mesa-ai-cto 0.0.1

package/LICENSE

@@ -0,0 +1,155 @@
+THE AI CTO — PROPRIETARY LICENSE
+
+Copyright (c) 2026 Mesa Startup Lab. All rights reserved.
+
+Created by Gaurav Madan and the Mesa Startup Lab team.
+
+--------------------------------------------------------------------------------
+1. DEFINITIONS
+--------------------------------------------------------------------------------
+
+"The Kit" means this repository and everything in it: the module execution guides,
+the concept cards, the checklists, the kit manifests, the AGENTS.md and
+INITIALIZE.md templates, the prompts, the pitch deck, the scripts, and any
+software published from it including the `mesa-ai-cto` command-line tool.
+
+"Licensor" means Mesa Startup Lab, the owner of the Kit.
+
+"You" means the individual or organisation granted a licence under these terms.
+
+"Your Products" means software You build for Yourself or for Your clients using
+the Kit.
+
+"Generated Code" means source code, configuration and other files produced by an
+AI agent, by You, or by the `mesa-ai-cto` tool while following the Kit.
+
+--------------------------------------------------------------------------------
+2. WHAT YOU MAY DO
+--------------------------------------------------------------------------------
+
+Subject to Section 3, You are granted a non-exclusive, non-transferable,
+worldwide licence to:
+
+  a. USE the Kit to design, build, test, deploy and operate Your Products,
+     including for commercial purposes and including work delivered to clients.
+
+  b. OWN the Generated Code outright. Nothing in this licence claims any right
+     over the code You or Your agent produce by following the Kit. You may
+     license, sell, open-source or keep that code entirely as You choose, with
+     no obligation to attribute the Kit.
+
+  c. COPY the guides, checklists, prompts and templates into Your own private
+     repositories, and modify them there, for use on Your Products.
+
+  d. SHARE the Kit within Your organisation, with employees and contractors
+     working on Your Products, provided they are bound by these terms.
+
+--------------------------------------------------------------------------------
+3. WHAT YOU MAY NOT DO
+--------------------------------------------------------------------------------
+
+You may not, without prior written permission from the Licensor:
+
+  a. REDISTRIBUTE, resell, rent, lease, sublicense or otherwise make the Kit, or
+     any substantial part of it, available to anyone outside Your organisation.
+
+  b. PUBLISH the Kit, or any substantial part of it, publicly — including in a
+     public repository, a website, a book, a course, or a video series.
+
+  c. OFFER a product or service that is substantially the Kit, or that is derived
+     from it and competes with it, whether paid or free.
+
+  d. USE the Kit, or any substantial part of it, as training data for a machine
+     learning model, or to generate a derivative work intended for distribution.
+
+  e. REMOVE or obscure any copyright, attribution or licence notice in the Kit.
+
+For clarity: Section 3 restricts redistribution of *the Kit*. It places no
+restriction whatsoever on Your Products or on Generated Code, which are Yours
+under Section 2(b).
+
+--------------------------------------------------------------------------------
+4. NO WARRANTY
+--------------------------------------------------------------------------------
+
+THE KIT IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+The Kit contains security guidance, checklists and architectural
+recommendations. These are offered in good faith and are not a substitute for a
+professional security audit, legal advice, or compliance review appropriate to
+Your jurisdiction and industry. Software versions, provider behaviour and
+security best practice all change; each guide states the versions and the date it
+was last verified, and You are responsible for confirming that guidance is still
+current before relying on it.
+
+Following the Kit does not guarantee that Your Products are secure, correct,
+compliant, or fit for any purpose. You remain solely responsible for what You
+build, deploy and operate.
+
+--------------------------------------------------------------------------------
+5. LIMITATION OF LIABILITY
+--------------------------------------------------------------------------------
+
+IN NO EVENT SHALL THE LICENSOR OR ITS AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE KIT OR THE USE OR OTHER DEALINGS IN THE
+KIT — including without limitation any loss of data, loss of profit, business
+interruption, security incident, or third-party claim arising from software built
+using the Kit.
+
+--------------------------------------------------------------------------------
+6. TERMINATION
+--------------------------------------------------------------------------------
+
+This licence terminates automatically if You breach Section 3. On termination You
+must stop using the Kit and delete Your copies of it. Your Products and Generated
+Code created before termination are unaffected and remain Yours.
+
+--------------------------------------------------------------------------------
+7. GOVERNING LAW
+--------------------------------------------------------------------------------
+
+This licence is governed by the laws of India, and the courts of India shall have
+exclusive jurisdiction over any dispute arising from it.
+
+--------------------------------------------------------------------------------
+8. CONTACT
+--------------------------------------------------------------------------------
+
+For permissions beyond the scope of this licence — redistribution, resale,
+white-labelling, training use, or an enterprise arrangement — contact Mesa Startup
+Lab.
+
+================================================================================
+NOTICE — PROVENANCE
+================================================================================
+
+The Kit is not theory. Its architectural patterns, its security checklists and
+its traps are generalised from Mesa LMS, a production platform built and operated
+by Mesa Startup Lab: four user roles with scoped permissions, roughly forty
+backend modules, around fifty frontend feature slices, PostgreSQL, object
+storage, transactional email, web push, a progressive web app and an LLM module.
+
+Specifically:
+
+  * The response envelope, the error hierarchy, the boot-time environment
+    validation, the guard chain and the request logging format are generalised
+    from that codebase.
+
+  * The security checklists are derived from a review of it. Findings carry
+    identifiers (SEC-01 … SEC-20) so a rule in a checklist can be traced to the
+    incident or pattern that produced it. That review is included at
+    docs/specs/2026-08-19-mesa-security-review.md.
+
+  * The "How Mesa LMS does it" boxes in the concept cards point at real files in
+    that codebase, not at illustrative examples.
+
+Mesa LMS itself is separate proprietary software and is not licensed by this
+document. No right to Mesa LMS, its source code, its data, or any of its
+trademarks is granted here. The Kit is stack-generic: nothing in it requires You
+to use the same stack, the same providers, or the same conventions.
+
+"The AI CTO", "Mesa Startup Lab", "Mesa School of Business" and "Mesa LMS" are
+marks of Mesa Startup Lab.

package/README.md

@@ -0,0 +1,34 @@
+# mesa-ai-cto
+
+Scaffolds a production-grade project from a plan produced by [The AI CTO](https://github.com/Mesa-School).
+
+> **Not yet released.** `0.0.1` is a placeholder and does not scaffold anything.
+> The working client ships as `0.1.0`.
+
+## What it will do
+
+You describe your business to the AI CTO. It produces a plan — the tier, the stack, the
+modules, and what to build first. The plan gives you one command:
+
+```bash
+npx mesa-ai-cto my-app --tier1 --token=mesa_i_…
+```
+
+That command checks your machine, installs the right codebase, writes your plan and the
+module guides alongside it, installs dependencies, and leaves you with something running
+on localhost.
+
+```
+my-app/
+├── src/
+├── docs/          module guides and checklists
+├── plan.md        what you are building, and in what order
+└── mesa.json
+```
+
+## Licence
+
+Proprietary. See [LICENSE](LICENSE).
+
+The guides, checklists and boilerplate are **not** contained in this package. They are
+delivered only to a holder of a valid install token.

package/bin/mesa-ai-cto.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * Placeholder release.
+ *
+ * This exists so the name is held by the product that will use it — the dashboard already
+ * renders `npx mesa-ai-cto …` in every plan it produces, and a command that resolves to
+ * somebody else's package is worse than one that resolves to nothing.
+ *
+ * It also proves the publish pipeline while nothing is at stake. A version number can never
+ * be reused and a package cannot meaningfully be unpublished after 72 hours, so the first
+ * real release should not be the first release.
+ *
+ * Replaced by the real client in 0.1.0. See docs/specs/2026-08-22-cli-install-design.md.
+ */
+
+const args = process.argv.slice(2);
+const wants = (...flags) => args.some((a) => flags.includes(a));
+
+// `--version` and `--help` are questions this build can answer honestly, so they succeed.
+if (wants("-v", "--version")) {
+  process.stdout.write("0.0.1\n");
+  process.exit(0);
+}
+
+const HELP = `
+  mesa-ai-cto — scaffold a project from your AI CTO plan
+
+  Not yet released. This version is a placeholder and does not scaffold anything.
+
+  When it ships:
+    npx mesa-ai-cto <name> --tier<N> --token=<t>   scaffold a project
+    npx mesa-ai-cto doctor                          check your machine
+    npx mesa-ai-cto add <module>                    add a module guide
+
+  You get the command, with its token, from your plan in the AI CTO dashboard.
+`;
+
+if (wants("-h", "--help") || args.length === 0) {
+  process.stdout.write(`${HELP}\n`);
+  // No arguments is a request for help, and help was given.
+  process.exit(0);
+}
+
+// Anything else is somebody — or some agent — asking this to do real work. It cannot, and
+// exiting 0 would report success for a project that was never created.
+process.stderr.write(
+  "\n  mesa-ai-cto is not yet released — this is a placeholder version.\n" +
+    "  Nothing has been created. Run with --help for what is coming.\n\n",
+);
+process.exit(1);

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "mesa-ai-cto",
+  "version": "0.0.1",
+  "description": "Scaffold a production-grade project from an AI CTO plan. Placeholder release — not yet functional.",
+  "keywords": [
+    "scaffold",
+    "cli",
+    "nextjs",
+    "express",
+    "postgres",
+    "supabase"
+  ],
+  "homepage": "https://github.com/Mesa-School/ai_cto_license_configs#readme",
+  "bugs": {
+    "url": "https://github.com/Mesa-School/ai_cto_license_configs/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Mesa-School/ai_cto_license_configs.git",
+    "directory": "packages/mesa-ai-cto"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Gaurav Madan and the Mesa Startup Lab team",
+  "type": "module",
+  "bin": {
+    "mesa-ai-cto": "bin/mesa-ai-cto.mjs"
+  },
+  "//files": [
+    "An ALLOWLIST, deliberately, and never an .npmignore. An allowlist fails closed and a",
+    "denylist fails open — and the thing that escapes through an open failure here is the",
+    "Kit itself, or a .env. Every addition to this list is a decision to publish something."
+  ],
+  "files": [
+    "bin/",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}