qualia-framework 6.8.0 → 6.9.0

package/templates/stacks/full-app/scaffold/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "ES2022"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/templates/stacks/full-app/stack.json

@@ -0,0 +1,9 @@
+{
+  "id": "full-app",
+  "title": "Full App",
+  "description": "Authenticated product — Supabase auth + Postgres + RLS, Tailwind UI, deployed on Vercel. The default for anything with user accounts and persisted data.",
+  "archetype": "web-app",
+  "defaultStack": "Next.js 16 (App Router) · Supabase (auth + Postgres + RLS) · Tailwind · Vercel",
+  "scaffoldEntry": "app/page.tsx",
+  "whenToUse": "Any product with logged-in users, roles, and a database. Pick this when users sign up, data persists per-user, and RLS must isolate tenants."
+}

package/templates/stacks/full-app/verify-checklist.md

@@ -0,0 +1,32 @@
+# Full App — Definition of Done
+
+Per-stack verify checklist. Inherits `rules/constitution.md` and the `web-app` archetype DoD.
+
+## Auth & Access (constitution — non-negotiable)
+- [ ] Supabase auth with the chosen model; email verification + password reset wired.
+- [ ] **RLS enabled on every table**, policies derived from `app_metadata` (never `user_metadata`).
+- [ ] RLS verified as two+ users — each sees only its own rows.
+- [ ] Every UPDATE policy has a matching SELECT policy.
+- [ ] Postgres views set `security_invoker = true`.
+- [ ] Storage upsert grants INSERT + SELECT + UPDATE on the bucket.
+- [ ] Sessions revoked before a user is deleted.
+
+## Security
+- [ ] `SUPABASE_SERVICE_ROLE_KEY` is server-only — never `NEXT_PUBLIC_`, never imported in a client component.
+- [ ] Mutations use `lib/supabase/server.ts`; client reads use `lib/supabase/client.ts`.
+- [ ] Inputs validated with Zod; no `dangerouslySetInnerHTML`, no `eval()`.
+- [ ] Security headers (HSTS); CSRF/permission checks on every mutation.
+
+## Schema flow
+- [ ] All schema changes are migrations in `supabase/migrations/` — never hand-applied to remote.
+- [ ] `npx supabase gen types` run after schema changes.
+
+## App quality
+- [ ] Every async surface has loading / empty / error states.
+- [ ] Destructive actions confirm; rate limiting on mutating + public endpoints.
+- [ ] No N+1 on list views.
+
+## Build & Deploy
+- [ ] `npx tsc --noEmit` exits 0; `next build` succeeds.
+- [ ] Deploys to Vercel; homepage returns HTTP 200; auth callback responds.
+- [ ] Design anti-slop bar met (DESIGN.md); a11y AA.

package/templates/stacks/internal-tool/env.required.json

@@ -0,0 +1,20 @@
+[
+  {
+    "name": "NEXT_PUBLIC_SUPABASE_URL",
+    "purpose": "Supabase project URL — used by both client and server SDKs.",
+    "howToObtain": "Supabase Dashboard → Project Settings → API → Project URL, or `npx supabase projects list`.",
+    "ownerIssued": false
+  },
+  {
+    "name": "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY",
+    "purpose": "Public (anon/publishable) key for client-side Supabase calls. RLS protects data.",
+    "howToObtain": "Supabase Dashboard → Project Settings → API → Publishable/anon key.",
+    "ownerIssued": false
+  },
+  {
+    "name": "SUPABASE_SERVICE_ROLE_KEY",
+    "purpose": "Server-only service-role key — also used to invite staff users from a server action. NEVER NEXT_PUBLIC_, never in a client component.",
+    "howToObtain": "Supabase Dashboard → Project Settings → API → service_role key.",
+    "ownerIssued": false
+  }
+]

package/templates/stacks/internal-tool/phases.md

@@ -0,0 +1,45 @@
+# Internal Tool — Phase Plan
+
+Stack: Next.js 16 (App Router) · Supabase (portal auth + RLS) · Tailwind · Vercel.
+Archetype: `web-app` (internal/living product — runs as a rolling release, no terminal Handoff).
+Seed plan copied into ROADMAP.md by `/qualia-new`.
+
+## Phase 1: Foundation, Portal Auth & Roles
+
+**Goal:** Stack on a Vercel preview; Supabase wired with RLS on every table; invite-only auth (no public signup); roles in `app_metadata`.
+
+**Success criteria:**
+1. Staff log in (invite / SSO); public signup is disabled.
+2. Roles stored in `app_metadata`; role-based routing in middleware AND data layer.
+3. Every table has RLS; verified as two roles — each sees only its scope.
+4. Deploys to a Vercel preview URL.
+
+## Phase 2: Core Workflows (vertical slices)
+
+**Goal:** The primary staff workflows work end-to-end — list, detail, create/edit, with states.
+
+**Success criteria:**
+1. Primary workflow works end-to-end and persists.
+2. Every async surface has loading / empty / error states.
+3. Forms validate client AND server; destructive actions confirm + soft-delete where flagged.
+4. Mutations go through `lib/supabase/server.ts`.
+
+## Phase 3: Admin, Audit & Hardening
+
+**Goal:** User management, audit trail, rate limiting, performance.
+
+**Success criteria:**
+1. Admin can invite / deactivate users and assign roles.
+2. Audit log on sensitive writes; soft-delete where flagged.
+3. No N+1 on list views; rate limiting on mutating endpoints.
+4. Every UPDATE policy has a matching SELECT policy.
+
+## Phase 4: Polish & Rolling Release
+
+**Goal:** Design pass, a11y, prod deploy. As a living product this repeats per increment — no terminal Handoff.
+
+**Success criteria:**
+1. DESIGN.md anti-slop bar; a11y WCAG 2.2 AA.
+2. `service_role` server-only; security headers; MFA on accounts.
+3. Production deploy + smoke (HTTP 200, auth callback, role isolation).
+4. `/qualia-report` per increment.

package/templates/stacks/internal-tool/scaffold/.env.example

@@ -0,0 +1,7 @@
+# Supabase — internal portal. Public signup disabled; staff join by invite.
+NEXT_PUBLIC_SUPABASE_URL=
+NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=
+
+# Server-only — also used to invite staff from a server action.
+# NEVER prefix with NEXT_PUBLIC_, never import into a client component.
+SUPABASE_SERVICE_ROLE_KEY=

package/templates/stacks/internal-tool/scaffold/README.md

@@ -0,0 +1,29 @@
+# Internal Tool
+
+Staff-facing portal — Next.js 16 + Supabase (invite-only auth + RLS) + Tailwind + Vercel.
+Public signup is disabled; staff join by invite / SSO. Runs as a rolling release.
+
+## Run
+
+```bash
+npm install
+cp .env.example .env.local   # fill Supabase keys
+npx supabase db push
+npm run dev                  # http://localhost:3000
+```
+
+## Where things live
+
+- `app/page.tsx` — portal entry; reads session + role from `app_metadata`.
+- `lib/supabase/server.ts` — server adapter (mutations, RLS, inviting staff).
+- `lib/supabase/client.ts` — browser adapter (publishable key only).
+- `supabase/migrations/` — domain tables, RLS + role gating from the first migration.
+
+## Non-negotiables (constitution)
+
+- Roles live in `app_metadata`, never `user_metadata`.
+- RLS on every table; every UPDATE policy has a matching SELECT.
+- `service_role` server-only; used for inviting users from a server action.
+- Disable public signup in the Supabase Auth settings.
+
+This is an MVP skeleton. Build portal auth + workflows per `.planning/ROADMAP.md`.

package/templates/stacks/internal-tool/scaffold/app/globals.css

@@ -0,0 +1,13 @@
+@import "tailwindcss";
+
+/* OKLCH design tokens. Source of truth is .planning/DESIGN.md. */
+:root {
+  --brand: oklch(0.62 0.18 264);
+  --ink: oklch(0.21 0.01 264);
+  --paper: oklch(0.99 0.004 264);
+}
+
+body {
+  background: var(--paper);
+  color: var(--ink);
+}

package/templates/stacks/internal-tool/scaffold/app/layout.tsx

@@ -0,0 +1,20 @@
+import type { Metadata } from "next";
+import "./globals.css";
+
+export const metadata: Metadata = {
+  title: "Internal Tool",
+  // Internal portal — keep it out of search indexes.
+  robots: { index: false, follow: false },
+};
+
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/templates/stacks/internal-tool/scaffold/app/page.tsx

@@ -0,0 +1,22 @@
+import { createClient } from "@/lib/supabase/server";
+
+export default async function Home() {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  // Role lives in app_metadata (never user_metadata).
+  const role = (user?.app_metadata?.role as string | undefined) ?? "none";
+
+  return (
+    <main className="mx-auto flex min-h-dvh max-w-3xl flex-col justify-center gap-6 px-6">
+      <h1 className="text-4xl font-semibold tracking-tight">Internal Tool</h1>
+      <p className="text-lg text-neutral-600">
+        {user
+          ? `Signed in as ${user.email} (role: ${role}).`
+          : "Staff only — invite required. Wire portal auth + role gating in Phase 1."}
+      </p>
+    </main>
+  );
+}

package/templates/stacks/internal-tool/scaffold/lib/supabase/client.ts

@@ -0,0 +1,9 @@
+import { createBrowserClient } from "@supabase/ssr";
+
+// Client-side Supabase adapter — publishable key only. RLS protects data.
+export function createClient() {
+  return createBrowserClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!
+  );
+}

package/templates/stacks/internal-tool/scaffold/lib/supabase/server.ts

@@ -0,0 +1,28 @@
+import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+
+// Server-side Supabase adapter — all mutations and RLS-protected reads.
+export async function createClient() {
+  const cookieStore = await cookies();
+
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return cookieStore.getAll();
+        },
+        setAll(cookiesToSet) {
+          try {
+            cookiesToSet.forEach(({ name, value, options }) =>
+              cookieStore.set(name, value, options)
+            );
+          } catch {
+            // Server Component context — middleware refreshes the session.
+          }
+        },
+      },
+    }
+  );
+}

package/templates/stacks/internal-tool/scaffold/next.config.mjs

@@ -0,0 +1,6 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  // Internal portal — no public SEO. The root layout sets robots: noindex.
+};
+
+export default nextConfig;

package/templates/stacks/internal-tool/scaffold/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "internal-tool",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "@supabase/supabase-js": "^2.45.0",
+    "@supabase/ssr": "^0.5.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "tailwindcss": "^4.0.0",
+    "@tailwindcss/postcss": "^4.0.0",
+    "postcss": "^8.4.0",
+    "typescript": "^5.6.0"
+  }
+}

package/templates/stacks/internal-tool/scaffold/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;

package/templates/stacks/internal-tool/scaffold/supabase/migrations/0001_init.sql

@@ -0,0 +1,28 @@
+-- Initial migration. Internal portal: roles gate everything; RLS on every
+-- table from the first migration. Replace `records` with your real domain.
+
+create table if not exists public.records (
+  id uuid primary key default gen_random_uuid(),
+  owner_id uuid references auth.users (id) on delete set null,
+  title text not null,
+  status text not null default 'open',
+  deleted_at timestamptz,             -- soft-delete (constitution: where flagged)
+  created_at timestamptz not null default now()
+);
+
+alter table public.records enable row level security;
+
+-- Authenticated staff may read non-deleted records.
+create policy "records_select_staff"
+  on public.records for select
+  using (auth.role() = 'authenticated' and deleted_at is null);
+
+-- Admins (role in app_metadata) may write. Matching SELECT exists above.
+create policy "records_write_admin"
+  on public.records for all
+  using (
+    coalesce(auth.jwt() -> 'app_metadata' ->> 'role', '') = 'admin'
+  )
+  with check (
+    coalesce(auth.jwt() -> 'app_metadata' ->> 'role', '') = 'admin'
+  );

package/templates/stacks/internal-tool/scaffold/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "ES2022"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/templates/stacks/internal-tool/stack.json

@@ -0,0 +1,9 @@
+{
+  "id": "internal-tool",
+  "title": "Internal Tool",
+  "description": "Staff-facing portal — Supabase auth (invite/SSO, no public signup), role-gated dashboard, Tailwind, Vercel. Built for a known set of internal users.",
+  "archetype": "web-app",
+  "defaultStack": "Next.js 16 (App Router) · Supabase (portal auth + RLS) · Tailwind · Vercel",
+  "scaffoldEntry": "app/page.tsx",
+  "whenToUse": "Admin panel, ops dashboard, internal CRM — a known set of staff users, no public signup. Pick this over full-app when the audience is employees, access is invite-only, and roles gate everything."
+}

package/templates/stacks/internal-tool/verify-checklist.md

@@ -0,0 +1,31 @@
+# Internal Tool — Definition of Done
+
+Per-stack verify checklist. Inherits `rules/constitution.md` and the `web-app` archetype DoD.
+Internal/living product → runs as a **rolling release**; each increment clears this DoD, no terminal Handoff.
+
+## Portal auth & access (constitution)
+- [ ] Public signup disabled — staff join by invite / SSO only.
+- [ ] Roles stored in `app_metadata` (never `user_metadata`); role-based routing in middleware AND data layer.
+- [ ] **RLS enabled on every table**; verified as two roles — each sees only its scope.
+- [ ] Every UPDATE policy has a matching SELECT policy.
+- [ ] Postgres views set `security_invoker = true`.
+- [ ] Sessions revoked before a user is deleted/deactivated.
+
+## Security
+- [ ] `SUPABASE_SERVICE_ROLE_KEY` server-only; used only in server actions (e.g. inviting users).
+- [ ] Mutations use `lib/supabase/server.ts`; inputs validated with Zod.
+- [ ] Security headers (HSTS); MFA on Supabase/Vercel accounts.
+
+## App quality
+- [ ] Loading / empty / error states on every async surface.
+- [ ] Destructive actions confirm; soft-delete + audit where flagged.
+- [ ] Rate limiting on mutating endpoints; no N+1 on list views.
+
+## Schema flow
+- [ ] All schema changes are migrations in `supabase/migrations/`.
+- [ ] `npx supabase gen types` run after schema changes.
+
+## Build & Deploy
+- [ ] `npx tsc --noEmit` exits 0; `next build` succeeds.
+- [ ] Deploys to Vercel; HTTP 200; auth callback + role isolation verified.
+- [ ] Design anti-slop bar met; a11y AA.

package/templates/stacks/landing-page/env.required.json

@@ -0,0 +1,8 @@
+[
+  {
+    "name": "NEXT_PUBLIC_ANALYTICS_ID",
+    "purpose": "Optional analytics/measurement id for the marketing site (e.g. Plausible domain, GA4 id). The landing page runs without it.",
+    "howToObtain": "Create a property in your analytics provider and copy the site/measurement id. Skip if you are not tracking conversions yet.",
+    "ownerIssued": false
+  }
+]

package/templates/stacks/landing-page/phases.md

@@ -0,0 +1,42 @@
+# Landing Page — Phase Plan
+
+Stack: Next.js 16 (App Router, SSG) · Tailwind · Vercel. No database, no auth.
+Archetype: `website`. This is the seed plan `/qualia-new` copies into ROADMAP.md.
+
+## Phase 1: Foundation & Design System
+
+**Goal:** The site renders on a Vercel preview URL with the design system wired (tokens, fonts, OKLCH palette) and a base layout (nav + footer).
+
+**Success criteria:**
+1. `npm run dev` renders the homepage with no console errors.
+2. DESIGN.md tokens are live (CSS variables, distinctive type pair — never Inter/Arial/system-ui).
+3. Nav + footer render and are responsive at 375px and 1440px.
+4. Deploys to a Vercel preview URL.
+
+## Phase 2: Hero & Core Sections
+
+**Goal:** The above-the-fold hero plus the primary value sections (features, social proof) are built with real copy.
+
+**Success criteria:**
+1. Hero communicates the offer in one glance; primary CTA is present and reachable.
+2. Feature/benefit sections render with real copy — no lorem ipsum.
+3. All sections responsive, with loading-free SSG output.
+
+## Phase 3: Conversion & Contact
+
+**Goal:** The conversion path works — CTA → contact form or external link, with success/error states.
+
+**Success criteria:**
+1. Contact form (or CTA link) submits and shows a success state; errors are handled.
+2. If a form posts anywhere, it validates client-side (Zod or equivalent) — no DB needed.
+3. Analytics event fires on the primary CTA.
+
+## Phase 4: Polish & Launch
+
+**Goal:** Production-ready — SEO meta, a11y, performance, custom domain.
+
+**Success criteria:**
+1. SEO: title/description/OG tags per page; sitemap; favicon.
+2. a11y: alt text, labels, keyboard nav, AA contrast.
+3. Lighthouse performance/SEO green on the homepage.
+4. Custom domain wired; production deploy + smoke (HTTP 200).

package/templates/stacks/landing-page/scaffold/.env.example

@@ -0,0 +1,3 @@
+# Landing Page — no database, no auth. Nothing required to run locally.
+# Optional analytics (uncomment if you wire it):
+# NEXT_PUBLIC_ANALYTICS_ID=

package/templates/stacks/landing-page/scaffold/README.md

@@ -0,0 +1,25 @@
+# Landing Page
+
+Static/SSG marketing site — Next.js 16 + Tailwind + Vercel. No database, no auth.
+
+## Run
+
+```bash
+npm install
+npm run dev      # http://localhost:3000
+```
+
+## Ship
+
+```bash
+npm run build
+vercel --prod
+```
+
+## Where things live
+
+- `app/page.tsx` — the landing page itself (replace the hero copy).
+- `app/globals.css` — OKLCH design tokens. Source of truth is `.planning/DESIGN.md`.
+- `.env.example` — nothing required; copy to `.env.local` only if you add analytics.
+
+This is an MVP skeleton. Build the real sections per `.planning/ROADMAP.md`.

package/templates/stacks/landing-page/scaffold/app/globals.css

@@ -0,0 +1,14 @@
+@import "tailwindcss";
+
+/* Define your OKLCH palette here. Neutrals tinted toward the brand hue.
+   NEVER raw #000 / #fff. See .planning/DESIGN.md for the committed tokens. */
+:root {
+  --brand: oklch(0.62 0.18 264);
+  --ink: oklch(0.21 0.01 264);
+  --paper: oklch(0.99 0.004 264);
+}
+
+body {
+  background: var(--paper);
+  color: var(--ink);
+}

package/templates/stacks/landing-page/scaffold/app/layout.tsx

@@ -0,0 +1,19 @@
+import type { Metadata } from "next";
+import "./globals.css";
+
+export const metadata: Metadata = {
+  title: "Landing Page",
+  description: "Replace with your product's one-sentence pitch.",
+};
+
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/templates/stacks/landing-page/scaffold/app/page.tsx

@@ -0,0 +1,21 @@
+export default function Home() {
+  return (
+    <main className="mx-auto flex min-h-dvh max-w-3xl flex-col justify-center gap-6 px-6">
+      <h1 className="text-balance text-4xl font-semibold tracking-tight sm:text-6xl">
+        Your one-sentence pitch goes here.
+      </h1>
+      <p className="text-lg text-neutral-600">
+        Replace this hero with real copy. No lorem ipsum — the page is the
+        product.
+      </p>
+      <div>
+        <a
+          href="#contact"
+          className="inline-flex h-11 items-center rounded-md bg-neutral-900 px-6 font-medium text-white"
+        >
+          Primary CTA
+        </a>
+      </div>
+    </main>
+  );
+}

package/templates/stacks/landing-page/scaffold/next.config.mjs

@@ -0,0 +1,7 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  // Marketing site: keep it static where possible. Add `output: "export"`
+  // if the host is purely static (no Vercel server runtime needed).
+};
+
+export default nextConfig;

package/templates/stacks/landing-page/scaffold/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "landing-page",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "tailwindcss": "^4.0.0",
+    "@tailwindcss/postcss": "^4.0.0",
+    "postcss": "^8.4.0",
+    "typescript": "^5.6.0"
+  }
+}

package/templates/stacks/landing-page/scaffold/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;

package/templates/stacks/landing-page/scaffold/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "ES2022"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/templates/stacks/landing-page/stack.json

@@ -0,0 +1,9 @@
+{
+  "id": "landing-page",
+  "title": "Landing Page",
+  "description": "A static/SSG marketing site — hero, features, CTA, contact. No database, no auth. Built to convert, fast to ship.",
+  "archetype": "website",
+  "defaultStack": "Next.js 16 (App Router, SSG) · Tailwind · Vercel",
+  "scaffoldEntry": "app/page.tsx",
+  "whenToUse": "Marketing site, product landing, portfolio, throwaway prototype. Pick this when there is no logged-in user and no persistent data — the page IS the product."
+}