create-win-project 1.3.0

package/playbooks/stack/nextjs/structure.md

@@ -0,0 +1,50 @@
+# Next.js Structure
+
+## Feature Ownership
+
+`src/app` is the routing shell. Business/application code belongs to its feature.
+
+```text
+src/
+├── app/                    routes and route-level composition
+├── components/ui/          domain-free primitives
+├── components/shared/      UI reused by multiple features
+├── features/
+│   └── users/
+│       ├── components/
+│       ├── queries/
+│       ├── actions/
+│       ├── services/
+│       ├── repositories/   only for Next-owned persistence
+│       ├── api/            only for remote HTTP boundaries
+│       ├── schemas/
+│       └── types.ts
+├── lib/                    shared infrastructure: auth, db, logging, cache
+└── config/                 validated application configuration
+```
+
+Create only folders containing real files. A feature may start with one component and
+one query. Medium defines dependency direction; it does not demand seven directories.
+
+Large features may add `index.ts`, `domain/`, `jobs/`, and colocated tests. `index.ts`
+is the only supported cross-feature import surface in Large projects.
+
+## Backend-Specific Boundaries
+
+| Data owner | Feature boundary | Example |
+|---|---|---|
+| Next.js + Prisma | `repositories/` | `userRepository.ts` |
+| Next.js + Supabase | `repositories/` using the server client | `userRepository.ts` |
+| Spring/external API | `api/` | `usersApi.ts` |
+| Browser-only SDK | feature `api/` or `data/` | never server secrets |
+
+Do not put feature code in `lib/users.ts`, and do not call a Next Route Handler from a
+Server Component merely to reach code in the same process.
+
+## Naming
+
+- Use operation names: `createUser`, `listOrders`, `cancelInvoice`.
+- Name entry points by transport only when helpful: `createUserAction`, `POST`.
+- Keep runtime schemas beside the input or external-response boundary.
+- Mark server-only modules with `import 'server-only'` when accidental client import
+  would expose secrets or privileged access.

package/playbooks/stack/nextjs/testing.md

@@ -0,0 +1,20 @@
+# Next.js Testing
+
+## Test Layers
+
+| Risk | Test |
+|---|---|
+| Schema or pure policy | Vitest unit test |
+| Component behavior/accessibility | React Testing Library |
+| Service orchestration | Unit test with boundary fakes |
+| Repository/API contract | Integration or contract test |
+| Route Handler/Server Function security | Unauthenticated, forbidden, valid tests |
+| Critical user journey | Playwright |
+
+Test observable behavior rather than implementation call counts. Repository tests use the
+real database engine when query behavior matters. Remote API clients use contract fixtures
+that include malformed and failure responses.
+
+Every profile must pass format check, lint, typecheck, tests, and production build. Full
+testing adds Playwright. Large adds import-boundary and public-API checks. Authenticated
+projects test expiry/logout and ensure authorization is enforced below the UI.

package/playbooks/stack/nextjs.manifest.json

@@ -0,0 +1,49 @@
+{
+  "id": "nextjs",
+  "kind": "frontend",
+  "label": "Next.js",
+  "language": "TypeScript",
+  "platform": "web",
+  "appliesTo": { "backend": ["none", "supabase", "springboot", "postgres", "laravel"] },
+  "port": 3000,
+  "needsDocker": false,
+  "frontendDir": "",
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [
+    "stack/nextjs/architecture.md",
+    "stack/nextjs/structure.md",
+    "stack/nextjs/runtime.md",
+    "stack/nextjs/security.md",
+    "stack/nextjs/testing.md"
+  ],
+  "stylingOptions": ["tailwind", "css-modules"],
+  "scripts": { "dev": "next dev", "build": "next build", "test": "vitest run" },
+  "ciTemplate": "nextjs",
+  "envPrefix": "NEXT_PUBLIC_",
+  "dockerTemplate": "nextjs",
+  "agentsTemplate": "nextjs",
+  "gitignoreTemplate": "nextjs",
+  "folders": [],
+  "deps": ["next", "react", "react-dom"],
+  "devDeps": ["typescript", "@types/react", "@types/react-dom", "@types/node", "eslint", "eslint-config-next"],
+  "env": [],
+  "clientEnv": [],
+  "constraints": [
+    "Server Components default; use client only where browser behavior is required",
+    "Medium default: entry point → Service → owned Repository or remote API client"
+  ],
+  "concerns": [
+    { "id": "architecture", "required": true, "playbook": "stack/nextjs/architecture.md", "sections": ["Profiles", "Dependency Direction"] },
+    { "id": "structure", "required": true, "playbook": "stack/nextjs/structure.md", "sections": ["Feature Ownership", "Backend-Specific Boundaries"] },
+    { "id": "runtime", "required": true, "playbook": "stack/nextjs/runtime.md", "sections": ["Server and Client", "Caching and Mutations"] },
+    { "id": "stack-security", "required": true, "playbook": "stack/nextjs/security.md", "sections": ["Authorization", "Sessions"] },
+    { "id": "stack-testing", "required": true, "playbook": "stack/nextjs/testing.md", "sections": ["Test Layers"] },
+    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "Zod Schema Placement"] },
+    { "id": "query", "required": false, "when": "Client needs cached server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook"] },
+    { "id": "state", "required": false, "when": "Shared non-server UI state", "playbook": "concerns/zustand.md", "sections": ["Store Setup"] },
+    { "id": "env", "required": false, "when": "Validating env vars at build time", "playbook": "concerns/t3-env.md", "sections": ["Setup"] },
+    { "id": "url-state", "required": false, "when": "Filter/search/pagination state belongs in URL", "playbook": "concerns/nuqs.md", "sections": ["Basic Usage"] },
+    { "id": "safe-action", "required": false, "when": "Type-safe server actions with auth middleware", "playbook": "concerns/next-safe-action.md", "sections": ["Setup", "Defining an Action"] },
+    { "id": "dark-mode", "required": false, "when": "Project needs dark mode toggle", "playbook": "concerns/next-themes.md", "sections": ["Provider Setup"] }
+  ]
+}

package/playbooks/stack/no-frontend.manifest.json

@@ -0,0 +1,25 @@
+{
+  "id": "no-frontend",
+  "kind": "frontend",
+  "label": "No frontend",
+  "platform": "api",
+  "appliesTo": { "backend": ["springboot", "laravel"] },
+  "port": 0,
+  "needsDocker": false,
+  "frontendDir": "",
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [],
+  "stylingOptions": [],
+  "scripts": {},
+  "ciTemplate": "none",
+  "envPrefix": "",
+  "agentsTemplate": null,
+  "gitignoreTemplate": null,
+  "folders": [],
+  "deps": [],
+  "devDeps": [],
+  "env": [],
+  "clientEnv": [],
+  "constraints": ["No browser or mobile client is generated"],
+  "concerns": []
+}

package/playbooks/stack/none.manifest.json

@@ -0,0 +1,21 @@
+{
+  "id": "none",
+  "kind": "backend",
+  "label": "None / frontend only",
+  "appliesTo": { "frontend": ["nextjs", "react", "react-native"] },
+  "port": 0,
+  "needsDocker": false,
+  "architectureProfiles": ["small", "medium", "large"],
+  "makefileTemplate": "frontend",
+  "playbooks": [],
+  "folders": [],
+  "deps": [],
+  "devDeps": [],
+  "env": ["API_URL"],
+  "clientEnv": ["API_URL"],
+  "constraints": [
+    "No backend is scaffolded; the frontend can remain standalone or connect to an API later",
+    "The generated public API URL is optional until an external API is connected"
+  ],
+  "concerns": []
+}

package/playbooks/stack/react-native.manifest.json

@@ -0,0 +1,49 @@
+{
+  "id": "react-native",
+  "kind": "frontend",
+  "label": "React Native (Expo)",
+  "language": "TypeScript",
+  "platform": "mobile",
+  "appliesTo": { "backend": ["supabase", "springboot", "laravel", "none"] },
+  "port": 8081,
+  "needsDocker": false,
+  "frontendDir": "",
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [
+    "stack/expo/architecture.md",
+    "stack/expo/structure.md",
+    "stack/expo/runtime.md",
+    "stack/expo/security.md",
+    "stack/expo/testing.md"
+  ],
+  "stylingOptions": ["native-styles"],
+  "scripts": { "dev": "expo start", "build": "expo export", "test": "jest --passWithNoTests" },
+  "ciTemplate": "expo",
+  "envPrefix": "EXPO_PUBLIC_",
+  "agentsTemplate": "react-native",
+  "gitignoreTemplate": "react-native",
+  "folders": [],
+  "deps": ["expo", "expo-router", "@expo/metro-runtime", "react", "react-dom", "react-native", "react-native-web", "react-native-safe-area-context"],
+  "devDeps": ["typescript", "@types/react"],
+  "env": [],
+  "clientEnv": [],
+  "constraints": [
+    "No server boundary — every network call is a client-side side effect",
+    "Expo managed workflow — no native build config required",
+    "File-based routing via Expo Router (same mental model as Next.js App Router)",
+    "React Native StyleSheet by default — no styling compiler or web-CSS assumptions",
+    "Auth tokens must use expo-secure-store — never AsyncStorage"
+  ],
+  "concerns": [
+    { "id": "architecture", "required": true, "playbook": "stack/expo/architecture.md", "sections": ["Profiles", "Dependency Direction"] },
+    { "id": "navigation", "required": true, "playbook": "stack/expo/structure.md", "sections": ["Expo Router", "Feature Ownership"] },
+    { "id": "runtime", "required": true, "playbook": "stack/expo/runtime.md", "sections": ["Lifecycle and Remote State"] },
+    { "id": "stack-security", "required": true, "playbook": "stack/expo/security.md", "sections": ["Mobile Trust Boundary", "Session Storage"] },
+    { "id": "stack-testing", "required": true, "playbook": "stack/expo/testing.md", "sections": ["Test Layers"] },
+    { "id": "styling", "required": true, "playbook": "styling/native-styles.md", "sections": ["Default", "Rules"] },
+    { "id": "http-client", "required": false, "when": "The app adopts Axios for a REST API", "playbook": "concerns/axios.md", "sections": ["One Shared Client", "Service Calls apiClient, Hook Calls Service"] },
+    { "id": "query", "required": false, "when": "The app needs cached remote server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook", "QueryClient Setup"] },
+    { "id": "state", "required": false, "when": "Shared state across multiple screens", "playbook": "concerns/zustand.md", "sections": ["Store Setup", "Auth Store Pattern"] },
+    { "id": "validation", "required": false, "when": "Project has forms", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "React Native Form (React Hook Form + Controller)"] }
+  ]
+}

package/playbooks/stack/react-vite/architecture.md

@@ -0,0 +1,33 @@
+# React + Vite Architecture
+
+## Profiles
+
+### Small
+
+Keep route pages thin and place protocol details in a feature data function.
+
+```text
+Page → feature component → feature api/data function → trusted backend
+```
+
+### Medium (default)
+
+Use feature modules containing only the needed components, hooks, API/data functions,
+schemas, and types. A client Service may coordinate UI workflows, but it is never a
+trusted business or authorization boundary.
+
+### Large
+
+Keep the Medium vocabulary and add explicit feature `index.ts` public APIs, automated
+cross-feature import checks, API contract tests, and documented remote/client/URL state
+ownership. Do not reproduce server Repository layers in a browser bundle.
+
+## Dependency Direction
+
+```text
+router/page → feature UI/hook → feature API/data function → shared transport → backend
+```
+
+The backend or Supabase RLS authenticates and authorizes. Browser code renders decisions
+but cannot enforce them. Features may consume another feature only through its public API
+in Large projects.

package/playbooks/stack/react-vite/runtime.md

@@ -0,0 +1,13 @@
+# React + Vite Runtime
+
+## Remote State
+
+Use local component state for interaction, URL state for shareable navigation, and a
+query library only when caching/invalidation/polling/optimistic updates justify it. Do not
+copy remote records into a general client store.
+
+- Native `fetch` is the default; centralize base URL and safe error parsing once shared.
+- Cancel work tied to component lifetime and never blindly retry writes.
+- Every `VITE_` environment variable is public.
+- Production hosting needs an SPA fallback for client routes.
+- Loading, empty, error, retry, and stale states are product behavior, not polish.

package/playbooks/stack/react-vite/security.md

@@ -0,0 +1,16 @@
+# React + Vite Security
+
+## Browser Trust Boundary
+
+Everything shipped from `frontend/src` is observable and modifiable. Never place database
+passwords, service keys, OAuth client secrets, or authorization rules in the SPA.
+
+Route guards improve navigation only. The backend or RLS must reject unauthorized direct
+requests and enforce resource ownership. Validate external responses before trusting
+them. Prefer relative validated return paths and redact credentials and personal data
+from logs.
+
+For Supabase, the SDK owns browser session refresh; do not add an Axios refresh system.
+For a Spring browser session, send credentials only to the exact allowed origin and use
+the server-issued CSRF token. For OIDC, use Authorization Code with PKCE through a
+maintained client; never implement token rotation by hand.

package/playbooks/stack/react-vite/structure.md

@@ -0,0 +1,23 @@
+# React + Vite Structure
+
+## Feature Ownership
+
+```text
+frontend/src/
+├── app/                 providers and router composition
+├── pages/               route-level composition
+├── components/ui/       domain-free primitives
+├── components/shared/   cross-feature UI
+├── features/tasks/
+│   ├── components/
+│   ├── hooks/
+│   ├── api.ts           REST/external protocol
+│   ├── data.ts          Supabase queries when applicable
+│   ├── schema.ts
+│   └── types.ts
+└── lib/                 shared transport and SDK construction
+```
+
+Create a directory only with its first real file. URLs, wire DTOs, Supabase queries, and
+error normalization stay outside visual components. Cross-feature types become shared
+only after genuine reuse. Large modules expose `index.ts`; consumers do not deep import.

package/playbooks/stack/react-vite/testing.md

@@ -0,0 +1,12 @@
+# React + Vite Testing
+
+## Test Layers
+
+- Unit-test schemas, normalization, and pure client policies.
+- Test components by accessible behavior with React Testing Library.
+- Contract-test feature API/data functions, including malformed and rejected responses.
+- Use Playwright for critical navigation, login, authorization failures, and recovery.
+- Large projects verify public feature imports automatically.
+
+Every profile passes format check, lint, typecheck, unit tests, and production build.
+Full testing adds Playwright; authentication adds logout/expiry and forbidden-state tests.

package/playbooks/stack/react-vite.manifest.json

@@ -0,0 +1,46 @@
+{
+  "id": "react",
+  "kind": "frontend",
+  "label": "React + Vite",
+  "language": "TypeScript",
+  "platform": "web",
+  "appliesTo": { "backend": ["none", "supabase", "springboot", "laravel"] },
+  "port": 5173,
+  "needsDocker": false,
+  "frontendDir": "frontend",
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [
+    "stack/react-vite/architecture.md",
+    "stack/react-vite/structure.md",
+    "stack/react-vite/runtime.md",
+    "stack/react-vite/security.md",
+    "stack/react-vite/testing.md"
+  ],
+  "stylingOptions": ["tailwind", "css-modules"],
+  "scripts": { "dev": "vite", "build": "vite build", "test": "vitest run" },
+  "ciTemplate": "vite",
+  "envPrefix": "VITE_",
+  "dockerTemplate": "vite",
+  "agentsTemplate": "react-vite",
+  "gitignoreTemplate": "react-vite",
+  "folders": [],
+  "deps": ["react", "react-dom"],
+  "devDeps": ["vite", "typescript", "@vitejs/plugin-react", "@types/react", "@types/react-dom", "@types/node", "eslint", "@eslint/js", "typescript-eslint"],
+  "env": [],
+  "clientEnv": [],
+  "constraints": [
+    "SPA exposes everything to the browser — never use the service role key client-side",
+    "Full Docker: React + backend + PostgreSQL for Spring Boot combos"
+  ],
+  "concerns": [
+    { "id": "architecture", "required": true, "playbook": "stack/react-vite/architecture.md", "sections": ["Profiles", "Dependency Direction"] },
+    { "id": "structure", "required": true, "playbook": "stack/react-vite/structure.md", "sections": ["Feature Ownership"] },
+    { "id": "runtime", "required": true, "playbook": "stack/react-vite/runtime.md", "sections": ["Remote State"] },
+    { "id": "stack-security", "required": true, "playbook": "stack/react-vite/security.md", "sections": ["Browser Trust Boundary"] },
+    { "id": "stack-testing", "required": true, "playbook": "stack/react-vite/testing.md", "sections": ["Test Layers"] },
+    { "id": "http-client", "required": false, "when": "The app adopts Axios instead of the native fetch client", "playbook": "concerns/axios.md", "sections": ["One Shared Client", "Service Calls apiClient, Hook Calls Service"] },
+    { "id": "validation", "required": false, "when": "Project has forms / runtime input", "playbook": "concerns/zod.md", "sections": ["Schema First, Always", "Web Form (React Hook Form)"] },
+    { "id": "query", "required": false, "when": "Client needs cached server state", "playbook": "concerns/tanstack-query.md", "sections": ["Read Hook", "Mutation Hook"] },
+    { "id": "state", "required": false, "when": "Shared UI state across pages", "playbook": "concerns/zustand.md", "sections": ["Store Setup"] }
+  ]
+}

package/playbooks/stack/springboot/architecture.md

@@ -0,0 +1,40 @@
+# Spring Boot Architecture
+
+## Profiles
+
+### Small
+
+Use a conventional package per feature with one Controller, Service, Repository, request
+and response DTOs, and entity when persistence exists. Do not add interfaces that have
+only one implementation or split a simple operation into ceremonial layers.
+
+```text
+HTTP → Controller → Service → Repository → PostgreSQL
+```
+
+### Medium (default)
+
+Keep package-by-feature and make API, application service, persistence, DTO, and entity
+ownership explicit. Services own transaction boundaries and reusable operations. Features
+communicate through clear application APIs rather than reaching into repositories.
+
+### Large
+
+Build a modular monolith with Spring Modulith. A feature exposes a small API or named
+interface and keeps application, domain, and persistence implementation internal. Verify
+no cycles, no access to internals, and only declared module dependencies. Large does not
+mean microservices.
+
+## Dependency Direction
+
+```text
+web/API → application operation → domain policy → persistence/external adapter
+```
+
+- Controllers translate HTTP and never call repositories.
+- Services do not return `ResponseEntity` or depend on route details.
+- Repositories contain persistence queries, not application policy.
+- Cross-feature work calls a public operation or publishes a deliberate event.
+- External side effects are not assumed successful merely because a transaction commits.
+
+Start at the selected project baseline and let each feature create only the files it uses.

package/playbooks/stack/springboot/runtime.md

@@ -0,0 +1,28 @@
+# Spring Boot Runtime
+
+## Transactions
+
+Application services own transactions spanning multiple writes or read-modify-write
+behavior. Use read-only transactions for coherent multi-query reads when beneficial.
+Database unique/check/foreign-key constraints are the final concurrency boundary; map
+expected constraint conflicts to stable application errors.
+
+Publish noncritical work after commit. Use an outbox or durable queue when delivery must
+survive process failure. Plain `@Async` is not a reliability guarantee.
+
+## Errors and Observability
+
+Services throw custom application exceptions with stable error codes and no HTTP types.
+`@RestControllerAdvice` maps them to RFC 9457 `ProblemDetail`. Include a safe code and
+trace ID; never expose stack traces, SQL, internal hosts, credentials, or sensitive fields.
+
+Use structured PII-safe events. Do not log whole requests, passwords, tokens, cookies, or
+email addresses by default. Health and readiness are different: readiness verifies
+dependencies required to serve traffic.
+
+Configuration comes from validated properties and environment-specific deployment values.
+Keep Open Session in View disabled and schema changes owned by Flyway migrations.
+
+Allowlist client-selected sort fields. Store uploads outside the application tree under
+generated object keys; validate size and content and route untrusted files through the
+product's scanning/quarantine process.

package/playbooks/stack/springboot/security.md

@@ -0,0 +1,28 @@
+# Spring Boot Security
+
+## Authentication Models
+
+The generated authentication choice is authoritative:
+
+- `public`: no user accounts; generated application endpoints are intentionally public.
+- `undecided`: health is public and every other endpoint is denied until auth is designed.
+- `session`: Spring owns a secure browser session; credential cookies require CSRF.
+- `oidc`: an external identity provider owns login, refresh, rotation, and revocation;
+  Spring Resource Server validates access-token signature, issuer, audience, time, and
+  maps scopes/claims to authorities.
+
+Never turn the API into a home-grown authorization server from a short JWT example.
+
+## Authorization
+
+Route rules provide a broad baseline. Enforce feature permissions and resource ownership
+at the application operation or protected data boundary with method security or an
+equivalent policy. Test unauthenticated, authenticated-but-forbidden, and allowed cases.
+
+- Keep CSRF enabled for cookie/browser credentials; disable it only for a documented API
+  that accepts bearer headers and no ambient browser credentials.
+- Configure exact-origin credentialed CORS. Never combine credentials with wildcard origin.
+- Rotate the session ID after login and invalidate server sessions on logout.
+- Hash passwords with a maintained adaptive encoder if the product owns credentials.
+- Rate limit login, recovery, and other abuse-sensitive operations.
+- Treat role claims as inputs to server policy, not proof of resource ownership.

package/playbooks/stack/springboot/structure.md

@@ -0,0 +1,30 @@
+# Spring Boot Structure
+
+## Package by Feature
+
+Place the application class in the root package. Organize business code below it by
+feature, never in one global controller/service/repository layer.
+
+```text
+com.example.app/
+├── Application.java
+├── users/
+│   ├── api/              controllers and transport DTOs (Medium/Large)
+│   ├── service/          application operations
+│   ├── repository/       persistence boundary
+│   └── entity/           persistence/domain model
+├── orders/
+└── shared/               small technical foundations, not shared business dumping ground
+```
+
+Small may keep the few feature classes directly under `users/`. Medium uses the named
+subpackages when multiple files make ownership clearer. Large exposes types in the module
+base/API package and places implementation below `internal/` as required by the generated
+Spring Modulith verification.
+
+- Use constructor injection.
+- Prefer Java records for immutable transport DTOs; classes remain valid when framework
+  or modeling needs require them.
+- Do not use Lombok `@Data` on JPA entities. Define equality from stable identity and keep
+  secrets/relationships out of `toString`.
+- Use database-native identity types and constraints deliberately.

package/playbooks/stack/springboot/testing.md

@@ -0,0 +1,22 @@
+# Spring Boot Testing
+
+## Test Layers
+
+| Risk | Test |
+|---|---|
+| Pure policy/value object | JUnit unit test |
+| Service orchestration/error code | Focused unit test with boundary fakes |
+| MVC validation/error/security | MVC slice test without a database |
+| Custom repository/Flyway/constraints | PostgreSQL Testcontainers integration |
+| Feature module | Module integration test |
+| Large boundaries | Spring Modulith `ApplicationModules.verify()` |
+
+Do not use H2 as proof that PostgreSQL queries or migrations work. Standard Spring Data
+methods need no dedicated test, but custom queries, constraints, locking, and migrations do.
+
+Test behavior and risk rather than every public method or mock call. Authentication tests
+cover session expiry/logout/CSRF or invalid JWT issuer, audience, signature, and expiry as
+applicable. Authorization tests include resource ownership, not roles alone.
+
+Every profile runs Maven tests and package. Full testing runs PostgreSQL integration tests;
+Large additionally fails on cycles and access to module internals.

package/playbooks/stack/springboot.manifest.json

@@ -0,0 +1,38 @@
+{
+  "id": "springboot",
+  "kind": "backend",
+  "label": "Spring Boot",
+  "language": "Java",
+  "appliesTo": { "frontend": ["nextjs", "react", "react-native"] },
+  "port": 8080,
+  "needsDocker": true,
+  "architectureProfiles": ["small", "medium", "large"],
+  "playbooks": [
+    "stack/springboot/architecture.md",
+    "stack/springboot/structure.md",
+    "stack/springboot/runtime.md",
+    "stack/springboot/security.md",
+    "stack/springboot/testing.md",
+    { "file": "capabilities/auth/spring-session.md", "appliesWhen": { "authentication": "session" } },
+    { "file": "capabilities/auth/oidc-resource-server.md", "appliesWhen": { "authentication": "oidc" } }
+  ],
+  "makefileTemplate": "springboot",
+  "folders": [],
+  "deps": [],
+  "devDeps": [],
+  "env": ["API_URL", "DATABASE_URL", "POSTGRES_USER", "POSTGRES_PASSWORD", "POSTGRES_DB", "SPRING_PROFILES_ACTIVE"],
+  "clientEnv": ["API_URL"],
+  "constraints": [
+    "Spring Boot owns server-side business logic, authorization, and data access",
+    "Security starts deny-by-default; add authentication through Spring Security rather than hand-rolled token code"
+  ],
+  "concerns": [
+    { "id": "architecture", "required": true, "playbook": "stack/springboot/architecture.md", "sections": ["Profiles", "Dependency Direction"] },
+    { "id": "structure", "required": true, "playbook": "stack/springboot/structure.md", "sections": ["Package by Feature"] },
+    { "id": "runtime", "required": true, "playbook": "stack/springboot/runtime.md", "sections": ["Transactions", "Errors and Observability"] },
+    { "id": "stack-security", "required": true, "playbook": "stack/springboot/security.md", "sections": ["Authentication Models", "Authorization"] },
+    { "id": "stack-testing", "required": true, "playbook": "stack/springboot/testing.md", "sections": ["Test Layers"] },
+    { "id": "session-auth", "required": true, "appliesWhen": { "authentication": "session" }, "playbook": "capabilities/auth/spring-session.md", "sections": ["Session Ownership", "Required Tests"] },
+    { "id": "oidc-auth", "required": true, "appliesWhen": { "authentication": "oidc" }, "playbook": "capabilities/auth/oidc-resource-server.md", "sections": ["Provider and API Responsibilities", "Required Tests"] }
+  ]
+}