create-win-project 1.3.0 → 2.0.0

package/{playbooks/stack/react-native.manifest.json → library/stacks/expo/definition.json}

@@ -4,7 +4,7 @@
   "label": "React Native (Expo)",
   "language": "TypeScript",
   "platform": "mobile",
-  "appliesTo": { "backend": ["supabase", "springboot", "laravel", "none"] },
+  "appliesTo": { "backend": ["supabase", "springboot", "laravel", "none", "fastapi"] },
   "port": 8081,
   "needsDocker": false,
   "frontendDir": "",
@@ -44,6 +44,6 @@
     { "id": "http-client", "required": false, "when": "The app adopts Axios for a REST API", "playbook": "concerns/axios.md", "sections": ["One Shared Client", "Service Calls apiClient, Hook Calls Service"] },
     { "id": "query", "required": false, "when": "The app needs cached remote server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook", "QueryClient Setup"] },
     { "id": "state", "required": false, "when": "Shared state across multiple screens", "playbook": "concerns/zustand.md", "sections": ["Store Setup", "Auth Store Pattern"] },
-    { "id": "validation", "required": false, "when": "Project has forms", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "React Native Form (React Hook Form + Controller)"] }
+    { "id": "validation", "required": false, "when": "Project has forms", "playbook": "concerns/zod/validation.md", "sections": ["Schema First, Always", "React Native Form (React Hook Form + Controller)"] }
   ]
 }

package/library/stacks/fastapi/architecture.md

@@ -0,0 +1,40 @@
+# FastAPI Architecture
+
+## Profiles
+
+### Small
+
+Use a compact application package with configuration, database, security, and route
+modules. Do not add service/repository layers that have only one caller or split a
+simple operation into ceremonial layers.
+
+```text
+HTTP → Router → Service function → AsyncSession → PostgreSQL
+```
+
+### Medium (default)
+
+Keep feature-oriented routers, services, repositories, schemas, and shared core
+infrastructure explicit. Services own transaction boundaries and reusable operations.
+Features communicate through clear service APIs rather than reaching into repositories.
+
+### Large
+
+Build bounded feature modules with explicit public module interfaces. A feature exposes
+a small router/service API and keeps repository and schema implementation internal.
+Verify no cycles, no access to internals, and only declared module dependencies with
+the generated architecture-boundary tests. Large does not mean microservices.
+
+## Dependency Direction
+
+```text
+web/API → application operation → domain policy → persistence/external adapter
+```
+
+- Routers translate HTTP and never touch the database session directly.
+- Services do not return HTTP responses or depend on route details.
+- Repositories contain persistence queries, not application policy.
+- Cross-feature work calls a public operation or publishes a deliberate event.
+- External side effects are not assumed successful merely because a transaction commits.
+
+Start at the selected project baseline and let each feature create only the files it uses.

package/library/stacks/fastapi/definition.json

@@ -0,0 +1,39 @@
+{
+  "id": "fastapi",
+  "kind": "backend",
+  "label": "FastAPI",
+  "language": "Python",
+  "appliesTo": { "frontend": ["nextjs", "react", "react-native", "no-frontend"] },
+  "port": 8000,
+  "needsDocker": true,
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [
+    "stack/fastapi/architecture.md",
+    "stack/fastapi/structure.md",
+    "stack/fastapi/runtime.md",
+    "stack/fastapi/security.md",
+    "stack/fastapi/testing.md",
+    "capabilities/sqlalchemy-alembic.md",
+    { "file": "capabilities/auth/oidc-resource-server.md", "appliesWhen": { "authentication": "oidc" } }
+  ],
+  "makefileTemplate": "fastapi",
+  "folders": [],
+  "deps": [],
+  "devDeps": [],
+  "env": ["API_URL", "DATABASE_URL", "POSTGRES_USER", "POSTGRES_PASSWORD", "POSTGRES_DB", "OIDC_ISSUER", "OIDC_AUDIENCE", "OIDC_ALGORITHMS", "OIDC_JWKS_URL", "CORS_ALLOWED_ORIGINS"],
+  "clientEnv": ["API_URL"],
+  "constraints": [
+    "FastAPI owns server-side business logic, authorization, and data access",
+    "Security starts deny-by-default; add authentication through OIDC bearer validation rather than hand-rolled token code",
+    "Application startup must not automatically migrate production databases"
+  ],
+  "concerns": [
+    { "id": "architecture", "required": true, "playbook": "stack/fastapi/architecture.md", "sections": ["Profiles", "Dependency Direction"] },
+    { "id": "structure", "required": true, "playbook": "stack/fastapi/structure.md", "sections": ["Package by Feature"] },
+    { "id": "runtime", "required": true, "playbook": "stack/fastapi/runtime.md", "sections": ["Configuration and Lifecycle", "Errors and Observability"] },
+    { "id": "stack-security", "required": true, "playbook": "stack/fastapi/security.md", "sections": ["Authentication Models", "Authorization"] },
+    { "id": "stack-testing", "required": true, "playbook": "stack/fastapi/testing.md", "sections": ["Test Layers"] },
+    { "id": "persistence", "required": true, "playbook": "capabilities/sqlalchemy-alembic.md", "sections": ["Session Ownership", "Migrations"] },
+    { "id": "oidc-auth", "required": true, "appliesWhen": { "authentication": "oidc" }, "playbook": "capabilities/auth/oidc-resource-server.md", "sections": ["Provider and API Responsibilities", "Required Tests"] }
+  ]
+}

package/library/stacks/fastapi/runtime.md

@@ -0,0 +1,25 @@
+# FastAPI Runtime
+
+## Configuration and Lifecycle
+
+Configuration comes from validated Pydantic Settings and environment-specific deployment
+values. The application exposes public `GET /health` and dependency-aware `GET /ready`
+readiness separately. Readiness verifies dependencies required to serve traffic.
+
+Manage dependencies with uv and a frozen lockfile (`uv sync --frozen`). Run with
+Uvicorn. Keep schema changes owned by Alembic migrations invoked explicitly via
+`alembic upgrade head`; application startup must not automatically migrate production
+databases.
+
+## Errors and Observability
+
+Services raise typed application exceptions with stable error codes and no HTTP types.
+Exception handlers map them to RFC 9457 problem details. Include a safe code and
+trace ID; never expose stack traces, SQL, internal hosts, credentials, or sensitive fields.
+
+Use structured PII-safe events. Do not log whole requests, passwords, tokens, cookies, or
+email addresses by default.
+
+Configure exact-origin CORS from `CORS_ALLOWED_ORIGINS`. Store uploads outside the
+application tree under generated object keys; validate size and content and route
+untrusted files through the product's scanning/quarantine process.

package/library/stacks/fastapi/security.md

@@ -0,0 +1,26 @@
+# FastAPI Security
+
+## Authentication Models
+
+The generated authentication choice is authoritative:
+
+- `public`: no user accounts; generated application endpoints are intentionally public.
+- `undecided`: health is public and every other endpoint is denied until auth is designed.
+- `oidc`: an external identity provider owns login, refresh, rotation, and revocation;
+  FastAPI validates bearer issuer, audience, algorithm, JWKS signature, expiry, and claims
+  on every protected API request. Session authentication is not offered.
+
+Never turn the API into a home-grown authorization server from a short JWT example.
+
+## Authorization
+
+Route dependencies provide a broad baseline. Enforce feature permissions and resource
+ownership at the application operation or protected data boundary with explicit
+dependencies. Test unauthenticated, authenticated-but-forbidden, and allowed cases.
+
+- Keep public health endpoints separate from protected API routes.
+- Configure OIDC issuer, audience, allowed algorithms, JWKS retrieval, and claim
+  validation from environment; deny by default.
+- Configure exact-origin CORS. Never combine credentials with wildcard origin.
+- Rate limit login, recovery, and other abuse-sensitive operations.
+- Treat role claims as inputs to server policy, not proof of resource ownership.

package/library/stacks/fastapi/structure.md

@@ -0,0 +1,27 @@
+# FastAPI Structure
+
+## Package by Feature
+
+Place the application entrypoint in the `app` package. Organize business code below it by
+feature, never in one global router/service/repository layer.
+
+```text
+app/
+├── main.py
+├── core/               settings, database, security, logging (Medium/Large)
+├── modules/status/     router, service, repository, schemas (Large)
+├── features/status/    router, service, repository, schemas (Medium)
+└── routes_health.py    public health/readiness (Small)
+```
+
+Small may keep the few feature modules directly under `app/`. Medium uses the named
+`features/` packages when multiple files make ownership clearer. Large exposes types in
+the module base/`__init__.py` public interface and places implementation in submodules
+as required by the generated boundary tests.
+
+Backend-only projects live at the repository root. Paired backends live under `backend/`.
+
+- Use explicit imports; re-export only the public module interface from `__init__.py`.
+- Prefer Pydantic v2 models for transport schemas; keep ORM models persistence-only.
+- Do not invent users, products, or other business entities in the baseline.
+- Use database-native identity types and constraints deliberately.

package/library/stacks/fastapi/testing.md

@@ -0,0 +1,23 @@
+# FastAPI Testing
+
+## Test Layers
+
+| Risk | Test |
+|---|---|
+| Pure policy/value object | pytest unit test |
+| Service orchestration/error code | Focused unit test with boundary fakes |
+| Router validation/error/security | HTTPX async test without a database |
+| Custom repository/Alembic/constraints | PostgreSQL integration test |
+| Feature module | Module integration test |
+| Large boundaries | Generated boundary test (no internal imports) |
+
+Do not use SQLite as proof that PostgreSQL queries or migrations work. Standard CRUD
+methods need no dedicated test, but custom queries, constraints, locking, and migrations do.
+
+Test behavior and risk rather than every public function or mock call. Authentication tests
+cover missing bearer tokens and invalid issuer, audience, signature, expiry, and required
+claims. Authorization tests include resource ownership, not roles alone.
+
+Every profile runs `ruff check`, `ruff format --check`, `mypy`, and `pytest`. Full testing
+runs PostgreSQL integration tests; Large additionally fails on cycles and access to
+module internals.

package/{playbooks/stack/nextjs.manifest.json → library/stacks/nextjs/definition.json}

@@ -4,7 +4,7 @@
   "label": "Next.js",
   "language": "TypeScript",
   "platform": "web",
-  "appliesTo": { "backend": ["none", "supabase", "springboot", "postgres", "laravel"] },
+  "appliesTo": { "backend": ["none", "supabase", "springboot", "postgres", "laravel", "fastapi"] },
   "port": 3000,
   "needsDocker": false,
   "frontendDir": "",
@@ -38,7 +38,7 @@
     { "id": "runtime", "required": true, "playbook": "stack/nextjs/runtime.md", "sections": ["Server and Client", "Caching and Mutations"] },
     { "id": "stack-security", "required": true, "playbook": "stack/nextjs/security.md", "sections": ["Authorization", "Sessions"] },
     { "id": "stack-testing", "required": true, "playbook": "stack/nextjs/testing.md", "sections": ["Test Layers"] },
-    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "Zod Schema Placement"] },
+    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod/validation.md", "sections": ["Schema First, Always", "Zod Schema Placement"] },
     { "id": "query", "required": false, "when": "Client needs cached server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook"] },
     { "id": "state", "required": false, "when": "Shared non-server UI state", "playbook": "concerns/zustand.md", "sections": ["Store Setup"] },
     { "id": "env", "required": false, "when": "Validating env vars at build time", "playbook": "concerns/t3-env.md", "sections": ["Setup"] },

package/{playbooks/stack/no-frontend.manifest.json → library/stacks/no-frontend/definition.json}

@@ -3,7 +3,7 @@
   "kind": "frontend",
   "label": "No frontend",
   "platform": "api",
-  "appliesTo": { "backend": ["springboot", "laravel"] },
+  "appliesTo": { "backend": ["springboot", "laravel", "fastapi"] },
   "port": 0,
   "needsDocker": false,
   "frontendDir": "",

package/{playbooks/stack/react-vite.manifest.json → library/stacks/react-vite/definition.json}

@@ -4,7 +4,7 @@
   "label": "React + Vite",
   "language": "TypeScript",
   "platform": "web",
-  "appliesTo": { "backend": ["none", "supabase", "springboot", "laravel"] },
+  "appliesTo": { "backend": ["none", "supabase", "springboot", "laravel", "fastapi"] },
   "port": 5173,
   "needsDocker": false,
   "frontendDir": "frontend",
@@ -39,7 +39,7 @@
     { "id": "stack-security", "required": true, "playbook": "stack/react-vite/security.md", "sections": ["Browser Trust Boundary"] },
     { "id": "stack-testing", "required": true, "playbook": "stack/react-vite/testing.md", "sections": ["Test Layers"] },
     { "id": "http-client", "required": false, "when": "The app adopts Axios instead of the native fetch client", "playbook": "concerns/axios.md", "sections": ["One Shared Client", "Service Calls apiClient, Hook Calls Service"] },
-    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "Web Form (React Hook Form)"] },
+    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod/validation.md", "sections": ["Schema First, Always", "Web Form (React Hook Form)"] },
     { "id": "query", "required": false, "when": "Client needs cached server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook"] },
     { "id": "state", "required": false, "when": "Shared UI state across pages", "playbook": "concerns/zustand.md", "sections": ["Store Setup"] }
   ]

package/{compatibility/profiles.json → library/tested-versions.json}

@@ -9,11 +9,15 @@
       "springModulith": "2.0.8",
       "runtimes": {
         "node": "24.20.0",
+        "nodeMinimum": "22.14.0",
+        "npmMinimum": "11.19.0",
         "java": "21",
         "maven": "3.9.16",
         "postgres": "16",
         "php": "8.5.10",
-        "composer": "2.10.3"
+        "composer": "2.10.3",
+        "python": "3.14.7",
+        "uv": "0.12.10"
       },
       "images": {
         "node": {
@@ -43,8 +47,26 @@
         "composer": {
           "repository": "composer",
           "tag": "2.10.3"
+        },
+        "python": {
+          "repository": "python",
+          "tag": "3.14.7-slim"
         }
       },
+      "pythonPackages": {
+        "alembic": "1.19.2",
+        "asyncpg": "0.31.0",
+        "fastapi": "0.141.1",
+        "httpx": "0.28.1",
+        "mypy": "2.3.1",
+        "pydantic-settings": "2.15.0",
+        "pyjwt": "2.13.0",
+        "pytest": "9.1.1",
+        "pytest-asyncio": "1.4.0",
+        "ruff": "0.16.6",
+        "sqlalchemy": "2.0.52",
+        "uvicorn": "0.52.4"
+      },
       "composerPackages": {
         "auth0/login": "7.22.0",
         "fakerphp/faker": "1.24.1",
@@ -125,11 +147,15 @@
       "springModulith": "2.0.8",
       "runtimes": {
         "node": "24.20.0",
+        "nodeMinimum": "22.14.0",
+        "npmMinimum": "11.19.0",
         "java": "21",
         "maven": "3.9.16",
         "postgres": "16",
         "php": "8.5.10",
-        "composer": "2.10.3"
+        "composer": "2.10.3",
+        "python": "3.13.15",
+        "uv": "0.12.10"
       },
       "images": {
         "node": {
@@ -159,8 +185,26 @@
         "composer": {
           "repository": "composer",
           "tag": "2.10.3"
+        },
+        "python": {
+          "repository": "python",
+          "tag": "3.13.15-slim"
         }
       },
+      "pythonPackages": {
+        "alembic": "1.19.2",
+        "asyncpg": "0.31.0",
+        "fastapi": "0.141.1",
+        "httpx": "0.28.1",
+        "mypy": "2.3.1",
+        "pydantic-settings": "2.15.0",
+        "pyjwt": "2.13.0",
+        "pytest": "9.1.1",
+        "pytest-asyncio": "1.4.0",
+        "ruff": "0.16.6",
+        "sqlalchemy": "2.0.52",
+        "uvicorn": "0.52.4"
+      },
       "composerPackages": {
         "auth0/login": "7.22.0",
         "fakerphp/faker": "1.24.1",

package/{playbooks/universal/accessibility.manifest.json → library/universal/accessibility/definition.json}

@@ -2,10 +2,10 @@
   "id": "accessibility-baseline",
   "kind": "universal",
   "label": "Accessibility Baseline",
+  "file": "universal/accessibility.md",
   "required": true,
   "folders": [],
   "concerns": [
     { "id": "accessibility", "required": true, "sections": ["Semantic Structure", "Keyboard and Focus", "Forms and Authentication", "Accessibility Testing"] }
   ]
 }
-

package/library/universal/coding-rules/definition.json

@@ -0,0 +1,13 @@
+{
+  "id": "coding-rules",
+  "kind": "universal",
+  "label": "Coding Rules",
+  "playbooks": ["universal/coding-rules/naming.md", "universal/coding-rules/hygiene.md"],
+  "required": true,
+  "folders": [],
+  "devDeps": ["prettier"],
+  "concerns": [
+    { "id": "naming", "required": true, "playbook": "universal/coding-rules/naming.md", "sections": ["Naming", "Functions", "Imports", "Constants"] },
+    { "id": "no-debug", "required": true, "playbook": "universal/coding-rules/hygiene.md", "sections": ["No Debug Code in Commits", "One Thing Per File"] }
+  ]
+}

package/library/universal/coding-rules/hygiene.md

@@ -0,0 +1,9 @@
+# Code hygiene
+
+## No Debug Code in Commits
+
+Remove temporary logging, breakpoints, fixtures, bypasses, and commented-out implementations. Retain structured operational logging only when it has defined level, fields, privacy handling, and ownership.
+
+## One Thing Per File
+
+A file should have one clear reason to change. Keep tightly coupled helpers beside their owner, but split unrelated components, routes, services, or policies. Do not create one-line files merely to satisfy this rule.

package/library/universal/coding-rules/naming.md

@@ -0,0 +1,17 @@
+# Naming and structure
+
+## Naming
+
+Use names that describe domain intent. Avoid unexplained abbreviations, generic `data`/`utils` modules, and names that repeat their containing folder.
+
+## Functions
+
+Keep functions focused, make side effects visible, validate at boundaries, and return early for invalid states.
+
+## Imports
+
+Group platform, external, and local imports consistently. Respect architecture boundaries and remove unused imports.
+
+## Constants
+
+Name shared constants by meaning, keep feature-local values near their owner, and do not disguise mutable state as a constant.

package/{playbooks/universal/error-handling.manifest.json → library/universal/error-handling/definition.json}

@@ -2,6 +2,7 @@
   "id": "error-handling",
   "kind": "universal",
   "label": "Error Handling",
+  "file": "universal/error-handling.md",
   "required": true,
   "folders": [],
   "concerns": [

package/library/universal/git-conventions/branches.md

@@ -0,0 +1,5 @@
+# Git branches
+
+## Branch Structure
+
+Branch from the documented integration branch. Use short prefixes such as `feature/`, `fix/`, `docs/`, `refactor/`, or `chore/`, followed by a specific kebab-case purpose. Keep unrelated work on separate branches.

package/library/universal/git-conventions/commits.md

@@ -0,0 +1,7 @@
+# Git commits
+
+## Commit Convention
+
+Use `type(scope): imperative summary`. Each commit should represent one coherent, testable change and must not include secrets, generated noise, debug code, or unrelated formatting.
+
+Explain motivation and migration impact in the body when the diff alone is insufficient.

package/library/universal/git-conventions/definition.json

@@ -0,0 +1,13 @@
+{
+  "id": "git-conventions",
+  "kind": "universal",
+  "label": "Git Conventions",
+  "playbooks": ["universal/git-conventions/branches.md", "universal/git-conventions/commits.md", "universal/git-conventions/workflow.md"],
+  "required": true,
+  "folders": [],
+  "concerns": [
+    { "id": "git-branches", "required": true, "playbook": "universal/git-conventions/branches.md", "sections": ["Branch Structure"] },
+    { "id": "git-commits", "required": true, "playbook": "universal/git-conventions/commits.md", "sections": ["Commit Convention"] },
+    { "id": "git-workflow", "required": true, "playbook": "universal/git-conventions/workflow.md", "sections": ["Daily Workflow"] }
+  ]
+}

package/library/universal/git-conventions/workflow.md

@@ -0,0 +1,5 @@
+# Git workflow
+
+## Daily Workflow
+
+Inspect status and upstream changes before editing. Preserve user work, stage deliberately, review the staged diff, and run risk-appropriate checks before committing. Do not push, merge, rewrite shared history, or create releases without authorization.

package/{playbooks/universal/observability.manifest.json → library/universal/observability/definition.json}

@@ -2,6 +2,7 @@
   "id": "observability-baseline",
   "kind": "universal",
   "label": "Observability Baseline",
+  "file": "universal/observability.md",
   "required": true,
   "folders": [],
   "concerns": [

package/{playbooks/universal/security.manifest.json → library/universal/security/definition.json}

@@ -2,6 +2,7 @@
   "id": "security-baseline",
   "kind": "universal",
   "label": "Security Baseline",
+  "file": "universal/security.md",
   "required": true,
   "folders": [],
   "concerns": [

package/library/universal/typescript/boundaries.md

@@ -0,0 +1,13 @@
+# TypeScript boundaries
+
+## Strict Mode — Always On
+
+Keep `strict` enabled. Model inputs at trust boundaries as `unknown`, validate them, then pass typed values inward. Do not weaken compiler options for one failing file.
+
+## No any
+
+Avoid `any`. Prefer `unknown`, generics, discriminated unions, or a narrow local type. If an external library forces an escape hatch, isolate and document it at the adapter boundary.
+
+## Type vs Interface
+
+Use interfaces for extendable object contracts and types for unions, intersections, mapped types, and aliases. Consistency within a feature matters more than stylistic conversion.

package/library/universal/typescript/definition.json

@@ -0,0 +1,12 @@
+{
+  "id": "typescript",
+  "kind": "universal",
+  "label": "TypeScript",
+  "playbooks": ["universal/typescript/boundaries.md", "universal/typescript/errors.md", "universal/typescript/patterns.md"],
+  "required": true,
+  "folders": [],
+  "concerns": [
+    { "id": "typescript-strict", "required": true, "playbook": "universal/typescript/boundaries.md", "sections": ["Strict Mode — Always On", "No any", "Type vs Interface"] },
+    { "id": "validation", "required": false, "when": "Project validates external/runtime input", "playbook": "universal/typescript/patterns.md", "sections": ["Zod for Runtime Validation"] }
+  ]
+}

package/library/universal/typescript/errors.md

@@ -0,0 +1,5 @@
+# TypeScript errors
+
+## Typed Errors
+
+Represent expected failures with stable codes or discriminated results. Preserve causes for server logs, return safe messages at external boundaries, and exhaustively handle variants with `never` checks.

package/library/universal/typescript/patterns.md

@@ -0,0 +1,7 @@
+# TypeScript patterns
+
+## Zod for Runtime Validation
+
+Static types do not validate runtime data. Parse environment variables, requests, storage, and third-party responses at entry points. Export the inferred type from the schema instead of maintaining a duplicate interface.
+
+Prefer small pure functions, explicit return types on public APIs, `satisfies` for configuration, and immutable inputs where mutation is not part of the contract.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-win-project",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "Project scaffolding CLI by Win",
   "main": "index.js",
   "type": "module",
@@ -13,15 +13,12 @@
   },
   "files": [
     "index.js",
-    "lib",
-    "compatibility",
-    "playbooks",
-    "ci",
+    "src",
+    "library",
     "templates",
-    "scripts",
-    "docs/ARCHITECTURE.md",
-    "docs/CONTENT_MODEL.md",
-    "docs/DEPENDENCY_MAINTENANCE.md",
+    "checks",
+    "public/logo.svg",
+    "docs",
     "README.md",
     "LICENSE"
   ],
@@ -29,13 +26,15 @@
     "start": "node index.js",
     "doctor": "node index.js doctor",
     "test": "vitest run",
-    "validate:content": "node scripts/validate-content.mjs",
-    "matrix:smoke": "node scripts/compatibility-matrix.mjs --scope=smoke",
-    "matrix:full": "node scripts/compatibility-matrix.mjs --scope=full",
-    "verify:generated": "node scripts/verify-generated.mjs"
+    "validate:content": "node checks/check-library.js",
+    "package:check": "node checks/check-package.js",
+    "matrix:smoke": "node checks/check-compatibility.js --scope=smoke",
+    "matrix:full": "node checks/check-compatibility.js --scope=full",
+    "verify:generated": "node checks/check-generated-project.js"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=22.14",
+    "npm": ">=11.19"
   },
   "dependencies": {
     "chalk": "5.6.2",
@@ -44,6 +43,6 @@
     "ora": "7.0.1"
   },
   "devDependencies": {
-    "vitest": "2.1.9"
+    "vitest": "5.0.0"
   }
 }

package/public/logo.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" role="img" aria-label="W1N Project logo">
+<title>W1N Project logo</title>
+<style>
+  .bracket { fill: #ffffff; }
+  .accent { fill: #bdfa02; }
+</style>
+<circle cx="128" cy="128" r="128" fill="#0a0a0a" />
+<g class="brackets">
+  <path class="bracket" d="M 90.00 183.50 L 85.50 180.00 L 81.50 162.00 L 84.50 155.00 L 128.00 93.50 L 152.00 93.50 L 153.50 96.00 L 149.50 102.00 L 90.00 183.50 Z" />
+  <path class="bracket" d="M 59.00 162.50 L 46.00 162.50 L 12.50 130.00 L 12.50 126.00 L 46.00 93.50 L 59.00 93.50 L 60.50 102.00 L 34.50 128.00 L 60.50 154.00 L 59.00 162.50 Z" />
+  <path class="bracket" d="M 209.00 162.50 L 196.00 162.50 L 194.50 154.00 L 220.50 127.00 L 194.50 102.00 L 196.00 93.50 L 211.00 94.50 L 242.50 126.00 L 241.50 131.00 L 209.00 162.50 Z" />
+  <path class="bracket" d="M 82.00 151.50 L 79.50 151.00 L 78.50 147.00 L 64.50 79.00 L 64.50 74.00 L 67.00 71.50 L 86.00 71.50 L 89.50 75.00 L 100.50 124.00 L 82.00 151.50 Z" />
+  <path class="bracket" d="M 121.00 183.50 L 114.00 183.50 L 111.50 181.00 L 108.50 163.00 L 124.50 141.00 L 127.00 140.50 L 132.50 162.00 L 121.00 183.50 Z" />
+</g>
+<g class="accents">
+  <path class="accent" d="M 149.00 183.50 L 128.00 183.50 L 126.50 180.00 L 165.50 91.00 L 150.50 89.00 L 171.00 71.50 L 195.00 71.50 L 195.50 78.00 L 149.00 183.50 Z" />
+  <path class="accent" d="M 225.00 183.50 L 173.00 183.50 L 171.50 174.00 L 225.00 172.50 L 225.00 183.50 Z" />
+</g>
+</svg>