npm - create-win-project - Versions diffs - 1.3.0 - Mend

create-win-project 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (198) hide show

package/LICENSE +21 -0
package/README.md +187 -0
package/ci/expo.yml +28 -0
package/ci/laravel.yml +49 -0
package/ci/nextjs.yml +29 -0
package/ci/springboot.yml +33 -0
package/ci/vite.yml +36 -0
package/compatibility/profiles.json +237 -0
package/docs/ARCHITECTURE.md +118 -0
package/docs/CONTENT_MODEL.md +36 -0
package/docs/DEPENDENCY_MAINTENANCE.md +31 -0
package/index.js +431 -0
package/lib/application-shapes.js +95 -0
package/lib/banner.js +45 -0
package/lib/catalog.js +343 -0
package/lib/compatibility.js +116 -0
package/lib/constants.js +3 -0
package/lib/doctor.js +45 -0
package/lib/files.js +158 -0
package/lib/generator.js +366 -0
package/lib/interview.js +77 -0
package/lib/laravel-scaffold.js +3 -0
package/lib/playbooks.js +172 -0
package/lib/project-location.js +18 -0
package/lib/scaffold.js +467 -0
package/lib/stacks/context.js +27 -0
package/lib/stacks/contract.js +142 -0
package/lib/stacks/index.js +8 -0
package/lib/stacks/laravel/architecture.js +27 -0
package/lib/stacks/laravel/auth/oidc.js +13 -0
package/lib/stacks/laravel/auth/public.js +28 -0
package/lib/stacks/laravel/auth/sanctum.js +14 -0
package/lib/stacks/laravel/auth/session.js +17 -0
package/lib/stacks/laravel/composer.js +50 -0
package/lib/stacks/laravel/generate.js +362 -0
package/lib/stacks/laravel/index.js +18 -0
package/lib/stacks/laravel/ui/blade.js +15 -0
package/lib/stacks/laravel/ui/index.js +29 -0
package/lib/stacks/laravel/ui/inertia-react.js +35 -0
package/lib/stacks/laravel/ui/livewire.js +39 -0
package/lib/stacks/laravel/ui/shared.js +14 -0
package/lib/stacks/registry.js +42 -0
package/lib/stacks/shared/contributions.js +25 -0
package/lib/template.js +62 -0
package/package.json +49 -0
package/playbooks/INDEX.md +58 -0
package/playbooks/capabilities/auth/oidc-resource-server.md +15 -0
package/playbooks/capabilities/auth/spring-session.md +15 -0
package/playbooks/capabilities/ci/github-actions.manifest.json +10 -0
package/playbooks/capabilities/ci/github-actions.md +61 -0
package/playbooks/capabilities/docker/docker.manifest.json +11 -0
package/playbooks/capabilities/docker/overview.md +55 -0
package/playbooks/capabilities/flyway/environments.md +5 -0
package/playbooks/capabilities/flyway/flyway.manifest.json +12 -0
package/playbooks/capabilities/flyway/migrations.md +7 -0
package/playbooks/capabilities/flyway/testing.md +5 -0
package/playbooks/capabilities/laravel/database.md +8 -0
package/playbooks/capabilities/laravel/migrations.md +15 -0
package/playbooks/capabilities/laravel/observability.md +8 -0
package/playbooks/capabilities/laravel/oidc-resource-server.md +10 -0
package/playbooks/capabilities/laravel/queues.md +8 -0
package/playbooks/capabilities/laravel/sanctum-spa.md +8 -0
package/playbooks/capabilities/laravel/scheduler.md +7 -0
package/playbooks/capabilities/laravel/session-auth.md +8 -0
package/playbooks/capabilities/laravel/storage-uploads.md +7 -0
package/playbooks/capabilities/postgresql/architecture.md +5 -0
package/playbooks/capabilities/postgresql/migrations.md +5 -0
package/playbooks/capabilities/postgresql/postgresql.manifest.json +15 -0
package/playbooks/capabilities/postgresql/schema-design.md +7 -0
package/playbooks/capabilities/postgresql/security.md +5 -0
package/playbooks/capabilities/postgresql/testing.md +5 -0
package/playbooks/capabilities/prisma/architecture.md +5 -0
package/playbooks/capabilities/prisma/migrations.md +11 -0
package/playbooks/capabilities/prisma/prisma.manifest.json +14 -0
package/playbooks/capabilities/prisma/runtime.md +5 -0
package/playbooks/capabilities/prisma/schema.md +5 -0
package/playbooks/capabilities/prisma/testing.md +5 -0
package/playbooks/capabilities/supabase/architecture.md +5 -0
package/playbooks/capabilities/supabase/authentication.md +5 -0
package/playbooks/capabilities/supabase/expo.md +16 -0
package/playbooks/capabilities/supabase/migrations.md +7 -0
package/playbooks/capabilities/supabase/nextjs.md +24 -0
package/playbooks/capabilities/supabase/rls.md +7 -0
package/playbooks/capabilities/supabase/supabase.manifest.json +32 -0
package/playbooks/capabilities/supabase/testing.md +5 -0
package/playbooks/capabilities/supabase/vite.md +14 -0
package/playbooks/concerns/axios.md +123 -0
package/playbooks/concerns/next-safe-action.md +66 -0
package/playbooks/concerns/next-themes.md +87 -0
package/playbooks/concerns/nuqs.md +59 -0
package/playbooks/concerns/t3-env.md +48 -0
package/playbooks/concerns/tanstack-query.md +145 -0
package/playbooks/concerns/zod.md +174 -0
package/playbooks/concerns/zustand.md +93 -0
package/playbooks/devops/makefile.manifest.json +10 -0
package/playbooks/devops/makefile.md +556 -0
package/playbooks/devops/pr-template.manifest.json +10 -0
package/playbooks/devops/pr-template.md +106 -0
package/playbooks/platform/laravel-ui/blade/architecture.md +5 -0
package/playbooks/platform/laravel-ui/blade/runtime.md +5 -0
package/playbooks/platform/laravel-ui/blade/security.md +5 -0
package/playbooks/platform/laravel-ui/blade/structure.md +5 -0
package/playbooks/platform/laravel-ui/blade/testing.md +5 -0
package/playbooks/platform/laravel-ui/inertia-react/architecture.md +5 -0
package/playbooks/platform/laravel-ui/inertia-react/runtime.md +5 -0
package/playbooks/platform/laravel-ui/inertia-react/security.md +5 -0
package/playbooks/platform/laravel-ui/inertia-react/structure.md +5 -0
package/playbooks/platform/laravel-ui/inertia-react/testing.md +5 -0
package/playbooks/platform/laravel-ui/livewire/architecture.md +5 -0
package/playbooks/platform/laravel-ui/livewire/runtime.md +5 -0
package/playbooks/platform/laravel-ui/livewire/security.md +5 -0
package/playbooks/platform/laravel-ui/livewire/structure.md +5 -0
package/playbooks/platform/laravel-ui/livewire/testing.md +5 -0
package/playbooks/platform/mobile.manifest.json +17 -0
package/playbooks/platform/mobile.md +15 -0
package/playbooks/platform/web.manifest.json +17 -0
package/playbooks/platform/web.md +17 -0
package/playbooks/stack/expo/architecture.md +27 -0
package/playbooks/stack/expo/runtime.md +14 -0
package/playbooks/stack/expo/security.md +18 -0
package/playbooks/stack/expo/structure.md +26 -0
package/playbooks/stack/expo/testing.md +13 -0
package/playbooks/stack/laravel/architecture.md +34 -0
package/playbooks/stack/laravel/runtime.md +27 -0
package/playbooks/stack/laravel/security.md +23 -0
package/playbooks/stack/laravel/structure.md +29 -0
package/playbooks/stack/laravel/testing.md +22 -0
package/playbooks/stack/laravel-ui.manifest.json +42 -0
package/playbooks/stack/laravel.manifest.json +35 -0
package/playbooks/stack/nextjs/architecture.md +62 -0
package/playbooks/stack/nextjs/runtime.md +31 -0
package/playbooks/stack/nextjs/security.md +32 -0
package/playbooks/stack/nextjs/structure.md +50 -0
package/playbooks/stack/nextjs/testing.md +20 -0
package/playbooks/stack/nextjs.manifest.json +49 -0
package/playbooks/stack/no-frontend.manifest.json +25 -0
package/playbooks/stack/none.manifest.json +21 -0
package/playbooks/stack/react-native.manifest.json +49 -0
package/playbooks/stack/react-vite/architecture.md +33 -0
package/playbooks/stack/react-vite/runtime.md +13 -0
package/playbooks/stack/react-vite/security.md +16 -0
package/playbooks/stack/react-vite/structure.md +23 -0
package/playbooks/stack/react-vite/testing.md +12 -0
package/playbooks/stack/react-vite.manifest.json +46 -0
package/playbooks/stack/springboot/architecture.md +40 -0
package/playbooks/stack/springboot/runtime.md +28 -0
package/playbooks/stack/springboot/security.md +28 -0
package/playbooks/stack/springboot/structure.md +30 -0
package/playbooks/stack/springboot/testing.md +22 -0
package/playbooks/stack/springboot.manifest.json +38 -0
package/playbooks/styling/css-modules-extensions.md +267 -0
package/playbooks/styling/css-modules.manifest.json +11 -0
package/playbooks/styling/native-styles.manifest.json +9 -0
package/playbooks/styling/native-styles.md +29 -0
package/playbooks/styling/tailwind-extensions.md +182 -0
package/playbooks/styling/tailwind.manifest.json +11 -0
package/playbooks/universal/accessibility.manifest.json +11 -0
package/playbooks/universal/accessibility.md +45 -0
package/playbooks/universal/coding-rules.manifest.json +12 -0
package/playbooks/universal/coding-rules.md +281 -0
package/playbooks/universal/error-handling.manifest.json +10 -0
package/playbooks/universal/error-handling.md +21 -0
package/playbooks/universal/git-conventions.manifest.json +10 -0
package/playbooks/universal/git-conventions.md +186 -0
package/playbooks/universal/observability.manifest.json +10 -0
package/playbooks/universal/observability.md +29 -0
package/playbooks/universal/security.manifest.json +11 -0
package/playbooks/universal/security.md +30 -0
package/playbooks/universal/typescript.manifest.json +11 -0
package/playbooks/universal/typescript.md +272 -0
package/scripts/compatibility-matrix.mjs +48 -0
package/scripts/validate-content.mjs +76 -0
package/scripts/verify-generated.mjs +153 -0
package/templates/agents/nextjs.md +47 -0
package/templates/agents/react-native.md +48 -0
package/templates/agents/react-vite.md +48 -0
package/templates/docker/compose/postgres.yml +29 -0
package/templates/docker/compose/springboot.yml +69 -0
package/templates/docker/compose/supabase.yml +18 -0
package/templates/docker/compose-prod/springboot.yml +64 -0
package/templates/docker/dockerfile/laravel-inertia.dev.dockerfile +21 -0
package/templates/docker/dockerfile/laravel.dev.dockerfile +12 -0
package/templates/docker/dockerfile/laravel.prod.dockerfile +13 -0
package/templates/docker/dockerfile/nextjs.dev.dockerfile +6 -0
package/templates/docker/dockerfile/nextjs.prod.dockerfile +18 -0
package/templates/docker/dockerfile/springboot.dev.dockerfile +5 -0
package/templates/docker/dockerfile/springboot.prod.dockerfile +10 -0
package/templates/docker/dockerfile/vite.dev.dockerfile +6 -0
package/templates/docker/dockerfile/vite.prod.dockerfile +12 -0
package/templates/gitignore/base.gitignore +32 -0
package/templates/gitignore/nextjs.gitignore +40 -0
package/templates/gitignore/react-native.gitignore +43 -0
package/templates/gitignore/react-vite.gitignore +39 -0
package/templates/makefile/frontend.mk +31 -0
package/templates/makefile/laravel.mk +47 -0
package/templates/makefile/postgres.mk +40 -0
package/templates/makefile/springboot.mk +125 -0
package/templates/makefile/supabase.mk +42 -0

package/lib/stacks/laravel/index.js ADDED Viewed

@@ -0,0 +1,18 @@
+import { defineStackAdapter } from '../contract.js'
+export const laravelAdapter = defineStackAdapter({
+  id: 'laravel',
+  kind: 'backend',
+  label: 'Laravel (PHP)',
+  compatibleWith: {
+    frontend: ['nextjs', 'react', 'react-native', 'no-frontend', 'laravel-ui'],
+  },
+  capabilities: {
+    applicationShapes: ['fullstack', 'separate', 'api', 'mobile'],
+    architectureProfiles: ['small', 'medium', 'large'],
+    authenticationModels: ['public', 'undecided', 'laravel-session', 'sanctum-spa', 'laravel-oidc'],
+    runtime: 'php',
+  },
+  contributes: {},
+})

package/lib/stacks/laravel/ui/blade.js ADDED Viewed

@@ -0,0 +1,15 @@
+import { buildLaravelAuthView, laravelLoginNavigation } from './shared.js'
+export const bladeUi = Object.freeze({
+  id: 'blade',
+  label: 'Blade',
+  homeRoute: "Route::view('/', 'home');",
+  composerPackages: Object.freeze([]),
+  files(answers, stack) {
+    const login = laravelLoginNavigation(stack.authentication)
+    return {
+      ...buildLaravelAuthView(stack.authentication),
+      'resources/views/home.blade.php': `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>{{ config('app.name') }}</title></head><body>${login}<main><h1>${answers.projectName}</h1><p>Laravel Blade starter</p></main></body></html>\n`,
+    }
+  },
+})

package/lib/stacks/laravel/ui/index.js ADDED Viewed

@@ -0,0 +1,29 @@
+import { bladeUi } from './blade.js'
+import { inertiaReactUi } from './inertia-react.js'
+import { livewireUi } from './livewire.js'
+export const laravelUis = Object.freeze([bladeUi, livewireUi, inertiaReactUi])
+export function getLaravelUi(id) {
+  const ui = laravelUis.find((candidate) => candidate.id === id)
+  if (!ui) throw new Error(`Unsupported Laravel UI: ${id}`)
+  return ui
+}
+export function laravelUiPromptContribution(argument) {
+  return {
+    slot: 'stack-options',
+    questions: [{
+      type: 'list',
+      name: 'laravelUi',
+      message: 'How should Laravel render the website?',
+      choices: [
+        { name: 'Blade (Recommended) — server-rendered pages with the fewest moving parts', value: bladeUi.id },
+        { name: 'Livewire — interactive server-driven components with minimal JavaScript', value: livewireUi.id },
+        { name: 'Inertia + React — React pages with Laravel routing and controllers', value: inertiaReactUi.id },
+      ],
+      default: bladeUi.id,
+      when: (answers) => answers.frontend === 'laravel-ui' && !argument,
+    }],
+  }
+}

package/lib/stacks/laravel/ui/inertia-react.js ADDED Viewed

@@ -0,0 +1,35 @@
+import { packageVersion } from '../../../compatibility.js'
+import { buildLaravelAuthView } from './shared.js'
+const php = (value) => `${value.trim()}\n`
+const json = (value) => `${JSON.stringify(value, null, 2)}\n`
+export const inertiaReactUi = Object.freeze({
+  id: 'inertia-react',
+  label: 'Inertia + React',
+  homeRoute: "Route::get('/', fn () => Inertia\\Inertia::render('Home'));",
+  composerPackages: Object.freeze(['inertiajs/inertia-laravel']),
+  middlewareImport: 'use App\\Http\\Middleware\\HandleInertiaRequests;',
+  middleware: '        $middleware->web(append: [HandleInertiaRequests::class]);',
+  files(answers, stack) {
+    const npm = (name) => packageVersion(stack.profile, name, 'laravel-ui', 'Laravel Inertia scaffold')
+    return {
+      ...buildLaravelAuthView(stack.authentication),
+      'package.json': json({ private: true, type: 'module', scripts: { dev: 'vite', build: 'vite build' }, dependencies: { '@inertiajs/react': npm('@inertiajs/react'), react: npm('react'), 'react-dom': npm('react-dom') }, devDependencies: { '@vitejs/plugin-react': npm('@vitejs/plugin-react'), 'laravel-vite-plugin': npm('laravel-vite-plugin'), vite: npm('vite') } }),
+      'vite.config.js': `import { defineConfig } from 'vite'\nimport laravel from 'laravel-vite-plugin'\nimport react from '@vitejs/plugin-react'\n\nexport default defineConfig({ plugins: [laravel({ input: 'resources/js/app.jsx', refresh: true }), react()] })\n`,
+      'resources/js/app.jsx': `import { createInertiaApp } from '@inertiajs/react'\nimport { createRoot } from 'react-dom/client'\n\nconst pages = import.meta.glob('./Pages/**/*.jsx', { eager: true })\ncreateInertiaApp({ resolve: (name) => pages[\`./Pages/\${name}.jsx\`], setup({ el, App, props }) { createRoot(el).render(<App {...props} />) } })\n`,
+      'resources/js/Pages/Home.jsx': `export default function Home() { return <main><h1>${answers.projectName}</h1><p>Laravel + Inertia + React</p></main> }\n`,
+      'resources/views/app.blade.php': '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">@viteReactRefresh @vite(\'resources/js/app.jsx\') @inertiaHead</head><body>@inertia</body></html>\n',
+      'app/Http/Middleware/HandleInertiaRequests.php': php(`<?php
+namespace App\\Http\\Middleware;
+use Inertia\\Middleware;
+final class HandleInertiaRequests extends Middleware
+{
+    protected $rootView = 'app';
+}`),
+    }
+  },
+})

package/lib/stacks/laravel/ui/livewire.js ADDED Viewed

@@ -0,0 +1,39 @@
+import { buildLaravelAuthView, laravelLoginNavigation } from './shared.js'
+const php = (value) => `${value.trim()}\n`
+export const livewireUi = Object.freeze({
+  id: 'livewire',
+  label: 'Livewire',
+  homeRoute: "Route::view('/', 'app');",
+  composerPackages: Object.freeze(['livewire/livewire']),
+  files(answers, stack) {
+    const login = laravelLoginNavigation(stack.authentication)
+    return {
+      ...buildLaravelAuthView(stack.authentication),
+      'app/Livewire/HomePage.php': php(`<?php
+namespace App\\Livewire;
+use Illuminate\\View\\View;
+use Livewire\\Component;
+final class HomePage extends Component
+{
+    public int $count = 0;
+    public function increment(): void
+    {
+        $this->count++;
+    }
+    public function render(): View
+    {
+        return view('livewire.home-page');
+    }
+}`),
+      'resources/views/livewire/home-page.blade.php': `<main><h1>${answers.projectName}</h1><p>Count: {{ $count }}</p><button wire:click="increment">Increment</button></main>\n`,
+      'resources/views/app.blade.php': `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>{{ config('app.name') }}</title>@livewireStyles</head><body>${login}<livewire:home-page />@livewireScripts</body></html>\n`,
+    }
+  },
+})

package/lib/stacks/laravel/ui/shared.js ADDED Viewed

@@ -0,0 +1,14 @@
+import { usesLaravelSession } from '../auth/session.js'
+export function buildLaravelAuthView(authentication) {
+  if (!usesLaravelSession(authentication)) return {}
+  return {
+    'resources/views/auth/login.blade.php': '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Log in</title></head><body><main><h1>Log in</h1><form method="POST" action="/login">@csrf<label>Email <input name="email" type="email" autocomplete="email" required></label><label>Password <input name="password" type="password" autocomplete="current-password" required></label><button>Log in</button></form></main></body></html>\n',
+  }
+}
+export function laravelLoginNavigation(authentication) {
+  return usesLaravelSession(authentication)
+    ? '<nav>@auth <form method="POST" action="/logout">@csrf<button>Log out</button></form> @else <a href="/login">Log in</a> @endauth</nav>'
+    : ''
+}

package/lib/stacks/registry.js ADDED Viewed

@@ -0,0 +1,42 @@
+import { isStackAdapter } from './contract.js'
+export function createStackRegistry(initialAdapters = []) {
+  const adapters = new Map()
+  const registry = {
+    register(adapter) {
+      if (!isStackAdapter(adapter)) throw new Error('Only defined stack adapters can be registered')
+      if (adapters.has(adapter.id)) throw new Error(`Duplicate stack adapter id: ${adapter.id}`)
+      adapters.set(adapter.id, adapter)
+      return adapter
+    },
+    get(id) {
+      return adapters.get(id)
+    },
+    require(id) {
+      const adapter = adapters.get(id)
+      if (!adapter) throw new Error(`Unknown stack adapter: ${id}`)
+      return adapter
+    },
+    list(kind) {
+      const registered = [...adapters.values()]
+      return kind ? registered.filter((adapter) => adapter.kind === kind) : registered
+    },
+    supports(firstId, secondId) {
+      const first = registry.require(firstId)
+      const second = registry.require(secondId)
+      const firstConstraint = first.compatibleWith[second.kind]
+      const secondConstraint = second.compatibleWith[first.kind]
+      return (!firstConstraint || firstConstraint.includes(second.id)) &&
+        (!secondConstraint || secondConstraint.includes(first.id))
+    },
+  }
+  for (const adapter of initialAdapters) registry.register(adapter)
+  return Object.freeze(registry)
+}

package/lib/stacks/shared/contributions.js ADDED Viewed

@@ -0,0 +1,25 @@
+import { CONTRIBUTION_HOOKS, PROMPT_SLOTS } from '../contract.js'
+export function collectContributions(adapters, hook, context) {
+  if (!CONTRIBUTION_HOOKS.includes(hook)) throw new Error(`Unknown contribution hook: ${hook}`)
+  return adapters.flatMap((adapter) => {
+    const result = adapter.contributes[hook](context)
+    if (!Array.isArray(result)) {
+      throw new Error(`${adapter.id} contribution ${hook} must return an array`)
+    }
+    return result
+  })
+}
+export function collectPromptContributions(adapters, context) {
+  const prompts = collectContributions(adapters, 'prompts', context)
+  for (const prompt of prompts) {
+    if (!prompt || !PROMPT_SLOTS.includes(prompt.slot) || !Array.isArray(prompt.questions)) {
+      throw new Error('Prompt contributions require a supported slot and a questions array')
+    }
+  }
+  return Object.freeze(Object.fromEntries(PROMPT_SLOTS.map((slot) => [
+    slot,
+    prompts.filter((prompt) => prompt.slot === slot).flatMap((prompt) => prompt.questions),
+  ])))
+}

package/lib/template.js ADDED Viewed

@@ -0,0 +1,62 @@
+// ─── Template Variable Replacement ───────────────────────────────────────────
+import fs from 'fs-extra'
+import path from 'path'
+export function render(content, vars) {
+  return content.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`)
+}
+export async function readTemplate(templatesDir, category, name, ext = '') {
+  if (!name) return null
+  const file = path.join(templatesDir, category, `${name}${ext}`)
+  if (await fs.pathExists(file)) return fs.readFile(file, 'utf-8')
+  return null
+}
+export function buildVars(answers, stack) {
+  const packagePath = (answers.packageName ?? 'com.app').replace(/\./g, '/')
+  const profile = stack.profile
+  return {
+    PROJECT_NAME:        answers.projectName,
+    PROJECT_DESCRIPTION: answers.projectDescription,
+    PACKAGE_NAME:        answers.packageName ?? 'com.app',
+    PACKAGE_PATH:        packagePath,
+    STYLE_MODE:          stack.styleId?.toUpperCase().replace(/-/g, '_') ?? 'TAILWIND',
+    STACK:               stack.key,
+    PLATFORM:            stack.platform,
+    ARCHITECTURE:        stack.architecture?.toUpperCase() ?? 'MEDIUM',
+    YEAR:                new Date().getFullYear().toString(),
+    FRONTEND_DIR:        stack.frontendDir || '.',
+    FRONTEND_PORT:       stack.frontendPort || '3000',
+    BACKEND_PORT:        stack.backendPort || '8080',
+    ENV_PREFIX:          stack.envPrefix || '',
+    SRC_DIR:             stack.frontendDir ? `${stack.frontendDir}/src` : 'src',
+    CONSTRAINTS:         (stack.constraints || []).join('\n- ') ? `- ${(stack.constraints || []).join('\n- ')}` : '- (none beyond universal rules)',
+    // Dockerfile paths are resolved inside build.context, so they are always
+    // relative to that context rather than to the repository root.
+    FRONTEND_DOCKERFILE: 'Dockerfile.dev',
+    FRONTEND_DOCKERFILE_PROD: 'Dockerfile',
+    FRONTEND_PROD_PORT:  stack.frontendDir ? '80:80' : `${stack.frontendPort || '3000'}:${stack.frontendPort || '3000'}`,
+    NODE_VERSION:        profile.runtimes.node,
+    JAVA_VERSION:        profile.runtimes.java,
+    MAVEN_VERSION:       profile.runtimes.maven,
+    SPRING_BOOT_VERSION: profile.springBoot,
+    SPRING_MODULITH_VERSION: profile.springModulith,
+    PHP_VERSION:         profile.runtimes.php,
+    COMPOSER_VERSION:    profile.runtimes.composer,
+    LARAVEL_VERSION:     profile.composerPackages['laravel/framework'],
+    LARAVEL_DIR:         ['laravel-ui', 'no-frontend'].includes(stack.frontendKey) ? '.' : 'backend',
+    TESTCONTAINERS_VERSION: profile.packages["testcontainers-junit-jupiter"] || profile.packages["testcontainers-postgresql"] || "1.19.8",
+    POSTGRES_VERSION:    profile.runtimes.postgres,
+    NODE_IMAGE:          `${profile.images.node.repository}:${profile.images.node.tag}`,
+    MAVEN_IMAGE:         `${profile.images.maven.repository}:${profile.images.maven.tag}`,
+    JAVA_IMAGE:          `${profile.images.java.repository}:${profile.images.java.tag}`,
+    POSTGRES_IMAGE:      `${profile.images.postgres.repository}:${profile.images.postgres.tag}`,
+    NGINX_IMAGE:         `${profile.images.nginx.repository}:${profile.images.nginx.tag}`,
+    PHP_IMAGE:           `${profile.images.php.repository}:${profile.images.php.tag}`,
+    COMPOSER_IMAGE:      `${profile.images.composer.repository}:${profile.images.composer.tag}`,
+    COMPATIBILITY_PROFILE: profile.id,
+  }
+}

package/package.json ADDED Viewed

@@ -0,0 +1,49 @@
+{
+  "name": "create-win-project",
+  "version": "1.3.0",
+  "description": "Project scaffolding CLI by Win",
+  "main": "index.js",
+  "type": "module",
+  "bin": {
+    "create-win-project": "./index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/itsw1n/create-win-project.git"
+  },
+  "files": [
+    "index.js",
+    "lib",
+    "compatibility",
+    "playbooks",
+    "ci",
+    "templates",
+    "scripts",
+    "docs/ARCHITECTURE.md",
+    "docs/CONTENT_MODEL.md",
+    "docs/DEPENDENCY_MAINTENANCE.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "start": "node index.js",
+    "doctor": "node index.js doctor",
+    "test": "vitest run",
+    "validate:content": "node scripts/validate-content.mjs",
+    "matrix:smoke": "node scripts/compatibility-matrix.mjs --scope=smoke",
+    "matrix:full": "node scripts/compatibility-matrix.mjs --scope=full",
+    "verify:generated": "node scripts/verify-generated.mjs"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "dependencies": {
+    "chalk": "5.6.2",
+    "fs-extra": "11.4.0",
+    "inquirer": "9.3.8",
+    "ora": "7.0.1"
+  },
+  "devDependencies": {
+    "vitest": "2.1.9"
+  }
+}

package/playbooks/INDEX.md ADDED Viewed

@@ -0,0 +1,58 @@
+# Playbook Index
+Playbooks are task-routed standards used by generated projects. Their co-located manifests decide when a playbook applies and which headings appear in generated `RULES.md`.
+## Content groups
+| Directory | Responsibility |
+|---|---|
+| `universal/` | Only principles that remain true across every stack |
+| `platform/` | Browser/web and installed-mobile behavior |
+| `stack/` | Five stack-owned facets: architecture, structure, runtime, security, testing |
+| `capabilities/` | Supabase, PostgreSQL, Prisma, Flyway, Docker, CI, and authentication-provider behavior |
+| `styling/` | Styling-system rules selected by the frontend |
+| `concerns/` | Optional/shared libraries such as query, state, validation, and HTTP clients |
+| `devops/` | Optional CI, Docker, Makefile, and pull-request guidance |
+## Composition
+```text
+required universal + selected platform manifests
+  + selected frontend
+  + selected backend/database/migration
+  + selected styling
+  + enabled operational tooling
+  = resolved stack + generated RULES.md
+```
+Supported pairs:
+| Frontend | Backend/data choices |
+|---|---|
+| Next.js | Supabase, Spring Boot, PostgreSQL + Prisma |
+| React + Vite | Supabase, Spring Boot |
+| Expo | Supabase, Spring Boot, bring-your-own API |
+Expo uses React Native `StyleSheet` by default. Web projects can select Tailwind CSS or CSS Modules.
+## Manifest contract
+A stack manifest must declare all three architecture profiles. Any manifest may declare:
+- `id`, `kind`, `label`, and compatibility;
+- dependency names, scripts, templates, and conditional playbooks (versions live only in `compatibility/profiles.json`);
+- semantic environment names and client-visible names;
+- stack constraints;
+- required and optional concerns, target playbook, headings, and applicability.
+Manifests compose capabilities; `lib/scaffold.js` owns their executable minimum. Generated directories exist only when they contain a selected profile's real files. Adding a runnable capability requires both parts plus generated-output and compatibility-matrix coverage.
+## Generated documentation
+- `AGENTS.md`: small always-on operating contract.
+- `CONTEXT.md`: product-specific goals, scope, and decisions.
+- `RULES.md`: concern-to-heading router, not a second policy document.
+- `playbooks/`: only selected reusable guidance.
+- `docs/`: setup, API, architecture, auth, and deployment for the generated product.
+See `docs/CONTENT_MODEL.md` for authoring and deduplication rules and `docs/ARCHITECTURE.md` for the generation pipeline.

package/playbooks/capabilities/auth/oidc-resource-server.md ADDED Viewed

@@ -0,0 +1,15 @@
+# OIDC Resource Server
+## Provider and API Responsibilities
+The external OpenID Connect provider owns login, access-token and refresh-token issuance, rotation, revocation, recovery, and MFA. Spring is a resource server: it validates issuer, audience, signature, expiry, and claims on every protected API request. This generator does not mint custom JWTs.
+Public clients use Authorization Code with PKCE through the provider SDK. Store native refresh material only in platform-protected secure storage. A browser application should prefer a backend-for-frontend or provider-supported secure session when long-lived credentials would otherwise be exposed to JavaScript.
+## Authorization
+Map only documented provider claims to application authorities. Never trust a client-supplied user ID or role, and enforce resource ownership beside data access. Keep CORS on an explicit origin allowlist; bearer-token APIs do not use cookie CSRF as their request-integrity mechanism.
+## Required Tests
+Test missing bearer tokens and invalid issuer, audience, signature, expiry, and required claims. Also test valid access, resource-level denial, logout/revocation expectations at the provider boundary, and CORS behavior. Stub the decoder in MVC slices; use provider-compatible signed fixtures at the security integration boundary.

package/playbooks/capabilities/auth/spring-session.md ADDED Viewed

@@ -0,0 +1,15 @@
+# Spring Server Session
+## Session Ownership
+Spring Security authenticates the website, rotates the session identifier, and sends only a Secure, HttpOnly, SameSite cookie. The server owns expiry and logout; the browser never stores or refreshes an access token.
+Keep CSRF enabled for cookie-authenticated mutations. Replace the generated development user with the product identity store before production, configure HTTPS-only cookies, and use a shared Spring Session store before horizontally scaling stateful instances.
+## Authorization
+Authentication only proves who the caller is. Check roles and resource ownership beside each protected read or side effect. Deny by default and keep health endpoints as the only anonymous baseline unless a route is deliberately public.
+## Required Tests
+Test anonymous rejection, successful login, session-id rotation, authenticated access, CSRF rejection/acceptance, resource-level denial, expiry, logout invalidation, and safe redirect handling. Never assert only that a controller method was called.

package/playbooks/capabilities/ci/github-actions.manifest.json ADDED Viewed

@@ -0,0 +1,10 @@
+{
+  "id": "github-actions",
+  "kind": "devops",
+  "label": "GitHub Actions CI",
+  "required": false,
+  "folders": [".github/workflows"],
+  "concerns": [
+    { "id": "ci", "required": true, "sections": ["Frontend CI", "Backend CI (Spring Boot)", "Next.js CI"] }
+  ]
+}

package/playbooks/capabilities/ci/github-actions.md ADDED Viewed

@@ -0,0 +1,61 @@
+# GitHub Actions CI Capability
+Generated workflows run the same validation commands documented for local development. Keep CI a reproducible quality boundary, not a second build system.
+## Core Rules
+- Pin actions to maintained major versions or immutable commits according to the repository's supply-chain policy.
+- Use the lockfile command (`npm ci`) and Maven's batch mode.
+- Grant the workflow and each job the minimum `permissions` required; read-only is the default for validation jobs.
+- Do not expose secrets to pull requests from forks or print environment values during debugging.
+- Cache package downloads, not generated application output that can become stale.
+- Cancel superseded runs on the same pull request when build time becomes significant.
+- Protect the release branch with required checks and review rather than relying on branch names in prose.
+## Frontend CI
+The generated frontend job performs, in order:
+1. checkout;
+2. runtime setup with lockfile-aware npm caching;
+3. `npm ci`;
+4. lint where configured;
+5. strict typecheck;
+6. selected test level;
+7. production build;
+8. Playwright browser install and end-to-end tests when full testing is selected.
+React + Vite commands run from `frontend/`. Next.js and Expo commands run from the repository root. Build-time public values may use CI variables/secrets for convenience, but `NEXT_PUBLIC_`, `VITE_`, and `EXPO_PUBLIC_` values are still publicly bundled and must never be credentials.
+## Backend CI (Spring Boot)
+The generated Spring job runs:
+```bash
+cd backend
+mvn --batch-mode test
+mvn --batch-mode package -DskipTests
+```
+Unit/MVC tests use the generated H2 test configuration and do not need invented JWT credentials or a PostgreSQL service. Add a PostgreSQL service only when a real integration-test profile exercises PostgreSQL-specific behavior; use the same `DATABASE_URL`, `POSTGRES_USER`, and `POSTGRES_PASSWORD` contract as application configuration.
+## Next.js CI
+Next.js validates lint, types, selected tests, and `next build`. Supabase SSR builds receive only the public project URL and publishable key. Other Next.js backends do not receive placeholder Supabase values.
+When full testing is selected, Playwright starts the generated development server. Give that step the same required public build/runtime values as the application build and keep test accounts/data isolated from production.
+## Security and Releases
+- Validation workflows should normally declare `permissions: contents: read`.
+- Release/publish jobs require explicit additional permissions and should be separate from untrusted pull-request validation.
+- Use protected environments for production deployment approval and environment-scoped secrets.
+- Generate provenance/SBOM artifacts when the deployment risk warrants them.
+- Keep deployment rollback documented and test it before an incident.
+## Agent Rules
+- Change local scripts and CI together so command behavior does not drift.
+- Do not weaken a failing check to make a pull request green; fix the defect or document an approved policy change.
+- If a job needs a secret, name its owner, rotation process, environments, and why an identity federation mechanism cannot replace it.
+- Add path filters only after confirming changes to shared root configuration still trigger every affected job.

package/playbooks/capabilities/docker/docker.manifest.json ADDED Viewed

@@ -0,0 +1,11 @@
+{
+  "id": "docker",
+  "kind": "devops",
+  "label": "Docker",
+  "file": "capabilities/docker/overview.md",
+  "required": false,
+  "folders": [],
+  "concerns": [
+    { "id": "docker", "required": true, "sections": ["Dev vs Prod Differences", "Dockerfiles"] }
+  ]
+}

package/playbooks/capabilities/docker/overview.md ADDED Viewed

@@ -0,0 +1,55 @@
+# Docker Capability
+Generated Docker files are executable configuration, not tutorial samples. Keep this playbook focused on decisions the files cannot express by themselves.
+## Core Rules
+- Pin major runtime versions and use small trusted base images.
+- Copy dependency descriptors before application source so dependency layers remain cacheable.
+- Use a non-root runtime user when the framework image and deployment permit it.
+- Keep credentials out of images, build arguments, repository files, and Compose defaults. Inject them at runtime through the deployment platform.
+- Add `.dockerignore` files for dependencies, build output, secrets, IDE files, and VCS metadata.
+- Make health checks call a real application endpoint and distinguish readiness from liveness when the orchestrator supports both.
+- Scan the final image and update deliberately; do not hide known findings by disabling scanners.
+## Dev vs Prod Differences
+| Concern | Development | Production |
+|---|---|---|
+| Source | bind-mounted for fast feedback | copied into an immutable image |
+| Command | framework/Maven dev server | optimized server or executable JAR |
+| Dependencies | development dependencies available | runtime-only stage where practical |
+| Ports | exposed for local access | published by the deployment platform |
+| Credentials | local uncommitted environment | managed secret store |
+| Restart | developer-controlled | orchestrator policy |
+Do not deploy the development Compose file. Production needs explicit TLS termination, secret delivery, persistence/backup, resource limits, logging, probes, and rollout policy.
+## Dockerfiles
+The generated templates use multi-stage production builds:
+- Next.js builds standalone output, then copies only the standalone server, static assets, and public files.
+- Vite builds static assets, then serves them behind nginx with SPA fallback.
+- Spring Boot builds with Maven and runs the executable JAR on a JRE image.
+When editing a Dockerfile, verify both the image build and the container's real health endpoint. A successful compile alone does not prove the runtime stage contains all required files.
+## Compose Boundaries
+- `depends_on` controls startup ordering, not application readiness; use health conditions where a dependency must be ready.
+- Use named volumes only for data that must persist. Never mount source into a production container.
+- Bind databases to localhost in local development unless another host genuinely needs access.
+- Keep frontend-public values separate from backend secrets. Public framework prefixes remain public inside containers.
+- For managed Supabase, Compose should run the application client; it should not pretend a full Supabase platform exists locally unless the Supabase CLI owns that environment.
+## Verification
+```bash
+docker compose config
+docker compose build
+docker compose up
+docker compose ps
+```
+Then call the application health endpoint and exercise one real request across service boundaries. Inspect logs for secret leakage before considering the container setup complete.

package/playbooks/capabilities/flyway/environments.md ADDED Viewed

@@ -0,0 +1,5 @@
+# Flyway Environments
+Apply the same migration history through local, test, staging, and production. Production uses one
+controlled migrator with least-privilege credentials, locking, backup/recovery, and reviewed commands.
+Never enable clean/reset or repair checksums casually in shared environments.

package/playbooks/capabilities/flyway/flyway.manifest.json ADDED Viewed

@@ -0,0 +1,12 @@
+{
+  "id": "flyway",
+  "kind": "migration",
+  "label": "Flyway",
+  "playbooks": ["capabilities/flyway/migrations.md", "capabilities/flyway/environments.md", "capabilities/flyway/testing.md"],
+  "appliesTo": { "backend": ["springboot"] },
+  "required": true,
+  "folders": [],
+  "concerns": [
+    { "id": "migration", "required": true, "playbook": "capabilities/flyway/migrations.md", "sections": ["Naming and Ownership"] }
+  ]
+}

package/playbooks/capabilities/flyway/migrations.md ADDED Viewed

@@ -0,0 +1,7 @@
+# Flyway Migrations
+## Naming and Ownership
+Use immutable ordered versioned migrations with descriptive names and repeatables only for truly
+replaceable objects. Keep schema change and consuming code review together. Prefer explicit SQL,
+expand/contract rollouts, bounded backfills, and forward fixes after deployment.

package/playbooks/capabilities/flyway/testing.md ADDED Viewed

@@ -0,0 +1,5 @@
+# Flyway Testing
+Run Flyway from empty PostgreSQL and supported previous baselines. Start the Spring context against
+the migrated schema, verify constraints and important queries, and test risky expand/contract stages.
+Checksum drift or out-of-order production history fails CI rather than being repaired automatically.

package/playbooks/capabilities/laravel/database.md ADDED Viewed

@@ -0,0 +1,8 @@
+# Laravel Database
+PostgreSQL is the generated default. Eloquent owns ordinary persistence; query objects or
+repositories are escalation tools, not model-by-model ceremony. Use foreign keys, unique
+constraints, checks, appropriate nullability, indexes derived from real query paths, and
+race-safe handling of constraint violations. Prevent N+1 queries and allowlist client
+sorting/filtering. Factories own test data; seeders own deliberate local/demo baseline data.

package/playbooks/capabilities/laravel/migrations.md ADDED Viewed

@@ -0,0 +1,15 @@
+# Laravel Migrations
+## Development
+Laravel migrations are the schema source of truth. Generate descriptive migrations,
+review their SQL impact, test from an empty PostgreSQL database, and commit them with the
+code that needs them. Never edit an already-deployed migration to change history.
+## Production
+Use reviewed `php artisan migrate --force` in a deployment job with concurrency control,
+backups, monitoring, and a documented recovery path. Prefer expand/contract changes for
+zero-downtime releases. Production reset/refresh commands are forbidden. Prefer a new
+forward-fix migration after deployment; use `down()` only when rollback is verified safe.

package/playbooks/capabilities/laravel/observability.md ADDED Viewed

@@ -0,0 +1,8 @@
+# Laravel Observability
+Emit structured logs with request/trace identifiers, stable event names, safe entity IDs,
+latency, and outcome. Redact authentication material, secrets, uploads, and unnecessary
+PII. Measure HTTP errors/latency, database saturation, cache behavior, queue depth/age,
+retries, failed jobs, and scheduler outcomes. Health checks distinguish liveness from
+dependency readiness without leaking configuration.