create-win-project 1.3.0

package/lib/stacks/contract.js

@@ -0,0 +1,142 @@
+const IDENTIFIER = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+const DEFINITION_FIELDS = new Set(['id', 'kind', 'label', 'compatibleWith', 'capabilities', 'contributes'])
+
+export const STACK_KINDS = Object.freeze(['frontend', 'backend', 'data'])
+export const ARCHITECTURE_PROFILES = Object.freeze(['small', 'medium', 'large'])
+export const APPLICATION_SHAPES = Object.freeze(['fullstack', 'separate', 'api', 'mobile', 'frontend'])
+export const PROMPT_SLOTS = Object.freeze([
+  'frontend-options',
+  'backend-options',
+  'stack-options',
+  'authentication-options',
+  'tooling-options',
+])
+
+export const CONTRIBUTION_HOOKS = Object.freeze([
+  'prompts',
+  'authentication',
+  'files',
+  'environment',
+  'install',
+  'docker',
+  'ci',
+  'verification',
+])
+
+const emptyContribution = () => []
+
+function requireNonEmptyString(value, field) {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error(`Stack adapter ${field} must be a non-empty string`)
+  }
+}
+
+function validateStringList(values, field, allowedValues) {
+  if (!Array.isArray(values) || values.some((value) => typeof value !== 'string')) {
+    throw new Error(`Stack adapter ${field} must be an array of strings`)
+  }
+  if (new Set(values).size !== values.length) {
+    throw new Error(`Stack adapter ${field} must not contain duplicates`)
+  }
+  if (allowedValues) {
+    const unknown = values.find((value) => !allowedValues.includes(value))
+    if (unknown) throw new Error(`Stack adapter ${field} contains unsupported value: ${unknown}`)
+  }
+}
+
+function normalizeCompatibility(compatibleWith = {}) {
+  if (!compatibleWith || typeof compatibleWith !== 'object' || Array.isArray(compatibleWith)) {
+    throw new Error('Stack adapter compatibleWith must be an object')
+  }
+  const normalized = {}
+  for (const [kind, ids] of Object.entries(compatibleWith)) {
+    if (!STACK_KINDS.includes(kind)) {
+      throw new Error(`Stack adapter compatibleWith has unsupported kind: ${kind}`)
+    }
+    validateStringList(ids, `compatibleWith.${kind}`)
+    normalized[kind] = Object.freeze([...ids])
+  }
+  return Object.freeze(normalized)
+}
+
+function normalizeCapabilities(capabilities) {
+  if (!capabilities || typeof capabilities !== 'object' || Array.isArray(capabilities)) {
+    throw new Error('Stack adapter capabilities must be an object')
+  }
+  const {
+    applicationShapes = [],
+    architectureProfiles = ARCHITECTURE_PROFILES,
+    authenticationModels = [],
+    ...custom
+  } = capabilities
+  validateStringList(applicationShapes, 'capabilities.applicationShapes', APPLICATION_SHAPES)
+  validateStringList(architectureProfiles, 'capabilities.architectureProfiles', ARCHITECTURE_PROFILES)
+  validateStringList(authenticationModels, 'capabilities.authenticationModels')
+  if (architectureProfiles.length === 0) {
+    throw new Error('Stack adapter must support at least one architecture profile')
+  }
+  return Object.freeze({
+    ...custom,
+    applicationShapes: Object.freeze([...applicationShapes]),
+    architectureProfiles: Object.freeze([...architectureProfiles]),
+    authenticationModels: Object.freeze([...authenticationModels]),
+  })
+}
+
+function normalizeContributions(contributes = {}) {
+  if (!contributes || typeof contributes !== 'object' || Array.isArray(contributes)) {
+    throw new Error('Stack adapter contributes must be an object')
+  }
+  const unknown = Object.keys(contributes).find((name) => !CONTRIBUTION_HOOKS.includes(name))
+  if (unknown) throw new Error(`Unknown stack adapter contribution hook: ${unknown}`)
+
+  return Object.freeze(Object.fromEntries(CONTRIBUTION_HOOKS.map((name) => {
+    const contribution = contributes[name] || emptyContribution
+    if (typeof contribution !== 'function') {
+      throw new Error(`Stack adapter contribution ${name} must be a function`)
+    }
+    return [name, contribution]
+  })))
+}
+
+/**
+ * Defines the stable boundary between core orchestration and a stack.
+ *
+ * Adapters describe capabilities and return contributions. They do not write
+ * files, install tools, or own dependency versions; core code retains those
+ * side effects and compatibility profiles remain the only version source.
+ */
+export function defineStackAdapter(definition) {
+  if (!definition || typeof definition !== 'object' || Array.isArray(definition)) {
+    throw new Error('Stack adapter definition must be an object')
+  }
+  const unknownField = Object.keys(definition).find((field) => !DEFINITION_FIELDS.has(field))
+  if (unknownField) throw new Error(`Unknown stack adapter field: ${unknownField}`)
+  requireNonEmptyString(definition.id, 'id')
+  if (!IDENTIFIER.test(definition.id)) {
+    throw new Error(`Invalid stack adapter id: ${definition.id}`)
+  }
+  if (!STACK_KINDS.includes(definition.kind)) {
+    throw new Error(`Invalid stack adapter kind for ${definition.id}: ${definition.kind}`)
+  }
+  requireNonEmptyString(definition.label, `${definition.id}.label`)
+
+  return Object.freeze({
+    id: definition.id,
+    kind: definition.kind,
+    label: definition.label,
+    compatibleWith: normalizeCompatibility(definition.compatibleWith),
+    capabilities: normalizeCapabilities(definition.capabilities),
+    contributes: normalizeContributions(definition.contributes),
+  })
+}
+
+export function isStackAdapter(value) {
+  return Boolean(
+    value &&
+    typeof value === 'object' &&
+    IDENTIFIER.test(value.id || '') &&
+    STACK_KINDS.includes(value.kind) &&
+    CONTRIBUTION_HOOKS.every((name) => typeof value.contributes?.[name] === 'function'),
+  )
+}

package/lib/stacks/index.js

@@ -0,0 +1,8 @@
+import { createStackRegistry } from './registry.js'
+import { laravelAdapter } from './laravel/index.js'
+
+// This is the only place stack adapters are assembled. Entries stay explicit
+// so adding a source file never silently changes supported generator behavior.
+export const stackRegistry = createStackRegistry([
+  laravelAdapter,
+])

package/lib/stacks/laravel/architecture.js

@@ -0,0 +1,27 @@
+const php = (value) => `${value.trim()}\n`
+
+export function buildLaravelArchitectureFiles(stack) {
+  if (stack.architecture === 'small') return {}
+  const files = {
+    'app/Actions/GetSystemStatus.php': php(`<?php
+
+namespace App\\Actions;
+
+final class GetSystemStatus
+{
+    /** @return array{status: string, architecture: string} */
+    public function handle(): array
+    {
+        return ['status' => 'ok', 'architecture' => '${stack.architecture}'];
+    }
+}`),
+  }
+  if (stack.architecture === 'large') {
+    files['tests/Architecture/BoundariesTest.php'] = php(`<?php
+
+arch('application does not depend on http adapters')
+    ->expect('App\\Actions')
+    ->not->toUse('App\\Http');`)
+  }
+  return files
+}

package/lib/stacks/laravel/auth/oidc.js

@@ -0,0 +1,13 @@
+export const laravelOidcAuthentication = Object.freeze({
+  id: 'laravel-oidc',
+  provider: 'auth0',
+  composerPackage: 'auth0/login',
+  guard: 'auth0-api',
+  apiMiddleware: 'auth',
+  environment: Object.freeze(['AUTH0_DOMAIN=', 'AUTH0_AUDIENCE=']),
+  acceptsRefreshTokens: false,
+})
+
+export function isLaravelOidc(authentication) {
+  return authentication === laravelOidcAuthentication.id
+}

package/lib/stacks/laravel/auth/public.js

@@ -0,0 +1,28 @@
+const php = (value) => `${value.trim()}\n`
+
+export function buildPublicApiRoutes(authentication) {
+  if (authentication === 'public') return php(`<?php
+
+use App\\Http\\Controllers\\HealthController;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/health', HealthController::class);`)
+
+  if (authentication === 'undecided') return php(`<?php
+
+use App\\Http\\Controllers\\HealthController;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/health', HealthController::class);
+Route::fallback(fn () => response()->json(['message' => 'Authentication is not configured.'], 403));`)
+
+  return null
+}
+
+export function buildUnauthenticatedWebRoutes(home) {
+  return php(`<?php
+
+use Illuminate\\Support\\Facades\\Route;
+
+${home}`)
+}

package/lib/stacks/laravel/auth/sanctum.js

@@ -0,0 +1,14 @@
+export const sanctumSpaAuthentication = Object.freeze({
+  id: 'sanctum-spa',
+  apiMiddleware: 'auth:sanctum',
+  composerPackage: 'laravel/sanctum',
+  middleware: '        $middleware->statefulApi();',
+  environment: Object.freeze([
+    'SANCTUM_STATEFUL_DOMAINS=localhost:5173',
+    'CORS_ALLOWED_ORIGINS=http://localhost:5173',
+  ]),
+})
+
+export function isSanctumSpa(authentication) {
+  return authentication === sanctumSpaAuthentication.id
+}

package/lib/stacks/laravel/auth/session.js

@@ -0,0 +1,17 @@
+export const laravelSessionAuthentication = Object.freeze({
+  id: 'laravel-session',
+  apiMiddleware: 'auth',
+  environment: Object.freeze([
+    'SESSION_DRIVER=database',
+    'SESSION_DOMAIN=localhost',
+    'SESSION_SECURE_COOKIE=false',
+  ]),
+})
+
+export function usesLaravelSession(authentication) {
+  return authentication === laravelSessionAuthentication.id || authentication === 'sanctum-spa'
+}
+
+export function sessionEnvironment(authentication) {
+  return usesLaravelSession(authentication) ? laravelSessionAuthentication.environment : []
+}

package/lib/stacks/laravel/composer.js

@@ -0,0 +1,50 @@
+import { composerPackageVersion } from '../../compatibility.js'
+import { usesLaravelSession } from './auth/session.js'
+import { isSanctumSpa, sanctumSpaAuthentication } from './auth/sanctum.js'
+import { isLaravelOidc, laravelOidcAuthentication } from './auth/oidc.js'
+import { getLaravelUi } from './ui/index.js'
+
+export function buildLaravelComposer(answers, stack) {
+  const version = (name) => composerPackageVersion(stack.profile, name, 'laravel scaffold')
+  const require = {
+    php: stack.profile.runtimes.php,
+    'laravel/framework': version('laravel/framework'),
+  }
+  if (isSanctumSpa(stack.authentication)) {
+    require[sanctumSpaAuthentication.composerPackage] = version(sanctumSpaAuthentication.composerPackage)
+  }
+  if (isLaravelOidc(stack.authentication)) {
+    require[laravelOidcAuthentication.composerPackage] = version(laravelOidcAuthentication.composerPackage)
+  }
+  if (stack.frontendKey === 'laravel-ui') {
+    for (const name of getLaravelUi(stack.laravelUi).composerPackages) require[name] = version(name)
+  }
+  const requireDev = {
+    'laravel/pint': version('laravel/pint'),
+    'larastan/larastan': version('larastan/larastan'),
+    'mockery/mockery': version('mockery/mockery'),
+    'pestphp/pest': version('pestphp/pest'),
+    'pestphp/pest-plugin-laravel': version('pestphp/pest-plugin-laravel'),
+  }
+  if (usesLaravelSession(stack.authentication)) requireDev['fakerphp/faker'] = version('fakerphp/faker')
+  return `${JSON.stringify({
+    name: `app/${answers.projectName}`,
+    type: 'project',
+    description: answers.projectDescription,
+    require,
+    'require-dev': requireDev,
+    autoload: { 'psr-4': { 'App\\': 'app/', 'Database\\Factories\\': 'database/factories/', 'Database\\Seeders\\': 'database/seeders/' } },
+    'autoload-dev': { 'psr-4': { 'Tests\\': 'tests/' } },
+    scripts: {
+      'post-autoload-dump': ['Illuminate\\Foundation\\ComposerScripts::postAutoloadDump', '@php artisan package:discover --ansi'],
+      test: 'php artisan test',
+      format: 'pint',
+      'format:check': 'pint --test',
+      analyse: 'phpstan analyse --memory-limit=1G',
+      check: ['@format:check', '@analyse', '@test'],
+    },
+    config: { 'optimize-autoloader': true, 'preferred-install': 'dist', 'sort-packages': true, 'allow-plugins': { 'pestphp/pest-plugin': true } },
+    'minimum-stability': 'stable',
+    'prefer-stable': true,
+  }, null, 2)}\n`
+}

package/lib/stacks/laravel/generate.js

@@ -0,0 +1,362 @@
+import { buildLaravelComposer } from './composer.js'
+import { buildLaravelArchitectureFiles } from './architecture.js'
+import { buildPublicApiRoutes, buildUnauthenticatedWebRoutes } from './auth/public.js'
+import { laravelSessionAuthentication, sessionEnvironment, usesLaravelSession } from './auth/session.js'
+import { isSanctumSpa, sanctumSpaAuthentication } from './auth/sanctum.js'
+import { isLaravelOidc, laravelOidcAuthentication } from './auth/oidc.js'
+import { getLaravelUi } from './ui/index.js'
+
+const php = (value) => `${value.trim()}\n`
+
+function authFiles(stack) {
+  const loginEnabled = usesLaravelSession(stack.authentication)
+  if (isLaravelOidc(stack.authentication)) return {
+    'config/auth0.php': php(`<?php
+
+use Auth0\\Laravel\\Configuration;
+use Auth0\\SDK\\Configuration\\SdkConfiguration;
+
+return Configuration::VERSION_2 + [
+    'registerGuards' => true,
+    'registerMiddleware' => true,
+    'registerAuthenticationRoutes' => false,
+    'configurationPath' => null,
+    'guards' => [
+        'default' => [
+            Configuration::CONFIG_STRATEGY => SdkConfiguration::STRATEGY_NONE,
+            Configuration::CONFIG_DOMAIN => Configuration::get(Configuration::CONFIG_DOMAIN),
+            Configuration::CONFIG_AUDIENCE => Configuration::get(Configuration::CONFIG_AUDIENCE),
+        ],
+        'api' => [Configuration::CONFIG_STRATEGY => SdkConfiguration::STRATEGY_API],
+    ],
+    'routes' => [],
+];`),
+    'tests/Feature/OidcAuthorizationTest.php': php(`<?php
+
+it('rejects a request without an access token', function () {
+    $this->getJson('/api/me')->assertUnauthorized();
+});`),
+  }
+  if (!loginEnabled) return {}
+  return {
+    'app/Models/User.php': php(`<?php
+
+namespace App\\Models;
+
+use Database\\Factories\\UserFactory;
+use Illuminate\\Database\\Eloquent\\Factories\\HasFactory;
+use Illuminate\\Foundation\\Auth\\User as Authenticatable;
+use Illuminate\\Notifications\\Notifiable;
+
+final class User extends Authenticatable
+{
+    /** @use HasFactory<UserFactory> */
+    use HasFactory, Notifiable;
+
+    protected $fillable = ['name', 'email', 'password'];
+
+    protected $hidden = ['password', 'remember_token'];
+
+    protected function casts(): array
+    {
+        return ['email_verified_at' => 'datetime', 'password' => 'hashed'];
+    }
+}`),
+    'app/Http/Controllers/AuthController.php': php(`<?php
+
+namespace App\\Http\\Controllers;
+
+use App\\Models\\User;
+use Illuminate\\Http\\JsonResponse;
+use Illuminate\\Http\\Request;
+use Illuminate\\Support\\Facades\\Auth;
+use Illuminate\\Validation\\ValidationException;
+
+final class AuthController
+{
+    public function register(Request $request): JsonResponse
+    {
+        $data = $request->validate(['name' => ['required', 'string', 'max:100'], 'email' => ['required', 'email', 'max:255', 'unique:users,email'], 'password' => ['required', 'string', 'min:12', 'confirmed']]);
+        $user = User::create($data);
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return response()->json(['user' => $user->only(['id', 'name', 'email'])], 201);
+    }
+
+    public function login(Request $request): JsonResponse
+    {
+        $credentials = $request->validate(['email' => ['required', 'email'], 'password' => ['required', 'string']]);
+        if (! Auth::attempt($credentials)) {
+            throw ValidationException::withMessages(['email' => ['The supplied credentials are invalid.']]);
+        }
+        $request->session()->regenerate();
+
+        return response()->json(['user' => $request->user()->only(['id', 'name', 'email'])]);
+    }
+
+    public function logout(Request $request): JsonResponse
+    {
+        Auth::guard('web')->logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return response()->json(null, 204);
+    }
+}`),
+    'config/auth.php': php(`<?php
+
+use App\\Models\\User;
+
+return ['defaults' => ['guard' => 'web', 'passwords' => 'users'], 'guards' => ['web' => ['driver' => 'session', 'provider' => 'users']], 'providers' => ['users' => ['driver' => 'eloquent', 'model' => User::class]], 'passwords' => ['users' => ['provider' => 'users', 'table' => 'password_reset_tokens', 'expire' => 60, 'throttle' => 60]], 'password_timeout' => 10800];`),
+    'config/session.php': php(`<?php
+
+return ['driver' => env('SESSION_DRIVER', 'database'), 'lifetime' => (int) env('SESSION_LIFETIME', 120), 'expire_on_close' => false, 'encrypt' => true, 'files' => storage_path('framework/sessions'), 'connection' => env('SESSION_CONNECTION'), 'table' => 'sessions', 'store' => env('SESSION_STORE'), 'lottery' => [2, 100], 'cookie' => env('SESSION_COOKIE', 'app_session'), 'path' => '/', 'domain' => env('SESSION_DOMAIN'), 'secure' => env('SESSION_SECURE_COOKIE', true), 'http_only' => true, 'same_site' => env('SESSION_SAME_SITE', 'lax')];`),
+    'database/migrations/0001_01_01_000000_create_users_table.php': php(`<?php
+
+use Illuminate\\Database\\Migrations\\Migration;
+use Illuminate\\Database\\Schema\\Blueprint;
+use Illuminate\\Support\\Facades\\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('users', function (Blueprint $table) {
+            $table->id();
+            $table->string('name');
+            $table->string('email')->unique();
+            $table->timestamp('email_verified_at')->nullable();
+            $table->string('password');
+            $table->rememberToken();
+            $table->timestamps();
+        });
+        Schema::create('password_reset_tokens', function (Blueprint $table) {
+            $table->string('email')->primary();
+            $table->string('token');
+            $table->timestamp('created_at')->nullable();
+        });
+        Schema::create('sessions', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->foreignId('user_id')->nullable()->index();
+            $table->string('ip_address', 45)->nullable();
+            $table->text('user_agent')->nullable();
+            $table->longText('payload');
+            $table->integer('last_activity')->index();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('sessions');
+        Schema::dropIfExists('password_reset_tokens');
+        Schema::dropIfExists('users');
+    }
+};`),
+    'database/factories/UserFactory.php': php(`<?php
+
+namespace Database\\Factories;
+
+use Illuminate\\Database\\Eloquent\\Factories\\Factory;
+use Illuminate\\Support\\Facades\\Hash;
+use Illuminate\\Support\\Str;
+
+final class UserFactory extends Factory
+{
+    public function definition(): array
+    {
+        return ['name' => fake()->name(), 'email' => fake()->unique()->safeEmail(), 'email_verified_at' => now(), 'password' => Hash::make('a-secure-test-password'), 'remember_token' => Str::random(10)];
+    }
+}`),
+    'tests/Feature/AuthenticationTest.php': php(`<?php
+
+use App\\Models\\User;
+use Illuminate\\Foundation\\Testing\\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('rotates the session after login', function () {
+    $user = User::factory()->create(['password' => 'a-secure-test-password']);
+    $before = session()->getId();
+    $this->postJson('/login', ['email' => $user->email, 'password' => 'a-secure-test-password'])->assertOk();
+    expect(session()->getId())->not->toBe($before);
+});
+
+it('rejects an unauthenticated protected request', function () {
+    $this->getJson('/api/me')->assertUnauthorized();
+});
+
+it('invalidates authentication on logout', function () {
+    $user = User::factory()->create();
+    $this->actingAs($user)->postJson('/logout')->assertNoContent();
+    $this->getJson('/api/me')->assertUnauthorized();
+});`),
+  }
+}
+
+function apiRoutes(stack) {
+  const publicRoutes = buildPublicApiRoutes(stack.authentication)
+  if (publicRoutes) return publicRoutes
+  const middleware = isSanctumSpa(stack.authentication)
+    ? sanctumSpaAuthentication.apiMiddleware
+    : laravelSessionAuthentication.apiMiddleware
+  if (usesLaravelSession(stack.authentication)) {
+    return php(`<?php
+
+use App\\Http\\Controllers\\HealthController;
+use Illuminate\\Http\\Request;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/health', HealthController::class);
+Route::get('/me', fn (Request $request) => response()->json(['user' => $request->user()->only(['id', 'name', 'email'])]))->middleware('${middleware}');`)
+  }
+  if (isLaravelOidc(stack.authentication)) return php(`<?php
+
+use Illuminate\\Http\\Request;
+use Illuminate\\Support\\Facades\\Auth;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/health', fn () => response()->json(['status' => 'ok']));
+Auth::shouldUse('${laravelOidcAuthentication.guard}');
+Route::get('/me', fn (Request $request) => response()->json(['subject' => $request->user()?->getAuthIdentifier()]))->middleware('${laravelOidcAuthentication.apiMiddleware}');`)
+  throw new Error(`Unsupported Laravel authentication model: ${stack.authentication}`)
+}
+
+function webRoutes(stack) {
+  const home = stack.frontendKey !== 'laravel-ui'
+    ? "Route::get('/', fn () => response()->json(['application' => config('app.name')]));"
+    : getLaravelUi(stack.laravelUi).homeRoute
+  if (!usesLaravelSession(stack.authentication)) {
+    return buildUnauthenticatedWebRoutes(home)
+  }
+  return php(`<?php
+
+use App\\Http\\Controllers\\AuthController;
+use Illuminate\\Support\\Facades\\Route;
+
+${home}
+Route::view('/login', 'auth.login')->middleware('guest')->name('login');
+Route::post('/register', [AuthController::class, 'register'])->middleware('throttle:6,1');
+Route::post('/login', [AuthController::class, 'login'])->middleware('throttle:6,1');
+Route::post('/logout', [AuthController::class, 'logout'])->middleware('auth');`)
+}
+
+function uiFiles(answers, stack) {
+  if (stack.frontendKey !== 'laravel-ui') return {}
+  return getLaravelUi(stack.laravelUi).files(answers, stack)
+}
+
+export function buildLaravelFiles(answers, stack) {
+  if (stack.backendKey !== 'laravel') return {}
+  const root = stack.frontendKey === 'laravel-ui' || stack.frontendKey === 'no-frontend' ? '' : 'backend/'
+  const at = (path) => `${root}${path}`
+  const files = {
+    [at('composer.json')]: buildLaravelComposer(answers, stack),
+    [at('artisan')]: php(`#!/usr/bin/env php
+<?php
+
+define('LARAVEL_START', microtime(true));
+require __DIR__.'/vendor/autoload.php';
+$status = (require_once __DIR__.'/bootstrap/app.php')->handleCommand(new Symfony\\Component\\Console\\Input\\ArgvInput);
+exit($status);`),
+    [at('bootstrap/app.php')]: (() => {
+      const middlewareLines = []
+      const ui = stack.frontendKey === 'laravel-ui' ? getLaravelUi(stack.laravelUi) : null
+      if (isSanctumSpa(stack.authentication)) middlewareLines.push(sanctumSpaAuthentication.middleware)
+      if (ui?.middleware) middlewareLines.push(ui.middleware)
+      const middlewareBlock = middlewareLines.length ? `function (Middleware $middleware): void {\n${middlewareLines.join('\n')}\n    }` : 'function (Middleware $middleware): void {}'
+      return php(`<?php
+
+${ui?.middlewareImport ? `${ui.middlewareImport}\n` : ''}use Illuminate\\Foundation\\Application;
+use Illuminate\\Foundation\\Configuration\\Exceptions;
+use Illuminate\\Foundation\\Configuration\\Middleware;
+
+return Application::configure(basePath: dirname(__DIR__))
+    ->withRouting(web: __DIR__.'/../routes/web.php', api: __DIR__.'/../routes/api.php', commands: __DIR__.'/../routes/console.php', health: '/up')
+    ->withMiddleware(${middlewareBlock})
+    ->withExceptions(fn (Exceptions $exceptions) => null)
+    ->create();`);
+    })(),
+    [at('bootstrap/providers.php')]: php(`<?php
+
+use App\\Providers\\AppServiceProvider;
+
+return [AppServiceProvider::class];`),
+    [at('public/index.php')]: php(`<?php
+
+use Illuminate\\Http\\Request;
+
+define('LARAVEL_START', microtime(true));
+require __DIR__.'/../vendor/autoload.php';
+(require_once __DIR__.'/../bootstrap/app.php')->handleRequest(Request::capture());`),
+    [at('app/Providers/AppServiceProvider.php')]: php(`<?php
+
+namespace App\\Providers;
+
+use Illuminate\\Support\\ServiceProvider;
+
+final class AppServiceProvider extends ServiceProvider
+{
+    public function register(): void {}
+
+    public function boot(): void {}
+}`),
+    [at('app/Http/Controllers/HealthController.php')]: php(`<?php
+
+namespace App\\Http\\Controllers;
+
+${stack.architecture === 'small' ? '' : 'use App\\Actions\\GetSystemStatus;\n'}use Illuminate\\Http\\JsonResponse;
+
+final class HealthController
+{
+    public function __invoke(): JsonResponse
+    {
+        ${stack.architecture === 'small' ? "return response()->json(['status' => 'ok']);" : 'return response()->json(app(GetSystemStatus::class)->handle());'}
+    }
+}`),
+    [at('routes/api.php')]: apiRoutes(stack),
+    [at('routes/web.php')]: webRoutes(stack),
+    [at('routes/console.php')]: php(`<?php
+
+use Illuminate\\Support\\Facades\\Artisan;
+
+Artisan::command('about:starter', fn () => $this->info('Generated by create-win-project'));`),
+    [at('config/app.php')]: php(`<?php
+
+return ['name' => env('APP_NAME', '${answers.projectName}'), 'env' => env('APP_ENV', 'production'), 'debug' => (bool) env('APP_DEBUG', false), 'url' => env('APP_URL', 'http://localhost:8000'), 'key' => env('APP_KEY'), 'cipher' => 'AES-256-CBC'];`),
+    [at('config/database.php')]: php(`<?php
+
+return ['default' => 'pgsql', 'connections' => ['pgsql' => ['driver' => 'pgsql', 'host' => env('DB_HOST', '127.0.0.1'), 'port' => env('DB_PORT', '5432'), 'database' => env('DB_DATABASE', '${answers.projectName.replaceAll('-', '_')}'), 'username' => env('DB_USERNAME', 'postgres'), 'password' => env('DB_PASSWORD', '')]], 'migrations' => ['table' => 'migrations']];`),
+    [at('phpunit.xml')]: `<?xml version="1.0" encoding="UTF-8"?>\n<phpunit bootstrap="vendor/autoload.php" colors="true"><testsuites><testsuite name="Application"><directory>tests</directory></testsuite></testsuites><php><env name="APP_ENV" value="testing"/><env name="APP_KEY" value="base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="/><env name="SESSION_DRIVER" value="array"/><env name="CACHE_STORE" value="array"/><env name="QUEUE_CONNECTION" value="sync"/></php></phpunit>\n`,
+    [at('phpstan.neon')]: `includes:\n  - vendor/larastan/larastan/extension.neon\nparameters:\n  paths:\n    - app\n  level: 6\n`,
+    [at('tests/TestCase.php')]: php(`<?php
+
+namespace Tests;
+
+use Illuminate\\Foundation\\Testing\\TestCase as BaseTestCase;
+
+abstract class TestCase extends BaseTestCase {}`),
+    [at('tests/Pest.php')]: php(`<?php
+
+use Tests\\TestCase;
+
+pest()->extend(TestCase::class)->in('Feature');`),
+    [at('tests/Feature/HealthTest.php')]: php(`<?php
+
+it('reports application health', function () {
+    $this->getJson('/api/health')->assertOk()->assertJsonPath('status', 'ok');
+});`),
+    [at('.env.example')]: `APP_NAME=${answers.projectName}\nAPP_ENV=local\nAPP_KEY=\nAPP_DEBUG=true\nAPP_URL=http://localhost:8000\nDB_CONNECTION=pgsql\nDB_HOST=127.0.0.1\nDB_PORT=5432\nDB_DATABASE=${answers.projectName.replaceAll('-', '_')}\nDB_USERNAME=postgres\nDB_PASSWORD=change-me\n${sessionEnvironment(stack.authentication).map((line) => `${line}\n`).join('')}${isSanctumSpa(stack.authentication) ? sanctumSpaAuthentication.environment.map((line) => `${line}\n`).join('') : ''}${isLaravelOidc(stack.authentication) ? laravelOidcAuthentication.environment.map((line) => `${line}\n`).join('') : ''}`,
+    [at('.gitignore')]: `/vendor/\n/node_modules/\n.env\n.phpunit.result.cache\n/public/build/\n/storage/*.key\n`,
+    [at('storage/framework/cache/.gitignore')]: "*\n!.gitignore\n",
+    [at('storage/framework/sessions/.gitignore')]: "*\n!.gitignore\n",
+    [at('storage/framework/views/.gitignore')]: "*\n!.gitignore\n",
+    [at('storage/logs/.gitignore')]: "*\n!.gitignore\n",
+    [at('bootstrap/cache/.gitignore')]: "*\n!.gitignore\n",
+  }
+  for (const [path, content] of Object.entries(buildLaravelArchitectureFiles(stack))) files[at(path)] = content
+  for (const [path, content] of Object.entries(authFiles(stack))) files[at(path)] = content
+  for (const [path, content] of Object.entries(uiFiles(answers, stack))) files[at(path)] = content
+  files['README.md'] = `# ${answers.projectName}\n\n> ${answers.projectDescription}\n\n## Start Laravel\n\n\`\`\`bash\n${root ? `cd ${root.slice(0, -1)}\n` : ''}cp .env.example .env\ncomposer install\nphp artisan key:generate\nphp artisan serve\n\`\`\`\n\nHealth: \`GET /api/health\`\n\n## Validate\n\n\`\`\`bash\ncomposer check\n\`\`\`\n`
+  return files
+}