create-win-project 1.3.0 → 1.4.0

package/src/stacks/backends/README.md

@@ -0,0 +1,5 @@
+# Backend stacks
+
+Backend implementations move here one focused phase at a time. Laravel has an
+initial compatibility export; other stacks remain in their existing modules
+until their roadmap phases.

package/{lib/stacks → src/stacks/backends}/laravel/architecture.js

@@ -25,3 +25,4 @@ arch('application does not depend on http adapters')
   }
   return files
 }
+

package/{lib/stacks → src/stacks/backends}/laravel/auth/oidc.js

@@ -11,3 +11,4 @@ export const laravelOidcAuthentication = Object.freeze({
 export function isLaravelOidc(authentication) {
   return authentication === laravelOidcAuthentication.id
 }
+

package/{lib/stacks → src/stacks/backends}/laravel/auth/public.js

@@ -26,3 +26,4 @@ use Illuminate\\Support\\Facades\\Route;
 
 ${home}`)
 }
+

package/{lib/stacks → src/stacks/backends}/laravel/auth/sanctum.js

@@ -12,3 +12,4 @@ export const sanctumSpaAuthentication = Object.freeze({
 export function isSanctumSpa(authentication) {
   return authentication === sanctumSpaAuthentication.id
 }
+

package/{lib/stacks → src/stacks/backends}/laravel/auth/session.js

@@ -15,3 +15,4 @@ export function usesLaravelSession(authentication) {
 export function sessionEnvironment(authentication) {
   return usesLaravelSession(authentication) ? laravelSessionAuthentication.environment : []
 }
+

package/src/stacks/backends/laravel/ci.js

@@ -0,0 +1,3 @@
+export function ciContributions() {
+  return [{ template: 'laravel', path: '.github/workflows/ci-backend.yml' }]
+}

package/{lib/stacks → src/stacks/backends}/laravel/composer.js

@@ -1,4 +1,4 @@
-import { composerPackageVersion } from '../../compatibility.js'
+import { composerPackageVersion } from '../../shared/javascript-package.js'
 import { usesLaravelSession } from './auth/session.js'
 import { isSanctumSpa, sanctumSpaAuthentication } from './auth/sanctum.js'
 import { isLaravelOidc, laravelOidcAuthentication } from './auth/oidc.js'

package/{lib/stacks/laravel/generate.js → src/stacks/backends/laravel/create-files.js}

@@ -360,3 +360,4 @@ it('reports application health', function () {
   files['README.md'] = `# ${answers.projectName}\n\n> ${answers.projectDescription}\n\n## Start Laravel\n\n\`\`\`bash\n${root ? `cd ${root.slice(0, -1)}\n` : ''}cp .env.example .env\ncomposer install\nphp artisan key:generate\nphp artisan serve\n\`\`\`\n\nHealth: \`GET /api/health\`\n\n## Validate\n\n\`\`\`bash\ncomposer check\n\`\`\`\n`
   return files
 }
+

package/src/stacks/backends/laravel/docker.js

@@ -0,0 +1,14 @@
+export function laravelCompose(_answers, stack, vars) {
+  const laravelDir = stack.frontendKey === 'laravel-ui' || stack.frontendKey === 'no-frontend' ? '.' : './backend'
+  const frontend = stack.frontendKey === 'react'
+    ? `  frontend:\n    build:\n      context: ./frontend\n      dockerfile: Dockerfile.dev\n    ports:\n      - "\${FRONTEND_HOST_PORT:-5173}:5173"\n    volumes:\n      - ./frontend:/app\n      - frontend-node-modules:/app/node_modules\n    environment:\n      VITE_API_URL: http://backend:8000\n    depends_on:\n      - backend\n\n`
+    : stack.frontendKey === 'nextjs'
+      ? `  frontend:\n    build:\n      context: .\n      dockerfile: Dockerfile.dev\n    ports:\n      - "\${FRONTEND_HOST_PORT:-3000}:3000"\n    volumes:\n      - .:/app\n      - /app/backend\n      - frontend-node-modules:/app/node_modules\n    environment:\n      NEXT_PUBLIC_API_URL: http://backend:8000\n    depends_on:\n      - backend\n\n`
+      : ''
+  const frontendVolume = frontend ? '  frontend-node-modules:\n' : ''
+  return `services:\n${frontend}  backend:\n    build:\n      context: ${laravelDir}\n      dockerfile: Dockerfile.dev\n    ports:\n      - "\${BACKEND_HOST_PORT:-8000}:8000"\n    volumes:\n      - ${laravelDir}:/app\n      - laravel-vendor:/app/vendor\n    environment:\n      APP_ENV: local\n      APP_DEBUG: "true"\n      APP_KEY: \${APP_KEY:-}\n      DB_CONNECTION: pgsql\n      DB_HOST: db\n      DB_PORT: 5432\n      DB_DATABASE: \${POSTGRES_DB}\n      DB_USERNAME: \${POSTGRES_USER}\n      DB_PASSWORD: \${POSTGRES_PASSWORD}\n    depends_on:\n      db:\n        condition: service_healthy\n\n  db:\n    image: ${vars.POSTGRES_IMAGE}\n    ports:\n      - "\${POSTGRES_HOST_PORT:-5432}:5432"\n    environment:\n      POSTGRES_DB: \${POSTGRES_DB}\n      POSTGRES_USER: \${POSTGRES_USER}\n      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}\n    volumes:\n      - postgres-data:/var/lib/postgresql/data\n    healthcheck:\n      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER} -d \${POSTGRES_DB}"]\n      interval: 5s\n      timeout: 5s\n      retries: 10\n\nvolumes:\n${frontendVolume}  laravel-vendor:\n  postgres-data:\n`
+}
+
+export function dockerContributions() {
+  return [{ template: 'laravel', path: 'docker-compose.yml' }]
+}

package/src/stacks/backends/laravel/environment.js

@@ -0,0 +1,5 @@
+// Laravel auth modules add their model-specific names while catalog resolution
+// builds the final ordered environment list.
+export function environmentContributions({ stack } = {}) {
+  return stack?.env ? [...stack.env] : []
+}

package/{lib/stacks → src/stacks/backends}/laravel/index.js

@@ -1,4 +1,8 @@
-import { defineStackAdapter } from '../contract.js'
+import { defineStackAdapter } from '../../rules.js'
+import { buildLaravelFiles } from './create-files.js'
+import { dockerContributions } from './docker.js'
+import { ciContributions } from './ci.js'
+import { environmentContributions } from './environment.js'
 
 export const laravelAdapter = defineStackAdapter({
   id: 'laravel',
@@ -13,6 +17,10 @@ export const laravelAdapter = defineStackAdapter({
     authenticationModels: ['public', 'undecided', 'laravel-session', 'sanctum-spa', 'laravel-oidc'],
     runtime: 'php',
   },
-  contributes: {},
+  contributes: {
+    files: ({ answers, stack, vars }) => Object.entries(buildLaravelFiles(answers, stack, vars)),
+    environment: environmentContributions,
+    docker: dockerContributions,
+    ci: ciContributions,
+  },
 })
-

package/{lib/stacks → src/stacks/backends}/laravel/ui/blade.js

@@ -13,3 +13,4 @@ export const bladeUi = Object.freeze({
     }
   },
 })
+

package/{lib/stacks → src/stacks/backends}/laravel/ui/index.js

@@ -27,3 +27,4 @@ export function laravelUiPromptContribution(argument) {
     }],
   }
 }
+

package/{lib/stacks → src/stacks/backends}/laravel/ui/inertia-react.js

@@ -1,4 +1,4 @@
-import { packageVersion } from '../../../compatibility.js'
+import { packageVersion } from '../../../shared/javascript-package.js'
 import { buildLaravelAuthView } from './shared.js'
 
 const php = (value) => `${value.trim()}\n`
@@ -15,7 +15,9 @@ export const inertiaReactUi = Object.freeze({
     const npm = (name) => packageVersion(stack.profile, name, 'laravel-ui', 'Laravel Inertia scaffold')
     return {
       ...buildLaravelAuthView(stack.authentication),
-      'package.json': json({ private: true, type: 'module', scripts: { dev: 'vite', build: 'vite build' }, dependencies: { '@inertiajs/react': npm('@inertiajs/react'), react: npm('react'), 'react-dom': npm('react-dom') }, devDependencies: { '@vitejs/plugin-react': npm('@vitejs/plugin-react'), 'laravel-vite-plugin': npm('laravel-vite-plugin'), vite: npm('vite') } }),
+      'package.json': json({ private: true, type: 'module', packageManager: `npm@${stack.profile.runtimes.npmMinimum}`, engines: { node: `>=${stack.profile.runtimes.nodeMinimum}`, npm: `>=${stack.profile.runtimes.npmMinimum}` }, scripts: { dev: 'vite', build: 'vite build' }, dependencies: { '@inertiajs/react': npm('@inertiajs/react'), react: npm('react'), 'react-dom': npm('react-dom') }, devDependencies: { '@vitejs/plugin-react': npm('@vitejs/plugin-react'), 'laravel-vite-plugin': npm('laravel-vite-plugin'), vite: npm('vite') } }),
+      '.node-version': `${stack.profile.runtimes.node}\n`,
+      '.npmrc': 'engine-strict=true\n',
       'vite.config.js': `import { defineConfig } from 'vite'\nimport laravel from 'laravel-vite-plugin'\nimport react from '@vitejs/plugin-react'\n\nexport default defineConfig({ plugins: [laravel({ input: 'resources/js/app.jsx', refresh: true }), react()] })\n`,
       'resources/js/app.jsx': `import { createInertiaApp } from '@inertiajs/react'\nimport { createRoot } from 'react-dom/client'\n\nconst pages = import.meta.glob('./Pages/**/*.jsx', { eager: true })\ncreateInertiaApp({ resolve: (name) => pages[\`./Pages/\${name}.jsx\`], setup({ el, App, props }) { createRoot(el).render(<App {...props} />) } })\n`,
       'resources/js/Pages/Home.jsx': `export default function Home() { return <main><h1>${answers.projectName}</h1><p>Laravel + Inertia + React</p></main> }\n`,

package/{lib/stacks → src/stacks/backends}/laravel/ui/livewire.js

@@ -37,3 +37,4 @@ final class HomePage extends Component
     }
   },
 })
+

package/{lib/stacks → src/stacks/backends}/laravel/ui/shared.js

@@ -12,3 +12,4 @@ export function laravelLoginNavigation(authentication) {
     ? '<nav>@auth <form method="POST" action="/logout">@csrf<button>Log out</button></form> @else <a href="/login">Log in</a> @endauth</nav>'
     : ''
 }
+

package/src/stacks/backends/none/index.js

@@ -0,0 +1,23 @@
+import { defineStackAdapter } from '../../rules.js'
+
+export const noBackendAdapter = defineStackAdapter({
+  id: 'none',
+  kind: 'backend',
+  label: 'None / frontend only',
+  compatibleWith: { frontend: ['nextjs', 'react', 'react-native'] },
+  capabilities: {
+    applicationShapes: ['fullstack', 'frontend', 'mobile'],
+    architectureProfiles: ['small', 'medium', 'large'],
+    authenticationModels: ['public', 'undecided'],
+    runtime: 'none',
+  },
+  contributes: {
+    environment: () => [],
+    verification: () => [
+      { frontend: 'nextjs', architecture: 'small', authentication: 'public' },
+      { frontend: 'react', architecture: 'medium', authentication: 'undecided' },
+      { frontend: 'react-native', architecture: 'large', authentication: 'public' },
+    ],
+  },
+})
+

package/src/stacks/backends/postgres/ci.js

@@ -0,0 +1,3 @@
+export function ciContributions() {
+  return []
+}

package/src/stacks/backends/postgres/create-files.js

@@ -0,0 +1,21 @@
+export function buildPostgresFiles() {
+  return {
+    'prisma.config.ts': `import 'dotenv/config'\nimport { defineConfig, env } from 'prisma/config'\n\nexport default defineConfig({\n  schema: 'prisma/schema.prisma',\n  migrations: { path: 'prisma/migrations' },\n  datasource: { url: env('DATABASE_URL') },\n})\n`,
+    'prisma/schema.prisma': `generator client {\n  provider = "prisma-client"\n  output   = "../src/generated/prisma"\n}\n\ndatasource db {\n  provider = "postgresql"\n}\n\nmodel Example {\n  id        String   @id @default(uuid())\n  createdAt DateTime @default(now()) @map("created_at")\n  updatedAt DateTime @updatedAt @map("updated_at")\n\n  @@map("examples")\n}\n`,
+    'src/lib/prisma.ts': `import { PrismaPg } from '@prisma/adapter-pg'\nimport { PrismaClient } from '@/generated/prisma/client'\n\nconst connectionString = process.env.DATABASE_URL\nif (!connectionString) throw new Error('DATABASE_URL is required')\nconst globalForPrisma = globalThis as unknown as { prisma?: PrismaClient }\nexport const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter: new PrismaPg({ connectionString }) })\nif (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma\n`,
+  }
+}
+
+export function addPostgresScripts(scripts) {
+  Object.assign(scripts, {
+    'prisma:generate': 'prisma generate',
+    'db:migrate': 'prisma migrate dev',
+    'db:deploy': 'prisma migrate deploy',
+    'db:reset': 'prisma migrate reset --force',
+    'db:studio': 'prisma studio',
+    dev: 'prisma generate && next dev',
+    build: 'prisma generate && next build',
+    typecheck: 'prisma generate && tsc --noEmit',
+  })
+}
+

package/src/stacks/backends/postgres/docker.js

@@ -0,0 +1,3 @@
+export function dockerContributions() {
+  return [{ template: 'postgres', path: 'docker-compose.yml' }]
+}

package/src/stacks/backends/postgres/environment.js

@@ -0,0 +1,3 @@
+export function environmentContributions() {
+  return ['DATABASE_URL']
+}

package/src/stacks/backends/postgres/index.js

@@ -0,0 +1,30 @@
+import { defineStackAdapter } from '../../rules.js'
+import { buildPostgresFiles } from './create-files.js'
+import { ciContributions } from './ci.js'
+import { dockerContributions } from './docker.js'
+import { environmentContributions } from './environment.js'
+
+export const postgresAdapter = defineStackAdapter({
+  id: 'postgres',
+  kind: 'backend',
+  label: 'PostgreSQL + Prisma',
+  compatibleWith: { frontend: ['nextjs'] },
+  capabilities: {
+    applicationShapes: ['fullstack'],
+    architectureProfiles: ['small', 'medium', 'large'],
+    authenticationModels: ['public', 'undecided'],
+    runtime: 'postgres',
+  },
+  contributes: {
+    files: () => Object.entries(buildPostgresFiles()),
+    environment: environmentContributions,
+    install: () => [{ cwd: '.', command: 'npm', args: ['run', 'prisma:generate'] }],
+    docker: dockerContributions,
+    ci: ciContributions,
+    verification: () => [
+      { frontend: 'nextjs', architecture: 'small', authentication: 'public' },
+      { frontend: 'nextjs', architecture: 'medium', authentication: 'undecided' },
+      { frontend: 'nextjs', architecture: 'large', authentication: 'public' },
+    ],
+  },
+})

package/src/stacks/backends/springboot/ci.js

@@ -0,0 +1,3 @@
+export function ciContributions() {
+  return [{ template: 'springboot', path: '.github/workflows/ci-backend.yml' }]
+}

package/src/stacks/backends/springboot/create-files.js

@@ -0,0 +1,91 @@
+export function buildSpringBootFiles(answers, vars, stack) {
+  const pkg = vars.PACKAGE_NAME
+  const pkgPath = vars.PACKAGE_PATH
+  const appName = `${answers.projectName.split('-').map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join('')}Application`
+  const isLarge = stack.architecture === 'large'
+  const withTests = (answers.testing || 'basic') !== 'none'
+  const withFullTests = answers.testing === 'full'
+  const healthWebMvcTest = stack.authentication === 'oidc'
+    ? '@WebMvcTest(controllers = HealthController.class, properties = "spring.autoconfigure.exclude=org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration")'
+    : '@WebMvcTest(HealthController.class)'
+  const integrationSecurityImports = stack.authentication === 'oidc'
+    ? `\nimport static org.mockito.ArgumentMatchers.anyString;\nimport static org.mockito.Mockito.doThrow;\nimport org.springframework.security.oauth2.jwt.JwtDecoder;\nimport org.springframework.security.oauth2.jwt.BadJwtException;\nimport org.springframework.security.oauth2.jwt.JwtException;\nimport org.springframework.test.context.bean.override.mockito.MockitoBean;`
+    : stack.authentication === 'session'
+      ? `\nimport static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;\nimport static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;\nimport static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;`
+      : ''
+  const integrationSecurityFields = stack.authentication === 'oidc'
+    ? '\n    @MockitoBean JwtDecoder jwtDecoder;'
+    : ''
+  const integrationSecurityTests = stack.authentication === 'oidc'
+    ? `\n    @Test void protectedRoutesRejectMissingBearerToken() throws Exception { mvc.perform(get("/api/private-probe")).andExpect(status().isUnauthorized()); }\n    @Test void invalidBearerTokenIsRejected() throws Exception { doThrow(new BadJwtException("invalid")).when(jwtDecoder).decode(anyString()); mvc.perform(get("/api/private-probe").header("Authorization", "Bearer invalid")).andExpect(status().isUnauthorized()); }`
+    : stack.authentication === 'session'
+      ? `\n    @Test void protectedRoutesRequireASession() throws Exception { mvc.perform(get("/api/private-probe")).andExpect(status().is3xxRedirection()); }\n    @Test void authenticatedRequestsReachTheApplication() throws Exception { mvc.perform(get("/api/private-probe").with(user("test"))).andExpect(status().isNotFound()); }\n    @Test void logoutRequiresCsrf() throws Exception { mvc.perform(post("/api/auth/logout").with(user("test"))).andExpect(status().isForbidden()); mvc.perform(post("/api/auth/logout").with(user("test")).with(csrf())).andExpect(status().is3xxRedirection()); }`
+      : stack.authentication === 'undecided'
+        ? `\n    @Test void undecidedAuthenticationFailsClosed() throws Exception { mvc.perform(get("/api/private-probe")).andExpect(status().isForbidden()); }`
+        : `\n    @Test void publicApplicationsDoNotInventAuthentication() throws Exception { mvc.perform(get("/api/private-probe")).andExpect(status().isNotFound()); }`
+  const securityDependency = stack.authentication === 'oidc'
+    ? '\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-oauth2-resource-server</artifactId></dependency>'
+    : ''
+  const modulithManagement = isLarge
+    ? `\n  <dependencyManagement><dependencies><dependency><groupId>org.springframework.modulith</groupId><artifactId>spring-modulith-bom</artifactId><version>${vars.SPRING_MODULITH_VERSION}</version><type>pom</type><scope>import</scope></dependency></dependencies></dependencyManagement>`
+    : ''
+  const modulithDependency = isLarge && withTests
+    ? '\n    <dependency><groupId>org.springframework.modulith</groupId><artifactId>spring-modulith-starter-test</artifactId><scope>test</scope></dependency>'
+    : ''
+  const testDependencies = withTests
+    ? `\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-webmvc-test</artifactId><scope>test</scope></dependency>\n    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-test</artifactId><scope>test</scope></dependency>${modulithDependency}${withFullTests ? `\n    <dependency><groupId>org.testcontainers</groupId><artifactId>junit-jupiter</artifactId><version>${vars.TESTCONTAINERS_VERSION}</version><scope>test</scope></dependency>\n    <dependency><groupId>org.testcontainers</groupId><artifactId>postgresql</artifactId><version>${vars.TESTCONTAINERS_VERSION}</version><scope>test</scope></dependency>` : ''}`
+    : ''
+  const excludeDefaultUser = stack.authentication === 'session' ? '' : '\nimport org.springframework.boot.security.autoconfigure.UserDetailsServiceAutoConfiguration;'
+  const applicationAnnotation = stack.authentication === 'session'
+    ? '@SpringBootApplication'
+    : '@SpringBootApplication(exclude = UserDetailsServiceAutoConfiguration.class)'
+  const accessRule = stack.authentication === 'public'
+    ? '.anyRequest().permitAll()'
+    : stack.authentication === 'undecided' ? '.anyRequest().denyAll()' : '.anyRequest().authenticated()'
+  const authConfig = stack.authentication === 'session'
+    ? '\n            .formLogin(Customizer.withDefaults())\n            .logout(logout -> logout.logoutUrl("/api/auth/logout").invalidateHttpSession(true).deleteCookies("JSESSIONID"))'
+    : stack.authentication === 'oidc'
+      ? '\n            .csrf(csrf -> csrf.disable())\n            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))\n            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))'
+      : stack.authentication === 'public' ? '\n            .csrf(csrf -> csrf.disable())' : ''
+  const securityImports = `${['session', 'oidc'].includes(stack.authentication) ? '\nimport org.springframework.security.config.Customizer;' : ''}${stack.authentication === 'oidc' ? '\nimport org.springframework.security.config.http.SessionCreationPolicy;' : ''}`
+  const files = {
+    'backend/mvnw': `#!/bin/sh\nset -eu\nif command -v mvn >/dev/null 2>&1; then exec mvn "$@"; fi\nif command -v docker >/dev/null 2>&1; then exec docker run --rm -v "$PWD:/workspace" -w /workspace ${vars.MAVEN_IMAGE} mvn "$@"; fi\necho "Maven is unavailable. Install Maven ${vars.MAVEN_VERSION} or Docker." >&2\nexit 1\n`,
+    'backend/mvnw.cmd': `@echo off\r\nwhere mvn >nul 2>nul\r\nif %errorlevel% equ 0 (mvn %* & exit /b %errorlevel%)\r\nwhere docker >nul 2>nul\r\nif %errorlevel% equ 0 (docker run --rm -v "%cd%:/workspace" -w /workspace ${vars.MAVEN_IMAGE} mvn %* & exit /b %errorlevel%)\r\necho Maven is unavailable. Install Maven ${vars.MAVEN_VERSION} or Docker. 1>&2\r\nexit /b 1\r\n`,
+    'backend/pom.xml': `<?xml version="1.0" encoding="UTF-8"?>\n<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">\n  <modelVersion>4.0.0</modelVersion>\n  <parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>${vars.SPRING_BOOT_VERSION}</version><relativePath/></parent>\n  <groupId>${pkg}</groupId><artifactId>${answers.projectName}</artifactId><version>0.0.1-SNAPSHOT</version>\n  <properties><java.version>${vars.JAVA_VERSION}</java.version></properties>${modulithManagement}\n  <dependencies>\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId></dependency>\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-validation</artifactId></dependency>\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency>\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-actuator</artifactId></dependency>\n    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-jpa</artifactId></dependency>\n    <dependency><groupId>org.flywaydb</groupId><artifactId>flyway-database-postgresql</artifactId></dependency>\n    <dependency><groupId>org.postgresql</groupId><artifactId>postgresql</artifactId><scope>runtime</scope></dependency>${securityDependency}${testDependencies}\n  </dependencies>\n  <build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins></build>\n</project>\n`,
+    [`backend/src/main/java/${pkgPath}/${appName}.java`]: `package ${pkg};\n\nimport org.springframework.boot.SpringApplication;\nimport org.springframework.boot.autoconfigure.SpringBootApplication;${excludeDefaultUser}\n\n${applicationAnnotation}\npublic class ${appName} {\n    public static void main(String[] args) { SpringApplication.run(${appName}.class, args); }\n}\n`,
+    [`backend/src/main/java/${pkgPath}/health/HealthController.java`]: `package ${pkg}.health;\n\nimport java.util.Map;\nimport org.springframework.web.bind.annotation.GetMapping;\nimport org.springframework.web.bind.annotation.RestController;\n\n@RestController\npublic class HealthController {\n    @GetMapping("/api/health")\n    Map<String, String> health() { return Map.of("status", "ok"); }\n}\n`,
+    [`backend/src/main/java/${pkgPath}/config/SecurityConfig.java`]: `package ${pkg}.config;\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;${securityImports}\nimport org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\nimport org.springframework.security.web.SecurityFilterChain;\n\n@Configuration\n@EnableMethodSecurity\npublic class SecurityConfig {\n    @Bean\n    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {\n        return http\n            .authorizeHttpRequests(auth -> auth\n                .requestMatchers("/api/health", "/actuator/health").permitAll()\n                ${accessRule}\n            )${authConfig}\n            .build();\n    }\n}\n`,
+    [`backend/src/main/java/${pkgPath}/common/error/ErrorCode.java`]: `package ${pkg}.common.error;\n\npublic enum ErrorCode { RESOURCE_NOT_FOUND, CONFLICT, OPERATION_FORBIDDEN }\n`,
+    [`backend/src/main/java/${pkgPath}/common/error/AppException.java`]: `package ${pkg}.common.error;\n\npublic final class AppException extends RuntimeException {\n    private final ErrorCode code;\n    public AppException(ErrorCode code, String message) { super(message); this.code = code; }\n    public ErrorCode code() { return code; }\n}\n`,
+    [`backend/src/main/java/${pkgPath}/common/error/ApiExceptionHandler.java`]: `package ${pkg}.common.error;\n\nimport jakarta.servlet.http.HttpServletRequest;\nimport org.springframework.http.HttpStatus;\nimport org.springframework.http.ProblemDetail;\nimport org.springframework.web.bind.annotation.ExceptionHandler;\nimport org.springframework.web.bind.annotation.RestControllerAdvice;\n\n@RestControllerAdvice\npublic class ApiExceptionHandler {\n    @ExceptionHandler(AppException.class)\n    ProblemDetail handle(AppException exception, HttpServletRequest request) {\n        HttpStatus status = switch (exception.code()) {\n            case RESOURCE_NOT_FOUND -> HttpStatus.NOT_FOUND;\n            case CONFLICT -> HttpStatus.CONFLICT;\n            case OPERATION_FORBIDDEN -> HttpStatus.FORBIDDEN;\n        };\n        ProblemDetail problem = ProblemDetail.forStatusAndDetail(status, exception.getMessage());\n        problem.setTitle(status.getReasonPhrase());\n        problem.setProperty("code", exception.code().name());\n        return problem;\n    }\n}\n`,
+    'backend/src/main/resources/application.yml': `spring:\n  application:\n    name: ${answers.projectName}\n  datasource:\n    url: \${DATABASE_URL:jdbc:postgresql://localhost:5432/${answers.projectName.replaceAll('-', '_')}}\n    username: \${POSTGRES_USER:postgres}\n    password: \${POSTGRES_PASSWORD:postgres}\n  jpa:\n    open-in-view: false\n    hibernate:\n      ddl-auto: validate\n  flyway:\n    enabled: true\nmanagement:\n  endpoints:\n    web:\n      exposure:\n        include: health,info\n  endpoint:\n    health:\n      probes:\n        enabled: true\nserver:\n  error:\n    include-message: never\n`,
+    'backend/src/main/resources/db/migration/V1__baseline.sql': 'CREATE TABLE examples (\n  id UUID PRIMARY KEY,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\n);\n',
+  }
+  if (stack.authentication === 'oidc') {
+    files['backend/src/main/resources/application.yml'] += '\nspring.security.oauth2.resourceserver.jwt.issuer-uri: ${OIDC_ISSUER_URI:http://localhost:9090/realms/app}\nspring.security.oauth2.resourceserver.jwt.audiences: ${OIDC_AUDIENCE:api}\n'
+  }
+
+  if (stack.architecture !== 'small') {
+    if (isLarge) {
+      files[`backend/src/main/java/${pkgPath}/system/SystemStatus.java`] = `package ${pkg}.system;\n\npublic interface SystemStatus { Status current(); record Status(String status, String architecture) {} }\n`
+      files[`backend/src/main/java/${pkgPath}/system/internal/SystemStatusService.java`] = `package ${pkg}.system.internal;\n\nimport org.springframework.stereotype.Service;\nimport ${pkg}.system.SystemStatus;\n\n@Service\nclass SystemStatusService implements SystemStatus {\n    public Status current() { return new Status("ok", "large"); }\n}\n`
+      files[`backend/src/main/java/${pkgPath}/system/internal/SystemStatusController.java`] = `package ${pkg}.system.internal;\n\nimport ${pkg}.system.SystemStatus;\nimport ${pkg}.system.SystemStatus.Status;\nimport org.springframework.web.bind.annotation.GetMapping;\nimport org.springframework.web.bind.annotation.RequestMapping;\nimport org.springframework.web.bind.annotation.RestController;\n\n@RestController\n@RequestMapping("/api/status")\nclass SystemStatusController {\n    private final SystemStatus status;\n    SystemStatusController(SystemStatus status) { this.status = status; }\n    @GetMapping Status current() { return status.current(); }\n}\n`
+    } else {
+      files[`backend/src/main/java/${pkgPath}/system/api/SystemStatusResponse.java`] = `package ${pkg}.system.api;\n\npublic record SystemStatusResponse(String status, String architecture) {}\n`
+      files[`backend/src/main/java/${pkgPath}/system/service/SystemStatusService.java`] = `package ${pkg}.system.service;\n\nimport ${pkg}.system.api.SystemStatusResponse;\nimport org.springframework.stereotype.Service;\n\n@Service\npublic class SystemStatusService {\n    public SystemStatusResponse current() { return new SystemStatusResponse("ok", "medium"); }\n}\n`
+      files[`backend/src/main/java/${pkgPath}/system/api/SystemStatusController.java`] = `package ${pkg}.system.api;\n\nimport ${pkg}.system.service.SystemStatusService;\nimport org.springframework.web.bind.annotation.GetMapping;\nimport org.springframework.web.bind.annotation.RequestMapping;\nimport org.springframework.web.bind.annotation.RestController;\n\n@RestController\n@RequestMapping("/api/status")\npublic class SystemStatusController {\n    private final SystemStatusService service;\n    public SystemStatusController(SystemStatusService service) { this.service = service; }\n    @GetMapping SystemStatusResponse current() { return service.current(); }\n}\n`
+    }
+  }
+
+  if (withTests) {
+    files[`backend/src/test/java/${pkgPath}/health/HealthControllerTest.java`] = `package ${pkg}.health;\n\nimport static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;\nimport static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;\nimport static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;\nimport org.junit.jupiter.api.Test;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;\nimport org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;\nimport org.springframework.test.web.servlet.MockMvc;\n\n${healthWebMvcTest}\n@AutoConfigureMockMvc(addFilters = false)\nclass HealthControllerTest {\n    @Autowired MockMvc mvc;\n    @Test void healthContractIsStable() throws Exception { mvc.perform(get("/api/health")).andExpect(status().isOk()).andExpect(jsonPath("$.status").value("ok")); }\n}\n`
+    if (isLarge) {
+      files[`backend/src/test/java/${pkgPath}/ArchitectureTest.java`] = `package ${pkg};\n\nimport org.junit.jupiter.api.Test;\nimport org.springframework.modulith.core.ApplicationModules;\n\nclass ArchitectureTest {\n    @Test void modulesRespectTheirPublicApis() { ApplicationModules.of(${appName}.class).verify(); }\n}\n`
+    }
+    if (withFullTests) {
+      files[`backend/src/test/java/${pkgPath}/PostgresIntegrationTest.java`] = `package ${pkg};\n\nimport static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;\nimport static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;${integrationSecurityImports}\nimport org.junit.jupiter.api.Test;\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.boot.test.context.SpringBootTest;\nimport org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;\nimport org.springframework.test.context.DynamicPropertyRegistry;\nimport org.springframework.test.context.DynamicPropertySource;\nimport org.springframework.test.web.servlet.MockMvc;\nimport org.testcontainers.containers.PostgreSQLContainer;\nimport org.testcontainers.junit.jupiter.Container;\nimport org.testcontainers.junit.jupiter.Testcontainers;\n\n@SpringBootTest\n@AutoConfigureMockMvc\n@Testcontainers\nclass PostgresIntegrationTest {\n    @Container static final PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("${vars.POSTGRES_IMAGE}");\n    @Autowired MockMvc mvc;${integrationSecurityFields}\n    @DynamicPropertySource static void database(DynamicPropertyRegistry registry) {\n        registry.add("spring.datasource.url", postgres::getJdbcUrl);\n        registry.add("spring.datasource.username", postgres::getUsername);\n        registry.add("spring.datasource.password", postgres::getPassword);\n    }\n    @Test void migrationsAndPostgresContextStart() {}${integrationSecurityTests}\n}\n`
+    }
+  }
+  return files
+}
+

package/src/stacks/backends/springboot/docker.js

@@ -0,0 +1,3 @@
+export function dockerContributions() {
+  return [{ template: 'springboot', developmentPath: 'backend/Dockerfile.dev', productionPath: 'backend/Dockerfile' }]
+}

package/src/stacks/backends/springboot/environment.js

@@ -0,0 +1,3 @@
+export function environmentContributions() {
+  return ['API_URL', 'DATABASE_URL', 'POSTGRES_USER', 'POSTGRES_PASSWORD', 'POSTGRES_DB', 'SPRING_PROFILES_ACTIVE']
+}

package/src/stacks/backends/springboot/index.js

@@ -0,0 +1,31 @@
+import { defineStackAdapter } from '../../rules.js'
+import { buildSpringBootFiles } from './create-files.js'
+import { ciContributions } from './ci.js'
+import { dockerContributions } from './docker.js'
+import { environmentContributions } from './environment.js'
+
+export const springbootAdapter = defineStackAdapter({
+  id: 'springboot',
+  kind: 'backend',
+  label: 'Spring Boot',
+  compatibleWith: { frontend: ['nextjs', 'react', 'react-native', 'no-frontend'] },
+  capabilities: {
+    applicationShapes: ['separate', 'api', 'mobile'],
+    architectureProfiles: ['small', 'medium', 'large'],
+    authenticationModels: ['public', 'undecided', 'session', 'oidc'],
+    runtime: 'java',
+  },
+  contributes: {
+    files: ({ answers, stack, vars }) => Object.entries(buildSpringBootFiles(answers, vars, stack)),
+    environment: environmentContributions,
+    install: () => [{ cwd: 'backend', command: './mvnw', args: ['dependency:go-offline'] }],
+    docker: dockerContributions,
+    ci: ciContributions,
+    verification: () => [
+      { frontend: 'nextjs', architecture: 'small', authentication: 'public' },
+      { frontend: 'react', architecture: 'medium', authentication: 'session' },
+      { frontend: 'react-native', architecture: 'large', authentication: 'oidc' },
+      { frontend: 'no-frontend', architecture: 'medium', authentication: 'undecided' },
+    ],
+  },
+})

package/src/stacks/backends/supabase/ci.js

@@ -0,0 +1,3 @@
+export function ciContributions() {
+  return []
+}

package/src/stacks/backends/supabase/create-files.js

@@ -0,0 +1,52 @@
+import path from 'node:path'
+
+export function buildSupabaseProjectFiles(stack) {
+  if (stack.backendKey !== 'supabase') return {}
+  const authenticated = stack.authentication === 'supabase'
+  const policies = authenticated
+    ? `grant select, insert, update, delete on table public.examples to authenticated;\n\ncreate policy "owners read examples" on public.examples for select to authenticated using ((select auth.uid()) = user_id);\ncreate policy "owners create examples" on public.examples for insert to authenticated with check ((select auth.uid()) = user_id);\ncreate policy "owners update examples" on public.examples for update to authenticated using ((select auth.uid()) = user_id) with check ((select auth.uid()) = user_id);\ncreate policy "owners delete examples" on public.examples for delete to authenticated using ((select auth.uid()) = user_id);`
+    : stack.authentication === 'public'
+      ? `grant select on table public.examples to anon, authenticated;\ncreate policy "public reads examples" on public.examples for select to anon, authenticated using (true);`
+      : '-- No grants or policies: authentication is intentionally undecided and access is fail-closed.'
+  return {
+    'supabase/config.toml': `project_id = "${stack.key}"\n\n[api]\nenabled = true\nport = 54321\nschemas = ["public", "graphql_public"]\nextra_search_path = ["public", "extensions"]\n\n[db]\nport = 54322\nmajor_version = 16\n\n[studio]\nenabled = true\nport = 54323\n`,
+    'supabase/migrations/00000000000000_create_examples.sql': `create table public.examples (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid references auth.users(id) on delete cascade,\n  name text not null check (char_length(name) between 1 and 120),\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\nalter table public.examples enable row level security;\nrevoke all on table public.examples from anon, authenticated;\ncreate index examples_user_id_idx on public.examples (user_id);\n\n${policies}\n`,
+    'supabase/tests/examples_rls.test.sql': authenticated
+      ? `begin;\nselect plan(5);\nselect ok((select relrowsecurity from pg_class where oid = 'public.examples'::regclass), 'examples has RLS enabled');\nselect ok((select count(*) >= 1 from pg_indexes where schemaname = 'public' and tablename = 'examples' and indexdef like '%user_id%'), 'RLS ownership column is indexed');\n\ninsert into auth.users (id, instance_id, aud, role, email, encrypted_password, created_at, updated_at) values\n  ('11111111-1111-1111-1111-111111111111', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'owner@example.test', '', now(), now()),\n  ('22222222-2222-2222-2222-222222222222', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'other@example.test', '', now(), now());\ninsert into public.examples (user_id, name) values ('11111111-1111-1111-1111-111111111111', 'owned row');\n\nset local role authenticated;\nselect set_config('request.jwt.claim.sub', '11111111-1111-1111-1111-111111111111', true);\nselect results_eq('select name from public.examples order by name', $$values ('owned row'::text)$$, 'owner can read their row');\nselect set_config('request.jwt.claim.sub', '22222222-2222-2222-2222-222222222222', true);\nselect is((select count(*) from public.examples), 0::bigint, 'non-owner cannot read the row');\nreset role;\nset local role anon;\nselect is((select count(*) from public.examples), 0::bigint, 'anonymous caller cannot read the row');\nreset role;\n\nselect * from finish();\nrollback;\n`
+      : `begin;\nselect plan(2);\nselect ok((select relrowsecurity from pg_class where oid = 'public.examples'::regclass), 'examples has RLS enabled');\nselect ok((select count(*) >= 1 from pg_indexes where schemaname = 'public' and tablename = 'examples' and indexdef like '%user_id%'), 'RLS policy column is indexed');\nselect * from finish();\nrollback;\n`,
+  }
+}
+
+export function buildSharedTestFiles(files, root, stack, level) {
+  if (level === 'none') return
+  if (stack.isMobile) {
+    files[path.join(root, 'jest.config.js')] = "export default { preset: 'jest-expo' }\n"
+    files[path.join(root, 'app/index.test.tsx')] = `import { render } from '@testing-library/react-native'\nimport HomeScreen from './index'\n\ntest('renders the starter heading', async () => {\n  const view = await render(<HomeScreen />)\n  expect(view.getByText('Your starter is running')).toBeTruthy()\n})\n`
+    return
+  }
+
+  files[path.join(root, 'vitest.config.ts')] = `import { fileURLToPath, URL } from 'node:url'\nimport { defineConfig } from 'vitest/config'\n\nexport default defineConfig({\n  resolve: { alias: { '@': fileURLToPath(new URL('./src', import.meta.url)) } },\n  test: { environment: 'jsdom', setupFiles: './src/test/setup.ts', exclude: ['e2e/**', 'node_modules/**'] },\n})\n`
+  files[path.join(root, 'src/test/setup.ts')] = "import '@testing-library/jest-dom/vitest'\n"
+  if (level === 'full') {
+    files[path.join(root, 'playwright.config.ts')] = `import { defineConfig, devices } from '@playwright/test'\n\nexport default defineConfig({\n  testDir: './e2e',\n  use: { baseURL: 'http://127.0.0.1:${stack.frontendPort}' },\n  webServer: { command: 'npm run dev -- ${stack.frontendKey === 'nextjs' ? '--hostname' : '--host'} 127.0.0.1 --port ${stack.frontendPort}', url: 'http://127.0.0.1:${stack.frontendPort}', reuseExistingServer: true, timeout: 120_000 },\n  projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],\n})\n`
+    files[path.join(root, 'e2e/home.spec.ts')] = `import { expect, test } from '@playwright/test'\n\ntest('loads the starter', async ({ page }) => {\n  await page.goto('/')\n  await expect(page.getByRole('heading', { name: 'Your starter is running' })).toBeVisible()\n})\n`
+  }
+}
+
+export function buildSupabaseWebFiles(isNext, withAuth = false) {
+  if (!isNext) return {
+    'src/lib/supabase.ts': `import { createClient } from '@supabase/supabase-js'\n\nconst url = import.meta.env.VITE_SUPABASE_URL\nconst key = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY\nif (!url || !key) throw new Error('Missing VITE_SUPABASE_URL or VITE_SUPABASE_PUBLISHABLE_KEY')\nexport const supabase = createClient(url, key)\n`,
+  }
+  const files = {
+    'src/lib/supabase/client.ts': `import { createBrowserClient } from '@supabase/ssr'\n\nexport function createClient() {\n  return createBrowserClient(\n    process.env.NEXT_PUBLIC_SUPABASE_URL!,\n    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,\n  )\n}\n`,
+    'src/lib/supabase/server.ts': `import { createServerClient } from '@supabase/ssr'\nimport { cookies } from 'next/headers'\n\nexport async function createClient() {\n  const store = await cookies()\n  return createServerClient(\n    process.env.NEXT_PUBLIC_SUPABASE_URL!,\n    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,\n    { cookies: { getAll: () => store.getAll(), setAll: (values) => {\n      try { values.forEach(({ name, value, options }) => store.set(name, value, options)) } catch { /* Proxy owns refresh writes. */ }\n    } } },\n  )\n}\n`,
+  }
+  if (withAuth) Object.assign(files, {
+    'src/lib/supabase/proxy.ts': `import { createServerClient } from '@supabase/ssr'\nimport { NextResponse, type NextRequest } from 'next/server'\n\nexport async function updateSession(request: NextRequest) {\n  let response = NextResponse.next({ request })\n  const supabase = createServerClient(\n    process.env.NEXT_PUBLIC_SUPABASE_URL!,\n    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,\n    { cookies: {\n      getAll: () => request.cookies.getAll(),\n      setAll: (values) => {\n        values.forEach(({ name, value }) => request.cookies.set(name, value))\n        response = NextResponse.next({ request })\n        values.forEach(({ name, value, options }) => response.cookies.set(name, value, options))\n      },\n    } },\n  )\n  await supabase.auth.getClaims()\n  return response\n}\n`,
+    'src/proxy.ts': `import type { NextRequest } from 'next/server'\nimport { updateSession } from '@/lib/supabase/proxy'\n\nexport async function proxy(request: NextRequest) { return updateSession(request) }\n\nexport const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)'] }\n`,
+    'src/app/auth/callback/route.ts': `import { NextResponse, type NextRequest } from 'next/server'\nimport { createClient } from '@/lib/supabase/server'\n\nexport async function GET(request: NextRequest) {\n  const code = request.nextUrl.searchParams.get('code')\n  const destination = new URL('/', request.url)\n  if (!code) return NextResponse.redirect(destination)\n  const supabase = await createClient()\n  const { error } = await supabase.auth.exchangeCodeForSession(code)\n  if (error) destination.searchParams.set('authError', 'callback_failed')\n  return NextResponse.redirect(destination)\n}\n`,
+    'src/app/login/actions.ts': `'use server'\n\nimport { redirect } from 'next/navigation'\nimport { createClient } from '@/lib/supabase/server'\n\nexport async function signIn(formData: FormData) {\n  const email = String(formData.get('email') || '').trim()\n  const password = String(formData.get('password') || '')\n  if (!email || !password) redirect('/login?error=missing_credentials')\n  const supabase = await createClient()\n  const { error } = await supabase.auth.signInWithPassword({ email, password })\n  if (error) redirect('/login?error=invalid_credentials')\n  redirect('/')\n}\n\nexport async function signOut() {\n  const supabase = await createClient()\n  await supabase.auth.signOut()\n  redirect('/login')\n}\n`,
+    'src/app/login/page.tsx': `import { signIn } from './actions'\n\nexport default async function LoginPage({ searchParams }: { searchParams: Promise<{ error?: string }> }) {\n  const { error } = await searchParams\n  return <main><h1>Sign in</h1>{error ? <p role="alert">Sign-in failed. Check your details and try again.</p> : null}<form action={signIn}><label>Email <input name="email" type="email" autoComplete="email" required /></label><label>Password <input name="password" type="password" autoComplete="current-password" required /></label><button type="submit">Sign in</button></form></main>\n}\n`,
+  })
+  return files
+}

package/src/stacks/backends/supabase/docker.js

@@ -0,0 +1,3 @@
+export function dockerContributions() {
+  return [{ template: 'supabase', path: 'docker-compose.yml' }]
+}

package/src/stacks/backends/supabase/environment.js

@@ -0,0 +1,3 @@
+export function environmentContributions() {
+  return ['SUPABASE_URL', 'SUPABASE_PUBLISHABLE_KEY']
+}

package/src/stacks/backends/supabase/index.js

@@ -0,0 +1,31 @@
+import { defineStackAdapter } from '../../rules.js'
+import { buildSupabaseProjectFiles } from './create-files.js'
+import { ciContributions } from './ci.js'
+import { dockerContributions } from './docker.js'
+import { environmentContributions } from './environment.js'
+
+export const supabaseAdapter = defineStackAdapter({
+  id: 'supabase',
+  kind: 'backend',
+  label: 'Supabase',
+  compatibleWith: { frontend: ['nextjs', 'react', 'react-native'] },
+  capabilities: {
+    applicationShapes: ['fullstack', 'separate', 'mobile'],
+    architectureProfiles: ['small', 'medium', 'large'],
+    authenticationModels: ['public', 'undecided', 'supabase'],
+    runtime: 'docker',
+  },
+  contributes: {
+    files: ({ stack }) => Object.entries(buildSupabaseProjectFiles(stack)),
+    environment: environmentContributions,
+    install: () => [{ cwd: '.', command: 'npm', args: ['run', 'supabase:start'] }],
+    docker: dockerContributions,
+    ci: ciContributions,
+    verification: () => [
+      { frontend: 'nextjs', architecture: 'small', authentication: 'public' },
+      { frontend: 'nextjs', architecture: 'large', authentication: 'supabase' },
+      { frontend: 'react', architecture: 'medium', authentication: 'supabase' },
+      { frontend: 'react-native', architecture: 'medium', authentication: 'supabase' },
+    ],
+  },
+})

package/src/stacks/backends/supabase/native.js

@@ -0,0 +1,14 @@
+export function augmentSupabaseNativeFiles(files, answers, stack) {
+  if (stack.backendKey === 'supabase') {
+    files['lib/supabase.ts'] = stack.authentication === 'supabase'
+      ? `import { createClient } from '@supabase/supabase-js'\nimport * as SecureStore from 'expo-secure-store'\n\nconst storage = { getItem: SecureStore.getItemAsync, setItem: SecureStore.setItemAsync, removeItem: SecureStore.deleteItemAsync }\nexport const supabase = createClient(process.env.EXPO_PUBLIC_SUPABASE_URL!, process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY!, { auth: { storage, persistSession: true, autoRefreshToken: true, detectSessionInUrl: false } })\n`
+      : `import { createClient } from '@supabase/supabase-js'\n\nexport const supabase = createClient(process.env.EXPO_PUBLIC_SUPABASE_URL!, process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY!, { auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false } })\n`
+    if (stack.authentication === 'supabase') {
+      files['lib/supabase-lifecycle.ts'] = `import { AppState, type AppStateStatus } from 'react-native'\nimport { supabase } from './supabase'\n\nexport function bindSupabaseAuthLifecycle() {\n  const update = (state: AppStateStatus) => {\n    if (state === 'active') supabase.auth.startAutoRefresh()\n    else supabase.auth.stopAutoRefresh()\n  }\n  update(AppState.currentState)\n  const subscription = AppState.addEventListener('change', update)\n  return () => { subscription.remove(); supabase.auth.stopAutoRefresh() }\n}\n`
+      files['app/login.tsx'] = `import { useState } from 'react'\nimport { Pressable, StyleSheet, Text, TextInput, View } from 'react-native'\nimport { supabase } from '@/lib/supabase'\n\nexport default function LoginScreen() {\n  const [email, setEmail] = useState('')\n  const [password, setPassword] = useState('')\n  const [error, setError] = useState('')\n  const [pending, setPending] = useState(false)\n  async function signIn() {\n    setPending(true); setError('')\n    const result = await supabase.auth.signInWithPassword({ email: email.trim(), password })\n    if (result.error) setError('Unable to sign in with those credentials.')\n    setPending(false)\n  }\n  return <View style={styles.container}><Text accessibilityRole="header">Sign in</Text>{error ? <Text accessibilityRole="alert">{error}</Text> : null}<TextInput accessibilityLabel="Email" autoCapitalize="none" autoComplete="email" keyboardType="email-address" onChangeText={setEmail} value={email} /><TextInput accessibilityLabel="Password" autoComplete="current-password" onChangeText={setPassword} secureTextEntry value={password} /><Pressable accessibilityRole="button" disabled={pending} onPress={signIn}><Text>{pending ? 'Signing in…' : 'Sign in'}</Text></Pressable></View>\n}\nconst styles = StyleSheet.create({ container: { flex: 1, justifyContent: 'center', padding: 24, gap: 12 } })\n`
+      if ((answers.testing || 'basic') !== 'none') files['lib/supabase-lifecycle.test.ts'] = `import { AppState } from 'react-native'\nimport { bindSupabaseAuthLifecycle } from './supabase-lifecycle'\nimport { supabase } from './supabase'\n\njest.mock('./supabase', () => ({ supabase: { auth: { startAutoRefresh: jest.fn(), stopAutoRefresh: jest.fn() } } }))\n\ntest('starts refresh while active and stops it on cleanup', () => {\n  const remove = jest.fn()\n  jest.spyOn(AppState, 'addEventListener').mockReturnValue({ remove } as never)\n  Object.defineProperty(AppState, 'currentState', { configurable: true, value: 'active' })\n  const cleanup = bindSupabaseAuthLifecycle()\n  expect(supabase.auth.startAutoRefresh).toHaveBeenCalled()\n  cleanup()\n  expect(remove).toHaveBeenCalled()\n  expect(supabase.auth.stopAutoRefresh).toHaveBeenCalled()\n})\n`
+    }
+  }
+  return files
+}
+