Full Bootstrap Template

Use for any project that requires a database, external APIs, or authenticated users. Fill in the Mission field and update API key names to match your project, then paste the entire prompt directly into Claude Code.

This is Prompt 01 — the bootstrap. Claude Code will scaffold the project, create governance files, and stop at PLAN.md for your approval.

The prompt

You are bootstrapping a new project. Read this entire prompt before starting.

MISSION:
[One sentence describing what this project does, for whom, and why.]

TECH STACK:
- Next.js 14+ with App Router
- TypeScript (strict mode)
- Tailwind CSS
- Supabase (Postgres + Auth)
- Deployed on Vercel
- External APIs: [list — e.g. OpenAI, Anthropic, Perplexity]

REQUIRED FILES — create these exactly:

1. .claude/settings.json
   With this content exactly:
   {
     "permissions": {
       "allow": [
         "Read",
         "Glob",
         "Grep",
         "LS",
         "Edit",
         "MultiEdit",
         "Write(app/**)",
         "Write(components/**)",
         "Write(lib/**)",
         "Write(docs/**)",
         "Bash(npm run *)",
         "Bash(npm install *)",
         "Bash(npm test *)",
         "Bash(npx tsc *)",
         "Bash(npx prettier *)",
         "Bash(npx eslint *)",
         "Bash(git status)",
         "Bash(git diff *)",
         "Bash(git log *)",
         "Bash(git add *)",
         "Bash(git commit *)",
         "Bash(git checkout *)",
         "Bash(git branch *)"
       ],
       "deny": [
         "Read(**/.env*)",
         "Read(**/.dev.vars*)",
         "Read(**/*.pem)",
         "Read(**/*.key)",
         "Read(**/secrets/**)",
         "Read(**/credentials/**)",
         "Read(**/.aws/**)",
         "Read(**/.ssh/**)",
         "Read(**/.npmrc)",
         "Read(**/.pypirc)",
         "Edit(**/.env*)",
         "Write(**/.env*)",
         "Write(**/secrets/**)",
         "Write(**/.ssh/**)",
         "Bash(cat *.env*)",
         "Bash(head *.env*)",
         "Bash(tail *.env*)",
         "Bash(less *.env*)",
         "Bash(more *.env*)",
         "Bash(rm -rf *)",
         "Bash(sudo *)",
         "Bash(git push *)",
         "Bash(npm publish *)",
         "Bash(curl *)",
         "Bash(wget *)"
       ],
       "defaultMode": "acceptEdits"
     }
   }

2. CLAUDE.md
   Sections: Mission, Tech Stack, Conventions, Security Rules,
   Coding Standards, Uncertainty Handling. Be explicit about: no
   NEXT_PUBLIC_ on secrets, service-role key only on the server,
   no logging of request bodies that may contain secrets. If the
   project uses environment variables in tests, point the test
   framework at `.env.test` with dummy sentinel values (e.g.
   STRIPE_SECRET_KEY=sk_test_dummy). Never copy real secrets into
   `.env.test`.

   The Uncertainty Handling section must instruct Claude Code to
   flag uncertainty before acting on it: when unsure about an API
   signature, library behaviour, type definition, or how an existing
   file is structured, say so and read the source rather than guess.
   Never invent function names, types, or import paths.

3. memory.md
   Empty file with a header: "# Decision Log". Append to this as
   we make decisions.

4. .env.local
   With placeholder values only:
   NEXT_PUBLIC_SUPABASE_URL=your_url_here
   NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key_here
   SUPABASE_SERVICE_ROLE_KEY=your_service_role_key_here
   OPENAI_API_KEY=your_openai_key_here
   [add others as needed]

5. .env.example
   Same key names as .env.local, all empty values, committed to the repo.

6. .gitignore
   Standard Next.js + Node, plus: .env*.local, .vercel/

7. Folder structure:
   /app           <- Next.js App Router
   /components    <- React components
   /lib           <- utilities, Supabase client
   /docs          <- documentation (empty for now)
   /docs/features <- one PRD per feature sprint
   /docs/decisions <- detailed decision records

8. README.md
   Project name, mission, getting started (npm install, .env.local
   copy from .env.example, npm run dev).

INSTALL:
- npm install
- Confirm next, react, tailwindcss, @supabase/supabase-js,
  and any API SDKs install cleanly.

GIT:
- git init
- First commit: "Initial bootstrap"
- Do NOT push to a remote yet — there is no remote yet.

WHEN DONE:
Write PLAN.md at the project root. PLAN.md must include:
- Component tree (a list of components you'll need for the MVP)
- Route structure (pages and API routes)
- Data model (Supabase tables, columns, relationships)
- File count estimate
- CSS approach (utility classes vs extracted components)
- Any deviations from this prompt and why

Then STOP. Do not write any application code. Wait for me to
approve PLAN.md before proceeding.