coding-os 0.3.2__py3-none-any.whl

templates/spring-boot/scaffold/src/backend/pom.xml

@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-starter-parent</artifactId>
+    <version>3.3.0</version>
+    <relativePath/>
+  </parent>
+
+  <groupId>com.example</groupId>
+  <artifactId>{{PROJECT_NAME}}-backend</artifactId>
+  <version>0.1.0</version>
+  <packaging>jar</packaging>
+
+  <properties>
+    <java.version>21</java.version>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-validation</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-test</artifactId>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-maven-plugin</artifactId>
+      </plugin>
+      <plugin>
+        <groupId>com.diffplug.spotless</groupId>
+        <artifactId>spotless-maven-plugin</artifactId>
+        <version>2.44.5</version>
+        <configuration>
+          <java>
+            <googleJavaFormat>
+              <version>1.35.0</version>
+            </googleJavaFormat>
+          </java>
+        </configuration>
+        <executions>
+          <execution>
+            <id>spotless-check</id>
+            <phase>verify</phase>
+            <goals>
+              <goal>check</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+</project>

templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/Application.java

@@ -0,0 +1,16 @@
+package com.example.app;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+// SpringApplication bootstrap — owns wiring only, no business logic.
+// Component scanning discovers @RestController / @Service / @Repository beans
+// in this package and below; the container injects them by constructor.
+@SpringBootApplication
+public class Application {
+
+  public static void main(String[] args) {
+    SpringApplication.run(Application.class, args);
+    System.out.println("{{PROJECT_NAME}} backend started (spring-boot)");
+  }
+}

templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/common/GlobalExceptionHandler.java

@@ -0,0 +1,31 @@
+package com.example.app.common;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ProblemDetail;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.context.request.WebRequest;
+
+// The ONLY place that shapes an error response (RFC 9457 problem shape).
+// Controllers and services throw typed exceptions; this advice maps them.
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+
+  private static final Logger log = LoggerFactory.getLogger(GlobalExceptionHandler.class);
+
+  @ExceptionHandler(Exception.class)
+  public ProblemDetail handleUnexpected(Exception exception, WebRequest request) {
+    // Full detail to the logger only; never a stack trace to the client.
+    log.error("Unhandled exception shaping a 500 response", exception);
+
+    ProblemDetail problem = ProblemDetail.forStatus(HttpStatus.INTERNAL_SERVER_ERROR);
+    problem.setTitle("Internal Server Error");
+    return problem;
+  }
+
+  // Marker kept so a transport swap reads the JSON media type from one place.
+  static final MediaType PROBLEM_JSON = MediaType.APPLICATION_PROBLEM_JSON;
+}

templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthController.java

@@ -0,0 +1,22 @@
+package com.example.app.health;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+// Thin: maps the route and delegates to the service (Spring serializes the value).
+@RestController
+@RequestMapping("/health")
+public class HealthController {
+
+  private final HealthService health;
+
+  public HealthController(HealthService health) {
+    this.health = health;
+  }
+
+  @GetMapping
+  public HealthStatus check() {
+    return health.status();
+  }
+}

templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthService.java

@@ -0,0 +1,12 @@
+package com.example.app.health;
+
+import org.springframework.stereotype.Service;
+
+// Transport-free service — no HttpServletRequest, so it is unit-testable in isolation.
+@Service
+public class HealthService {
+
+  public HealthStatus status() {
+    return new HealthStatus("ok");
+  }
+}

templates/spring-boot/scaffold/src/backend/src/main/java/com/example/app/health/HealthStatus.java

@@ -0,0 +1,4 @@
+package com.example.app.health;
+
+// Response DTO — Spring serializes it to JSON; no envelope built by hand.
+public record HealthStatus(String status) {}

templates/spring-boot/scaffold/src/backend/src/test/java/com/example/app/health/HealthServiceTest.java

@@ -0,0 +1,15 @@
+package com.example.app.health;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Test;
+
+class HealthServiceTest {
+
+  @Test
+  void statusReportsOk() {
+    HealthStatus result = new HealthService().status();
+
+    assertThat(result.status()).isEqualTo("ok");
+  }
+}

templates/spring-boot/scaffold-boundary.yaml

@@ -0,0 +1,26 @@
+# Scaffold boundary for the spring-boot stack.
+# Schema: docs/governance/scaffold-boundary-contract.md
+
+version: 1
+stack: spring-boot
+
+roots:
+  - src/backend/
+
+file_patterns:
+  - "src/backend/**/*.java"
+  - "src/backend/**/*.xml"
+  - "src/backend/**/*.properties"
+  - "src/backend/**/*.yml"
+
+imports_from:
+  - src/shared/
+  - src/shared/contracts/
+
+forbids_writing_in:
+  - src/frontend/
+  - src/mobile/
+
+notes:
+  - "Controllers thin; services own logic; repositories own data access."
+  - "One @RestControllerAdvice is the only error-response shaper."

templates/spring-boot/skills/spring-boot/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: spring-boot
+tier: stack
+domain: [backend]
+description: Use when creating or modifying Java files under src/backend/ in a Spring Boot service — the @SpringBootApplication bootstrap, @RestController endpoints, @Service beans, Spring Data repositories, the global @RestControllerAdvice, @ConfigurationProperties, DTOs, and their tests. Triggers on any .java change under src/backend/. Covers constructor DI/bean wiring, thin controllers, the single error-shaping advice, fail-closed @Valid Bean Validation, the configuration-properties pattern, and slice/integration testing with @SpringBootTest + MockMvc. Also known as spring.
+globs: "src/backend/**/*.java"
+depends_on:
+  - clean-code
+  - backend-fundamentals
+  - api-design
+last_reviewed: "2026-06-14"
+---
+
+REQUIRED BACKGROUND: You MUST also follow the core `clean-code` and
+`backend-fundamentals` skills. This skill adds Spring Boot-specific patterns on
+top.
+
+# spring-boot
+
+## Layer contract (matches `structure.tree`)
+
+| Layer | May import | Never |
+|---|---|---|
+| `*Controller.java` (`@RestController`) | the feature service, DTOs | repositories, other controllers |
+| `*Service.java` (`@Service`) | repositories, other services | `HttpServletRequest`/`ServletResponse`, transport types |
+| `*Repository.java` (`@Repository`) | the `EntityManager` / Spring Data | services, controllers |
+| `common/` (advice/filters) | services (for auth lookups) | repositories |
+
+Services stay transport-free — no `HttpServletRequest` — so they are
+unit-testable and a transport swap (Spring MVC → WebFlux → messaging listener) is
+a controller-layer-only change.
+
+## DI & wiring
+
+- Inject collaborators by constructor into `final` fields; never `new` a bean and
+  never use field injection (`@Autowired` on a field) — both bypass the container
+  and break test overrides.
+- `@SpringBootApplication` owns wiring only, not business logic. Component scanning
+  discovers `@RestController`/`@Service`/`@Repository` beans in the base package
+  and below — there is no manual registration step.
+- Bean scopes: the default singleton for stateless services/repositories; only
+  reach for `@Scope("prototype")`/request scope when state genuinely demands it. A
+  singleton holding mutable request state is a bug.
+- Keep the bootstrap class reachable so `@SpringBootTest` builds the context
+  without binding a real port (`webEnvironment = RANDOM_PORT` or `MOCK`).
+
+## Controllers (thin)
+
+- A handler binds/validates the `@Valid` DTO → calls ONE service method → returns
+  the value (Spring serializes). Do not build the response envelope by hand;
+  return a typed record or `ResponseEntity<T>` when you need to set status/headers.
+- No try/catch for error shaping in a controller — throw a typed exception (a
+  domain exception or `ResponseStatusException`) and let the global advice shape it.
+
+## Validation
+
+- Every body/path/query input is a Bean Validation DTO behind `@Valid`
+  (`jakarta.validation` constraints); reject fail-closed before the service runs.
+  The service receives a typed, validated value and never reads the raw request.
+
+## Error handling
+
+- ONE global `@RestControllerAdvice` (`common/GlobalExceptionHandler.java`) shapes
+  every error response (RFC 9457 problem shape via `ProblemDetail`, per
+  `docs/api-contracts/error-format.md`). Unknown exceptions → 500 generic message,
+  full detail to the logger only — never a stack trace to the client.
+- Map typed domain exceptions to their status in dedicated `@ExceptionHandler`
+  methods on the same advice; keep the catch-all `Exception.class` last.
+
+## Configuration
+
+- Bind configuration once via `@ConfigurationProperties` types; services receive
+  typed config objects and never read raw `Environment`/`@Value` keys deep in a
+  method.
+
+## Testing
+
+- Services: pure unit tests, no context — construct with Mockito fakes/mocks and
+  assert.
+- Controllers/integration: `@SpringBootTest` + `MockMvc` (or `@WebMvcTest` for a
+  controller slice) builds the app in-memory; one happy + one error-path per
+  endpoint minimum.
+- Repositories: `@DataJpaTest` against a disposable database.
+- Never bind a real port in tests; always build through the test context.

templates/spring-boot/skills/spring-boot/references/anatomy.md

@@ -0,0 +1,63 @@
+<!-- domain:SPRINGBOOT | layer:reference | ssot:true | updated:2026-06-27 -->
+# Spring Boot Anatomy
+
+> P: Canonical file map + entity recipes for the Spring Boot (feature-package, constructor-DI) stack.
+> R: Adding any `.java` under `src/backend/`, or routing a backend task.
+> S: Reading frontend / mobile code — wrong stack.
+> N: [SKILL.md](../SKILL.md), [scaffold-boundary.yaml](../../../scaffold-boundary.yaml)
+
+> Nav: [Skill](../SKILL.md)
+
+---
+
+## 1. Boundary
+
+SSOT: `src/templates/spring-boot/scaffold-boundary.yaml`.
+
+## 2. Layout map
+
+| Pattern | Location | Naming | Imports from | Description |
+|---|---|---|---|---|
+| Controller | `<feature>/<Feature>Controller.java` | `<Feature>Controller.java` | its service | Thin — maps routes, delegates |
+| Service | `<feature>/<Feature>Service.java` | `<Feature>Service.java` | repository | Business logic (the only layer that thinks) |
+| Repository | `<feature>/<Feature>Repository.java` | `<Feature>Repository.java` | none | Spring Data persistence |
+| DTO | `<feature>/<Feature>Dtos.java` | `<Feature>Dtos.java` | none | `@Valid` Bean-Validation request shape |
+| Error shaper | `common/GlobalExceptionHandler.java` | — | none | `@RestControllerAdvice` — the ONLY shaper |
+| Test | `src/test/java/.../<Feature>Test.java` | `<Feature>Test.java` | source under test | JUnit 5 |
+
+## 3. Entity recipes
+
+### Add a new endpoint
+- **Trigger:** "add `POST /<feature>`".
+- **Files emitted:**
+  1. `<feature>/<Feature>Controller.java`
+  2. `<feature>/<Feature>Service.java`
+  3. `<feature>/<Feature>Dtos.java`
+- **Steps:**
+  1. Controller constructor-injects the service; `@Valid` the request DTO.
+  2. Service does the work; throws typed exceptions the advice maps.
+
+### Add a new model
+- **Trigger:** "persist `<Entity>`".
+- **Files emitted:** `<feature>/<Entity>.java` + `<Feature>Repository.java`.
+- **Steps:**
+  1. `@Entity` + a `JpaRepository`; never expose the entity as a DTO.
+
+### Add a new test
+- **Trigger:** any new controller / service.
+- **Files emitted:** `src/test/java/.../<Feature>Test.java`.
+- **Steps:**
+  1. `@WebMvcTest` for controllers; plain JUnit + Mockito for services.
+
+## 4. Conventions
+
+#### Naming
+- Files / types: `PascalCase.java`. Methods / fields: `camelCase`; constants: `UPPER_SNAKE`.
+
+#### Test colocation
+- Mirrored: `src/test/java/...` mirrors `src/main/java/...`.
+
+#### Dependency rules
+- ✓ controller → service → repository; inject via constructor.
+- ✗ never `new` a bean; no business logic in a controller.
+- ✗ `src/backend/` never imports from `src/frontend/` / `src/mobile/` — share via `src/shared/`.

templates/spring-boot/stack.yaml

@@ -0,0 +1,65 @@
+version: 1
+id: spring-boot
+language: java
+label: "Spring Boot + Java"
+category: backend
+
+structure:
+  root: src/backend
+  tree: |
+    src/backend/
+    ├── pom.xml
+    └── src/main/java/com/example/app/
+        ├── Application.java        # SpringApplication bootstrap (no business logic)
+        ├── common/                 # cross-cutting: the global @RestControllerAdvice error shaper
+        │   └── GlobalExceptionHandler.java
+        └── <feature>/              # one package per domain
+            ├── <Feature>Controller.java   # thin — maps routes, delegates to the service
+            └── <Feature>Service.java      # business logic (the only layer that thinks)
+  notes: "controllers thin, services own logic; one @RestControllerAdvice is the ONLY error-response shaper; DTOs validated with @Valid + Bean Validation before reaching a service; DI via constructor injection, never `new` a bean"
+primary_skill: spring-boot
+skills: [spring-boot]
+
+substitutions:
+  DOMAIN_ROUTES: "Backend→`docs/playbooks/spring-boot-service.md`"
+  SKILL_ROUTES: "Backend→`spring-boot`"
+  ENGINEERING_RULE_ROUTING: "Backend→`docs/engineering/spring-boot-rules.md`, Error format→`docs/api-contracts/error-format.md`"
+  TOOL_ROUTING_IMPL: "`lint-backend`, `test-backend`"
+  VERIFY_BACKEND_GLOB: "`src/backend/`"
+  VERIFY_BACKEND_SUITES: "lint-backend + test-backend"
+  VERIFY_BACKEND: "`cd src/backend && ./mvnw -q verify`"
+  QUICK_ROUTING: |-
+    - Spring Boot controller / service task → [Spring Boot Service Playbook](./playbooks/spring-boot-service.md)
+    - @RestControllerAdvice / DI / @Valid DTO validation → [Spring Boot Service Playbook](./playbooks/spring-boot-service.md)
+  STACK_REF_CODES: |-
+    - `REF:PLAYBOOK-SPRING` → `./playbooks/spring-boot-service.md`
+    - `REF:SPRING-RULES` → `./engineering/spring-boot-rules.md`
+
+ref_codes:
+  - {code: "REF:PLAYBOOK-SPRING", path: "./playbooks/spring-boot-service.md", desc: "Spring Boot service playbook"}
+  - {code: "REF:SPRING-RULES",    path: "./engineering/spring-boot-rules.md", desc: "Spring Boot engineering rules"}
+
+routing_entries:
+  - "Spring Boot controller / service task → [Spring Boot Service Playbook](./playbooks/spring-boot-service.md)"
+
+rules:
+  - {file: rules/backend.md, globs: ["src/backend/**/*.java"]}
+
+makefile_targets:
+  - {name: lint-backend, cmd: "cd src/backend && ./mvnw -q -DskipTests spotless:check"}
+  - {name: test-backend, cmd: "cd src/backend && ./mvnw -q test"}
+
+verify:
+  - {glob: "src/backend/**/*.java", suites: "lint-backend + test-backend", cmd: "cd src/backend && ./mvnw -q verify"}
+
+dimensions:
+  - {name: "Spring Boot controller",   read_files: ["docs/playbooks/spring-boot-service.md", "docs/engineering/spring-boot-rules.md"]}
+  - {name: "Service / business logic", read_files: ["docs/engineering/spring-boot-rules.md"]}
+  - {name: "Repository / persistence", read_files: ["docs/engineering/spring-boot-rules.md"]}
+  - {name: "DTO validation",           read_files: ["docs/engineering/spring-boot-rules.md", "docs/api-contracts/error-format.md"]}
+  - {name: "Security / authorization", read_files: ["docs/engineering/spring-boot-rules.md"]}
+
+skill_enforcement:
+  - {globs: ["src/backend/**/*.java"], primary: spring-boot, secondary: [clean-code, backend-fundamentals, api-design, auth-patterns, security-web, testing-strategy, observability]}
+  - {globs: ["src/backend/**/*Repository.java", "src/backend/**/repository/**/*.java", "src/backend/**/*Entity.java"], primary: spring-boot, secondary: [clean-code, db-design, backend-fundamentals]}
+  - {globs: ["src/backend/**/*SecurityConfig.java", "src/backend/**/security/**/*.java", "src/backend/**/Auth*.java"], primary: spring-boot, secondary: [auth-patterns, security-web, clean-code]}

templates/svelte-sveltekit/rules/frontend.md

@@ -0,0 +1,20 @@
+---
+globs: ["src/frontend/**/*.{svelte,ts}"]
+alwaysApply: false
+---
+
+# SvelteKit Frontend Rules (auto-loaded on src/frontend/**/*.{svelte,ts})
+
+When editing any Svelte or TypeScript file under `src/frontend/` in a SvelteKit project, follow these standards:
+
+- **Load functions own data** — fetch in `+page.ts` / `+page.server.ts` / `+layout.ts` with the injected `fetch`; components stay presentational. Fetching in a component `<script>` body is a review-blocking finding.
+- **File-based routing only** — a route is a directory under `routes/` with a `+page.svelte`; never hand-wire a client router. Dynamic segments use `[param]/`.
+- **State hierarchy** — local component state (`$state` / `let`) → `$lib/stores` `writable`/`derived` for cross-component state; one store per file, no module-level mutable singletons.
+- **Client/server split** — secrets and privileged clients live only in `+page.server.ts`, `+server.ts`, and `hooks.server.ts`; anything a `+page.svelte` imports ships to the client.
+- **One error shaper** — `hooks.server.ts::handleError` shapes every unexpected error response; endpoints throw or return typed errors, never build an ad-hoc error body.
+- **Strict TypeScript** — `npm run lint` (svelte-check) gates merges; `any` needs a written justification.
+- **A11y is not optional** — interactive elements keyboard-reachable with visible focus; the `a11y` core skill is the checklist SSOT.
+
+Canonical policy: `docs/engineering/svelte-sveltekit-rules.md`
+Playbook: `docs/playbooks/svelte-sveltekit-app.md`
+Primary skill: `svelte`

templates/svelte-sveltekit/scaffold/docs/engineering/svelte-sveltekit-rules.md

@@ -0,0 +1,37 @@
+<!-- domain:FRONTEND | layer:rules | ssot:true | updated:{{DATE}} -->
+# SvelteKit Engineering Rules
+
+Purpose: Non-negotiable conventions for the {{PROJECT_NAME}} SvelteKit frontend.
+Read when: Editing anything under `src/frontend/`.
+Skip when: Backend/mobile work.
+Read next: [SvelteKit App Playbook](../playbooks/svelte-sveltekit-app.md)
+
+> Nav: [Master Index](../00-index.md)
+
+## Hard rules
+
+1. **Load functions own data** — fetch in `+page.ts` / `+page.server.ts` / `+layout.ts`
+   with the injected `fetch`; components stay presentational. Fetching in a
+   component `<script>` body is a review-blocking finding.
+2. **File-based routing only** — a route is a directory under `routes/` with a
+   `+page.svelte`; never hand-wire a client router. Dynamic segments use
+   `[param]/`.
+3. **State hierarchy** — local component state (`$state` / `let`) → `$lib/stores`
+   `writable`/`derived` for cross-component state; one store per file, no module-
+   level mutable singletons. State-management skill is the hierarchy SSOT.
+4. **Client/server split** — secrets and privileged clients live only in
+   `+page.server.ts`, `+server.ts`, and `hooks.server.ts`; anything a
+   `+page.svelte` imports ships to the client.
+5. **One error shaper** — `hooks.server.ts::handleError` shapes every unexpected
+   error response (shape: `docs/api-contracts/error-format.md`); endpoints throw
+   or return typed errors, never build an ad-hoc error body.
+6. **Strict TypeScript** — `npm run lint` (svelte-check) gates merges; `any`
+   needs a written justification.
+7. **A11y is not optional** — interactive elements keyboard-reachable with
+   visible focus; the `a11y` core skill is the checklist SSOT.
+
+## Testing bar
+
+`load` functions unit-tested as pure functions; components behavior-tested with
+@testing-library/svelte (no snapshot-only suites); server endpoints invoked
+directly with a mocked request event.

templates/svelte-sveltekit/scaffold/docs/playbooks/svelte-sveltekit-app.md

@@ -0,0 +1,36 @@
+<!-- domain:FRONTEND | layer:playbook | ssot:true | updated:{{DATE}} -->
+# SvelteKit App Playbook
+
+Purpose: The recipe for adding routes, pages, components, stores and load functions to {{PROJECT_NAME}}.
+Read when: Any frontend feature or fix in src/frontend/.
+Skip when: Backend/mobile work.
+Read next: [SvelteKit Engineering Rules](../engineering/svelte-sveltekit-rules.md)
+
+> Nav: [Master Index](../00-index.md)
+
+## Add a route
+
+1. Create `src/frontend/src/routes/<path>/+page.svelte` (`[param]/` for dynamic segments).
+2. Fetch data in `+page.ts` (universal) or `+page.server.ts` (server-only) `load` — use the injected `fetch`, never the bare global.
+3. Keep the `.svelte` file presentational: props/`load` data in, markup out — no fetching in the component body.
+4. Accessibility pass per the `a11y` core skill checklist (focus, landmarks, keyboard).
+5. Test: component behavior via @testing-library/svelte; `load` functions as pure units.
+6. Verify: `cd src/frontend && npm run lint && npm test`.
+
+## Add a store
+
+`src/frontend/src/lib/stores/<name>.ts` exporting a `writable`/`derived` — one
+store per file. Subscribe in components with the `$store` auto-subscription;
+never mutate a store from inside a `load` function.
+
+## Add a server endpoint
+
+`src/frontend/src/routes/<path>/+server.ts` exporting `GET`/`POST` handlers;
+validate input fail-closed and return `json(...)`. Unexpected errors flow
+through `hooks.server.ts::handleError` — never hand-shape an error response.
+
+## Anti-patterns
+
+- Manual route wiring or a client router — file-based routing is the contract.
+- Fetching in a component's `<script>` body — data belongs in a `load` function.
+- Secrets in any module a `+page.svelte` imports — server-only code lives in `+page.server.ts` / `+server.ts` / `hooks.server.ts`.

templates/svelte-sveltekit/scaffold/src/frontend/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "{{PROJECT_NAME}}-frontend",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "lint": "svelte-check --tsconfig ./tsconfig.json",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@sveltejs/adapter-auto": "^3.2.0",
+    "@sveltejs/kit": "^2.5.0",
+    "@sveltejs/vite-plugin-svelte": "^3.1.0",
+    "svelte": "^5.0.0",
+    "svelte-check": "^3.7.0",
+    "typescript": "^5.4.0",
+    "vite": "^5.2.0",
+    "vitest": "^1.4.0"
+  }
+}

templates/svelte-sveltekit/scaffold/src/frontend/src/app.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{{PROJECT_NAME}}</title>
+    %sveltekit.head%
+  </head>
+  <body>
+    <div>%sveltekit.body%</div>
+  </body>
+</html>

templates/svelte-sveltekit/scaffold/src/frontend/src/hooks.server.ts

@@ -0,0 +1,14 @@
+import type { HandleServerError } from "@sveltejs/kit";
+
+// The single central error shaper for {{PROJECT_NAME}}. SvelteKit calls this
+// for every unexpected server error; the returned object is the only error
+// surface a client ever sees (shape: docs/api-contracts/error-format.md).
+// Log full detail server-side; never leak internals to the response.
+export const handleError: HandleServerError = ({ error, status, message }) => {
+  const reference = crypto.randomUUID();
+  console.error(`[{{PROJECT_NAME}}] error ${reference} (${status})`, error);
+  return {
+    message: status < 500 ? message : "Internal error",
+    reference,
+  };
+};

templates/svelte-sveltekit/scaffold/src/frontend/src/lib/components/Greeting.svelte

@@ -0,0 +1,6 @@
+<script lang="ts">
+  // Reusable presentational component for {{PROJECT_NAME}} — props in, markup out.
+  let { name }: { name: string } = $props();
+</script>
+
+<p>Hello, {name}.</p>

templates/svelte-sveltekit/scaffold/src/frontend/src/lib/stores/count.test.ts

@@ -0,0 +1,26 @@
+import { get } from "svelte/store";
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { count } from "./count";
+
+// Unit test for the {{PROJECT_NAME}} counter store — exercises the EXISTING
+// writable exported from ./count.ts. Pure store logic, no SvelteKit runtime.
+describe("count store", () => {
+  beforeEach(() => {
+    count.set(0);
+  });
+
+  it("starts at 0", () => {
+    expect(get(count)).toBe(0);
+  });
+
+  it("increments via update", () => {
+    count.update((n) => n + 1);
+    expect(get(count)).toBe(1);
+  });
+
+  it("sets an explicit value", () => {
+    count.set(42);
+    expect(get(count)).toBe(42);
+  });
+});

templates/svelte-sveltekit/scaffold/src/frontend/src/lib/stores/count.ts

@@ -0,0 +1,4 @@
+import { writable } from "svelte/store";
+
+// Cross-component counter store for {{PROJECT_NAME}} — one store per file.
+export const count = writable(0);

templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+layout.svelte

@@ -0,0 +1,24 @@
+<script lang="ts">
+  // Root shell for {{PROJECT_NAME}} — nav + a11y landmark; pages render via {@render children()}.
+  let { children } = $props();
+</script>
+
+<a href="#main" class="skip-link">Skip to content</a>
+<header>
+  <nav aria-label="Primary">
+    <a href="/">{{PROJECT_NAME}}</a>
+  </nav>
+</header>
+<main id="main">
+  {@render children()}
+</main>
+
+<style>
+  .skip-link {
+    position: absolute;
+    left: -999px;
+  }
+  .skip-link:focus {
+    left: 1rem;
+  }
+</style>

templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+page.svelte

@@ -0,0 +1,9 @@
+<script lang="ts">
+  import type { PageData } from "./$types";
+
+  // {{PROJECT_NAME}} landing page — presentational; data comes from +page.ts load.
+  let { data }: { data: PageData } = $props();
+</script>
+
+<h1>{data.title}</h1>
+<p>Scaffolded by coding-os — see docs/playbooks/svelte-sveltekit-app.md to add routes.</p>

templates/svelte-sveltekit/scaffold/src/frontend/src/routes/+page.ts

@@ -0,0 +1,7 @@
+import type { PageLoad } from "./$types";
+
+// Universal load for the landing route — runs on server then client.
+// Real data fetching goes here via the injected `fetch`; never bare global fetch.
+export const load: PageLoad = async () => {
+  return { title: "{{PROJECT_NAME}}" };
+};