forgedock 1.27.0 → 1.28.0

package/templates/bootstrap/needs-human-issue.md

@@ -0,0 +1,45 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+<!-- /bootstrap needs-human issue: one per credential, account or external input (OAuth client, cloud or DNS account,
+payment keys, API keys, legal review). Label it needs-human and set "needsHuman": true in the plan. Code issues
+reference it (#{{KEY}}) but never list it under Dependencies; their mocks keep dev and CI green. Copy from "## Problem" down. -->
+## Problem
+
+{which credential, account or external input is needed, and which issues use it}
+
+### Setup steps
+
+1. {exact console URL and the clicks to create it}
+2. {settings to choose: redirect URIs, scopes, region}
+3. {store the values as deploy secrets (repository or environment secrets)}
+
+### Environment variables
+
+- `{SERVICE_CLIENT_ID}` — {what it is}
+- `{SERVICE_CLIENT_SECRET}` — {what it is}
+
+### Secret handling
+
+Never commit these values or paste them into issues. Store them only as deploy/CI secrets and a local untracked
+`.env`. Rotate them if exposed. Until they exist, dev and CI use the mock provider.
+
+## Root Cause (if known)
+
+Greenfield: an external input agents cannot create.
+
+## Affected Files
+
+1. `docs/setup/{service}.md` — new
+
+## Acceptance Criteria
+
+- [ ] Credentials created and stored as deploy secrets [type:manual]
+- [ ] The real provider replaces the mock in staging [type:manual]
+
+## Context
+
+**Parent**: #{{SPIKE}}
+
+## Dependencies
+
+None.

package/templates/bootstrap/stack-profiles.md

@@ -0,0 +1,34 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+# /bootstrap stack-profile presets
+
+Pick the preset closest to the interview and record the choice and its rationale in the spike's Stack section. A
+preset only fills blanks: anything the user said wins. Domain labels go into the plan's `labels`.
+
+## Next.js + shadcn SaaS
+- **Stack**: TypeScript, Next.js (App Router), shadcn/ui + Tailwind, Postgres (Prisma or Drizzle) with row-level security, Auth.js.
+- **Repo layout**: `apps/web/`, `packages/db/`, `packages/ui/`, `packages/config/`, `docs/engineering/`.
+- **Deployment**: Vercel or a VPS with Docker; managed Postgres; preview deployments per branch.
+- **Quality gates**: `tsc --noEmit`, ESLint, Vitest, Playwright smoke test, Lighthouse budget on hero pages.
+- **Domain labels**: `frontend`, `backend`, `infra`, `design`.
+
+## Python API
+- **Stack**: Python 3.12, FastAPI, SQLAlchemy + Alembic, Postgres, Pydantic settings, uv.
+- **Repo layout**: `src/<app>/api/`, `src/<app>/models/`, `src/<app>/services/`, `migrations/`, `tests/`, `docs/engineering/`.
+- **Deployment**: a container on a VPS or Cloud Run; managed Postgres.
+- **Quality gates**: ruff, mypy, pytest with coverage, an OpenAPI schema diff check.
+- **Domain labels**: `backend`, `infra`, `api`.
+
+## Mobile (Expo / React Native)
+- **Stack**: TypeScript, Expo + React Native, Expo Router, a backend from one of the presets above (or Supabase).
+- **Repo layout**: `apps/mobile/`, `apps/api/` (when a custom backend exists), `packages/shared/`, `docs/engineering/`.
+- **Deployment**: EAS Build and Submit; OTA updates for JS-only changes.
+- **Quality gates**: `tsc --noEmit`, ESLint, Jest, a Maestro or Detox smoke flow.
+- **Domain labels**: `mobile`, `backend`, `infra`, `design`.
+
+## Go service
+- **Stack**: Go, chi or net/http, sqlc + Postgres, Docker.
+- **Repo layout**: `cmd/<app>/`, `internal/`, `migrations/`, `docs/engineering/`.
+- **Deployment**: a single static binary in a container on a VPS or Fly.io.
+- **Quality gates**: `go vet`, golangci-lint, `go test -race`.
+- **Domain labels**: `backend`, `infra`.

package/templates/bootstrap/technical-spike.md

@@ -0,0 +1,75 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+# Technical Spike: {PRODUCT_NAME}
+
+> Written by /bootstrap. Every decision is followed by an ADR-style `**Rationale**:` line (the decision, why, and the
+> rejected alternative). bootstrap-create.mjs refuses to create the backlog while a section or a rationale is missing.
+
+## Assumptions
+
+{the "Here's what I assumed" list, one line each: aspect — default — rationale}
+
+## Guardrails
+
+{guardrails and domain rules from the interview; copied into every issue's Context}
+
+## Stack
+
+{languages, frameworks, database, auth, UI library}
+
+**Rationale**: {why this stack fits the product; rejected alternative}
+
+## Repo layout
+
+```
+{tree of planned directories and key files; /issue --greenfield validates Affected Files against it}
+```
+
+**Rationale**: {why this layout}
+
+## Runtime topology
+
+{services, workers, storage, CDN; the bootstrap-to-scale path: day-one single node -> next step -> at scale}
+
+**Rationale**: {why}
+
+## Data model
+
+{entities, relations, tenancy model, retention}
+
+**Rationale**: {why}
+
+## Security and privacy
+
+{authn/authz, secrets, PII handling, data residency, compliance}
+
+**Rationale**: {why}
+
+## Design system and quality gates
+
+{design tokens, component library, dark mode, a11y target; lint, type, test and performance gates in CI}
+
+**Rationale**: {why}
+
+## Route/API map
+
+| Route or endpoint | Purpose | Auth |
+|-------------------|---------|------|
+| {path} | {what} | {who} |
+
+**Rationale**: {why}
+
+## Credentials
+
+| Credential or account | Env var(s) | needs-human issue | Mock in dev/CI |
+|-----------------------|------------|-------------------|----------------|
+| {e.g. Google OAuth client} | `{GOOGLE_CLIENT_ID}` | {title} | {mock provider} |
+
+**Rationale**: {why each external input is mocked until a human provides it}
+
+## Milestone plan
+
+1. {Foundation — what it delivers}
+2. {next milestone}
+
+**Rationale**: {build order: foundation first, then dependents}