead of shipping.
+* - Not called on the extract's output: that keeps its markers on purpose, for the CLI to
+*   decide per scaffold.
+*/
+const assertNoMarkers = (file, text) => {
+	const line = text.split("\n").findIndex((candidate) => MARKER_RE.test(candidate));
+	if (line === -1) return;
+	throw new Error(`${file}:${line + 1} still carries a region marker after rendering — no "#region" may reach an emitted app.`);
+};
+/** Replaces `__KEY__` with `vars[KEY]`. An unlisted placeholder is left in place. */
+const substitute = (source, vars) => Object.entries(vars).reduce((acc, [key, value]) => acc.replaceAll(`__${key}__`, value), source);
+//#endregion
+export { substitute as a, renderRegions as i, assertNoMarkers as n, blockIdOf as r, MARKER_RE as t };

package/dist/sanitize-CKs8pAzZ.js

@@ -0,0 +1,158 @@
+import { t as MARKER_RE } from "./regions-B3r5LhXl.js";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/sanitize.ts
+const PATTERNS_PATH = fileURLToPath(new URL("../sanitize-patterns.json", import.meta.url));
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".turbo",
+	".git"
+]);
+/**
+* The pattern table, compiled.
+*
+* - Read from JSON on purpose: the table is not in `files[]`, so no published copy of this
+*   scanner carries the patterns it looks for.
+* - Absent means the caller is running from an installed package, which the gates never do.
+*/
+const loadPatterns = () => {
+	let raw;
+	try {
+		raw = readFileSync(PATTERNS_PATH, "utf8");
+	} catch (error) {
+		throw new Error(`sanitize-patterns.json not found at ${PATTERNS_PATH} — the sanitize scan runs only inside the repo checkout (${String(error)})`);
+	}
+	return JSON.parse(raw).patterns.map((row) => ({
+		name: row.name,
+		regex: new RegExp(row.pattern, row.flags),
+		why: row.why,
+		hits: row.hits,
+		misses: row.misses
+	}));
+};
+/** Every pattern's first match on every line of `text`. */
+const scanText = (patterns, file, text) => {
+	const findings = [];
+	text.split("\n").forEach((line, index) => {
+		for (const pattern of patterns) {
+			const match = pattern.regex.exec(line);
+			if (!match) continue;
+			findings.push({
+				file,
+				line: index + 1,
+				pattern: pattern.name,
+				match: match[0],
+				why: pattern.why
+			});
+		}
+	});
+	return findings;
+};
+const isBinary = (buffer) => buffer.subarray(0, 8e3).includes(0);
+const walk = (root, dir, out) => {
+	for (const entry of readdirSync(dir)) {
+		if (SKIP_DIRS.has(entry)) continue;
+		const path = join(dir, entry);
+		if (statSync(path).isDirectory()) walk(root, path, out);
+		else out.push(relative(root, path).split(sep).join("/"));
+	}
+};
+/** Scans every text file under `root`, reporting paths relative to it. */
+const scanTree = (root, patterns = loadPatterns()) => {
+	const files = [];
+	walk(root, root, files);
+	return files.flatMap((file) => {
+		const buffer = readFileSync(join(root, file));
+		if (isBinary(buffer)) return [];
+		return scanText(patterns, file, buffer.toString("utf8"));
+	});
+};
+/**
+* Structural check on every `package.json` under `root`: no dependency may keep pnpm's
+* `workspace:` protocol.
+*
+* - Parsed rather than grepped, so the rule is about specifiers and not about the string
+*   appearing anywhere in a file. The CLI legitimately holds that literal for `--workspace`.
+*/
+const scanManifests = (root) => {
+	const files = [];
+	walk(root, root, files);
+	const groups = [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies",
+		"optionalDependencies"
+	];
+	return files.filter((file) => file === "package.json" || file.endsWith("/package.json")).flatMap((file) => {
+		const manifest = JSON.parse(readFileSync(join(root, file), "utf8"));
+		return groups.flatMap((group) => {
+			const deps = Reflect.get(manifest, group);
+			if (typeof deps !== "object" || deps === null) return [];
+			return Object.entries(deps).filter(([, range]) => typeof range === "string" && range.startsWith("workspace:")).map(([name, range]) => ({
+				file,
+				line: 1,
+				pattern: "workspace-specifier",
+				match: `${name}: ${String(range)}`,
+				why: "A workspace: specifier cannot resolve outside the monorepo — the emitted manifest must carry a published range."
+			}));
+		});
+	});
+};
+const scan = (root) => [...scanTree(root), ...scanManifests(root)];
+/**
+* Region markers surviving into emitted source.
+*
+* - Separate from `scan`, and never part of it: the tarball's own `dist/template/` carries
+*   markers on purpose, so a pattern-table rule for them would fail every run.
+* - Run against an **emitted app** instead — the one place the invariant applies. A marker
+*   there is dead text that compiles, which is how the mechanism fails without telling anyone.
+* - `assertNoMarkers` already aborts a scaffold in-process; this is the same rule applied to
+*   output on disk, so the gates can prove it about a real `pnpm pack` → scaffold run rather
+*   than trusting the code path.
+*/
+const scanMarkers = (root) => {
+	const files = [];
+	walk(root, root, files);
+	return files.flatMap((file) => {
+		const buffer = readFileSync(join(root, file));
+		if (isBinary(buffer)) return [];
+		return buffer.toString("utf8").split("\n").flatMap((line, index) => {
+			return MARKER_RE.exec(line) ? [{
+				file,
+				line: index + 1,
+				pattern: "region-marker",
+				match: line.trim(),
+				why: "No \"#region\" may reach an emitted app — a surviving marker is dead text that still compiles."
+			}] : [];
+		});
+	});
+};
+const formatFindings = (findings) => findings.map((f) => `  ${f.file}:${f.line}  [${f.pattern}] ${f.match}\n      ${f.why}`).join("\n");
+/**
+* Two modes, because the two things being proved are opposites.
+*
+* 1. Default — internal references and credential shapes under a directory. Run on `pnpm pack`
+*    output, which still holds the marked-up template.
+* 2. `--markers` — region markers under a directory. Run on an **emitted app**, where a marker
+*    must never appear.
+*/
+const main = () => {
+	const args = process.argv.slice(2);
+	const markersOnly = args[0] === "--markers";
+	const root = markersOnly ? args[1] : args[0];
+	if (root === void 0) {
+		console.error("usage: node dist/sanitize.js [--markers] <directory>");
+		process.exit(1);
+	}
+	const findings = markersOnly ? scanMarkers(root) : scan(root);
+	if (findings.length > 0) {
+		console.error(`✗ ${findings.length} ${markersOnly ? "marker" : "sanitize"} finding(s) under ${root}:`);
+		console.error(formatFindings(findings));
+		process.exit(1);
+	}
+	console.log(markersOnly ? `✓ no region markers under ${root}` : `✓ no internal references or credential shapes under ${root}`);
+};
+if (process.argv[1]?.endsWith("sanitize.js") === true) main();
+//#endregion
+export { scanMarkers as a, scanManifests as i, loadPatterns as n, scanText as o, scan as r, scanTree as s, formatFindings as t };

package/dist/sanitize.js

@@ -0,0 +1,2 @@
+import { a as scanMarkers, i as scanManifests, n as loadPatterns, o as scanText, r as scan, s as scanTree, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
+export { formatFindings, loadPatterns, scan, scanManifests, scanMarkers, scanText, scanTree };

package/dist/template/AGENTS.md

@@ -0,0 +1,133 @@
+# __APP_NAME__
+
+Generated by `create-keboola-app`. This file is yours to edit — nothing regenerates it.
+
+## Read the installed package's contract first
+
+Before writing UI, read the usage contract that ships with the version you actually have:
+
+- `node_modules/@keboola/design/AGENTS.md` — the component decision tree and prop reference.
+- `node_modules/@keboola/brand-registry/AGENTS.md` — brands, tokens and `BrandLogo`.
+
+Both are pinned by your lockfile, so they match the components in your `node_modules` rather
+than whatever the published docs track. Any `@keboola/*` package you add: check for its
+`AGENTS.md` the same way.
+
+## Conventions
+
+- TypeScript only, `type` over `interface`, named exports only, no `any`.
+- Import order: side effects → React/external → `@keboola/*` → relative.
+- Tailwind v4 with the `tw:` variant prefix. Colours come from semantic tokens
+  (`tw:bg-background`, `tw:text-muted-foreground`), never literals and never a primitive
+  scale — that is what lets a customer brand re-theme the app.
+- Dark mode is `[data-theme='dark']` on the root, written by `ThemeProvider`. A portalled
+  surface must set its own `tw:text-foreground` beside its `tw:bg-*`.
+- Layout uses Tailwind classes on real elements. There is no `Stack`/`Flex`/`Box` wrapper.
+- Per-module locality: everything about a feature lives under its route directory. A `-`
+  prefix keeps a file out of the generated route tree.
+- `.oxfmtrc.json` is the formatter's config, and it excludes this file and `README.md`. Both
+  were generated for the block selection you picked, and `oxfmt` pads Markdown table columns to
+  the widest cell — so their canonical form differs per selection and no generated text can
+  satisfy it. Everything under `src/` is format-checked normally.
+
+## Stack
+
+| Concern | Tool |
+| --- | --- |
+| Build | Vite 8 + `@vitejs/plugin-react` |
+| Routing | TanStack Router, file-based via `@tanstack/router-plugin/vite` |
+| Server state | TanStack Query v5 |
+| Client state | Zustand v5 with `devtools` + `persist` |
+| UI | `@keboola/design` |
+| Styling | Tailwind v4 + `@keboola/design/theme` tokens |
+| Tests | Vitest + jsdom + `@testing-library/react` |
+<!-- #region block:crud -->
+| Forms | TanStack Form v1 + zod v4 |
+<!-- #endregion block:crud -->
+<!-- #region block:grid -->
+| Data grid | TanStack Table v8 rendered through design's `Table` |
+<!-- #endregion block:grid -->
+<!-- #region block:chart -->
+| Charts | `@keboola/design/charts` |
+<!-- #endregion block:chart -->
+
+## File map
+
+```
+src/
+  main.tsx                # Mounts ThemeProvider + QueryClientProvider + RouterProvider
+  index.css               # Tailwind v4 layer order + @keboola/design theme and styles
+  routeTree.gen.ts        # Generated from src/routes/** by the Vite plugin
+  nav.ts                  # The rail's destinations and the active-match rule
+  overview-sections.tsx   # The ordered registry the overview renders
+  store.ts                # The Zustand store: storage key, partialize, merge guard
+  slices/shell.ts         # Sidebar mode + help visibility
+  components/AppChrome.tsx  # AppShell + Navbar + Sidebar
+  routes/__root.tsx       # Root layout
+  routes/index.tsx        # / — the overview
+  routes/-hooks.ts        # useOverview, AbortSignal threaded
+  routes/-fixtures.ts     # In-memory overview stub — swap for a real client call
+```
+<!-- #region block:kpi -->
+- `components/KpiCard.tsx`, `sections/kpi.tsx` — the KPI row.
+<!-- #endregion block:kpi -->
+<!-- #region block:chart -->
+- `recipes/Chart.tsx`, `sections/chart.tsx` — the line chart card.
+<!-- #endregion block:chart -->
+<!-- #region block:grid -->
+- `recipes/DataGrid.tsx`, `sections/grid.tsx` — the editable grid.
+<!-- #endregion block:grid -->
+<!-- #region block:crud -->
+- `routes/tokens/**` — the CRUD slice: `index.tsx`, `$id.tsx`, `new.tsx`, `-hooks.ts`,
+  `-fixtures.ts`, `-types.ts`, `-nav.ts`. **The entity is a placeholder.** Rename it to yours;
+  the fixture rows are labels only.
+<!-- #endregion block:crud -->
+<!-- #region block:assistant -->
+- `components/AssistantPanel.tsx`, `AssistantToggle.tsx`, `HomePrompt.tsx`,
+  `SelectionFloater.tsx`, `slices/assistant.ts` — the assistant. `slices/assistant.ts`
+  answers with a canned reply; swap that branch for a real request.
+<!-- #endregion block:assistant -->
+
+## Adding a route
+
+Drop a file in `src/routes/`. The Vite plugin regenerates `routeTree.gen.ts` on the next
+`pnpm dev` or `pnpm build`; nothing needs registering by hand.
+
+```tsx
+import { createFileRoute } from '@tanstack/react-router';
+
+export const Route = createFileRoute('/reports/')({
+  component: ReportsPage,
+});
+
+function ReportsPage() {
+  return null;
+}
+```
+
+Add it to the rail by appending to `NAV` in `src/nav.ts`, and to the overview by appending a
+section to `OVERVIEW_SECTIONS` in `src/overview-sections.tsx`.
+
+## Fetching data
+
+One hook per query, in the route's `-hooks.ts`, always threading the signal:
+
+```ts
+export const useReports = () =>
+  useQuery({
+    queryKey: ['reports'],
+    queryFn: ({ signal }) => api.reports.list(signal),
+  });
+```
+
+TanStack Query aborts that signal on unmount and on refetch. A `queryFn` that ignores it
+leaks a request per navigation.
+
+## Secrets
+
+`.env` is gitignored; `.env.example` is the checked-in list of what the app expects. Vite only
+exposes `VITE_`-prefixed variables to the client bundle, so anything not prefixed stays out of
+it — and nothing secret belongs in a client bundle at all.
+
+`templates/agent-safety/` holds opt-in, per-runtime read-blocking stubs (Claude Code, Cursor,
+Gemini CLI). Copy the one for your runtime as its README describes.

package/dist/template/README.md

@@ -0,0 +1,56 @@
+# __APP_TITLE__
+
+A Keboola-shaped frontend app: Vite, React 19, TanStack Router/Query/Form, Zustand,
+`@keboola/design` with `@keboola/brand-registry`.
+
+## Quick start
+
+```bash
+pnpm install
+pnpm dev
+```
+
+Open `http://localhost:5173`.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `pnpm dev` | Vite dev server. |
+| `pnpm build` | Production build into `dist/`. |
+| `pnpm test` | Vitest + jsdom. |
+| `pnpm type-check` | `tsc`, no emit. |
+| `pnpm lint` | `oxfmt --check` then `oxlint`. |
+| `pnpm lint:fix` | `oxlint --fix` then `oxfmt`. |
+| `pnpm gate:ui` | Scores the built app 0-100 in a headless browser. Needs `ANTHROPIC_API_KEY` and a `pnpm build` first — see below. |
+
+`gate:ui` is deliberately not part of `pnpm test`: it needs a model key, and a first run that
+fails for a missing credential is a worse welcome than an opt-in gate.
+
+## What is here
+
+- **`/`** — the overview route.
+<!-- #region block:kpi -->
+- KPI cards, reflowing on the content column's own width.
+<!-- #endregion block:kpi -->
+<!-- #region block:chart -->
+- A credits used-vs-budgeted line chart, coloured from `--chart-N` palette slots.
+<!-- #endregion block:chart -->
+<!-- #region block:grid -->
+- An editable per-component budget grid.
+<!-- #endregion block:grid -->
+<!-- #region block:crud -->
+- **`/tokens`**, **`/tokens/:id`**, **`/tokens/new`** — a list → detail → form slice with zod
+  validation and toast feedback.
+<!-- #endregion block:crud -->
+<!-- #region block:assistant -->
+- A docked assistant rail on every route, a composer on the overview, and
+  explain-on-selection. All three share one transcript.
+<!-- #endregion block:assistant -->
+
+Every data call is an in-memory fixture that honours an `AbortSignal`. Replacing a fixture with
+a real `@keboola/api-client` call is a drop-in — the query hooks already thread `signal`.
+
+## Next
+
+Read [AGENTS.md](./AGENTS.md), then `node_modules/@keboola/design/AGENTS.md`.

package/dist/template/_env.example

@@ -0,0 +1,6 @@
+# What this app reads from the environment. `.env` is gitignored; this file is the list.
+# Vite exposes only VITE_-prefixed variables to the client bundle.
+
+# The Keboola stack this app talks to. Left empty on purpose: a default here would pin the
+# app to one region.
+# VITE_KBC_STACK_URL=

package/dist/template/_gitignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+*.local
+
+.env
+.env.*
+!.env.example

package/dist/template/_oxfmtrc.json

@@ -0,0 +1,18 @@
+{
+  "printWidth": 100,
+  "tabWidth": 2,
+  "singleQuote": true,
+  "arrowParens": "always",
+  "jsxSingleQuote": false,
+  "bracketSameLine": false,
+  "sortPackageJson": false,
+  "ignorePatterns": [
+    "dist",
+    "public",
+    "src/routeTree.gen.ts",
+    "pnpm-lock.yaml",
+    "pnpm-workspace.yaml",
+    "README.md",
+    "AGENTS.md"
+  ]
+}

package/dist/template/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <title>__APP_TITLE__</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/dist/template/oxlint.config.ts

@@ -0,0 +1,43 @@
+import { defineConfig } from 'oxlint';
+
+import keboolaShared from '@keboola/oxlint-config';
+import keboolaTailwind from '@keboola/oxlint-config/tailwind';
+
+export default defineConfig({
+  // `keboolaTailwind` opts into the v4-native Tailwind lint layer
+  // (eslint-plugin-better-tailwindcss). It carries the plugin + rules; the
+  // `entryPoint` below is required — oxlint only reads `settings` from the
+  // root config, so it can't live inside the shared fragment.
+  extends: [keboolaShared, keboolaTailwind],
+  env: {
+    node: true,
+  },
+  settings: {
+    'better-tailwindcss': {
+      // This app's Tailwind v4 CSS entry (the file that `@import`s "tailwindcss").
+      entryPoint: 'src/index.css',
+    },
+  },
+  jsPlugins: [
+    // Local design-system + brand-safety lint rules — see
+    // packages/eslint-plugin-design. Aliased to `design` so rule IDs read
+    // `design/<rule>` in lint output. Boilerplate is the canonical scaffold
+    // cloned by `pnpm scaffold:app`, so every generated app inherits these.
+    { name: 'design', specifier: '@keboola/eslint-plugin-design' },
+  ],
+  rules: {
+    // Shipped at 'warn' for the first pass, matching the plugin convention —
+    // promote to 'error' once generated apps are consistently clean. See
+    // packages/eslint-plugin-design/README.md.
+    'design/no-layout-primitives': 'warn',
+    'design/no-inline-color': 'warn',
+    'design/no-primitive-tw-color': 'warn',
+    'design/no-native-form-controls': 'warn',
+    'design/no-raw-heading-on-page': 'warn',
+    'design/prefer-design-modal': 'warn',
+
+    // 'error' from the start: this app is the scaffold template, so a
+    // locale-implicit format here is copied into every generated app.
+    'design/no-implicit-locale': 'error',
+  },
+});