@maxnate/create-system

Scaffold a new Maxnate project with a real createSystem() backend bootstrap and maxnate-ui frontend shells.

Usage

npm create @maxnate/system@latest

Or with flags to skip prompts:

npm create @maxnate/system@latest -- --industry realestate,restaurant --theme realestate-clean --out ./my-app

Options

| Flag | Description | |------|-------------| | --industry <list> | Comma-separated industries: realestate, restaurant, healthcare, legal, education, fitness, saas, nonprofit, blog, ecommerce | | --theme <id> | Theme preset ID (e.g. realestate-clean, saas-modern) | | --out <dir> | Output directory | | --dry-run | Print what would be generated without writing files | | -h, --help | Show help |

What Gets Generated

• nuxt.config.ts — registers the maxnate-ui modules and capability manifest
• server/plugins/system-core.ts — boots createSystem({ prisma, plugins })
• server/api/_capabilities.get.ts — frontend capability manifest endpoint
• server/api/_system/public-config.get.ts — public config + boot-time UI strings
• server/api/public/i18n/ui-strings.get.ts — runtime UI-string refresh endpoint
• scripts/generate-schema.mjs — regenerates Prisma schema from installed capability packages
• prisma/schema.prisma — generated schema output tracked in the app
• .env.example — environment variable template
• README.md — project readme with selected capabilities and next steps

First Run

npm install
cp .env.example .env
npm run db:push
npm run dev

npm install runs the generated schema script plus prisma generate, so the starter stays aligned with the selected backend plugins.

Industry Plugins

| Industry | Package | |----------|---------| | Real Estate | @system-core/plugin-realestate | | Restaurant | @system-core/plugin-restaurant | | Healthcare | @system-core/plugin-healthcare-core (+ verticals: plugin-hc-dispensary, plugin-hc-clinic, plugin-hc-doctor, plugin-hc-lab, plugin-hc-pharmacy, plugin-hc-dental) | | Legal | @system-core/plugin-legal | | Education | @system-core/plugin-education | | Fitness | @system-core/plugin-fitness | | SaaS | @system-core/plugin-saas | | Nonprofit | @system-core/plugin-nonprofit | | Blog | @system-core/plugin-blog | | E-Commerce | @system-core/plugin-ecommerce |

Capability Plugins (Payments / SMS / CRM)

Cross-cutting capabilities that register shared modules consumed by industry plugins. Install the matching provider package alongside each capability plugin.

| Capability | Plugin Package | Provider Packages | |------------|----------------|-------------------| | Payments | @maxnate/plugin-payments (+ @maxnate/payments-core) | @maxnate/provider-snippe, @maxnate/provider-clickpesa, @maxnate/provider-selcom, @maxnate/provider-azampay, @maxnate/provider-everyorg | | SMS | @maxnate/plugin-sms (+ @maxnate/sms-core) | @maxnate/provider-twilio | | CRM | @maxnate/plugin-crm (+ @maxnate/crm-core) | @maxnate/provider-hubspot |

Theme Presets

| ID | Label | Paired Industries | |----|-------|-------------------| | realestate-clean | Real Estate — Clean | realestate | | realestate-luxury | Real Estate — Luxury | realestate | | restaurant-warm | Restaurant — Warm | restaurant | | restaurant-fine-dining | Restaurant — Fine Dining | restaurant | | healthcare-trust | Healthcare — Trust | healthcare | | legal-authority | Legal — Authority | legal | | education-friendly | Education — Friendly | education | | fitness-energy | Fitness — Energy | fitness | | saas-modern | SaaS — Modern | saas | | saas-developer | SaaS — Developer | saas | | nonprofit-impact | Nonprofit — Impact | nonprofit | | agency-bold | Agency — Bold | any |

Security Headers

The scaffold includes security headers configured in nuxt.config.ts:

routeRules: {
  '/api/**': { headers: {
    'X-Content-Type-Options': 'nosniff',
    'X-Frame-Options': 'DENY',
    'X-XSS-Protection': '1; mode=block',
  }},
  '/**': { headers: {
    'X-Content-Type-Options': 'nosniff',
    'Referrer-Policy': 'strict-origin-when-cross-origin',
    'Permissions-Policy': 'camera=(), microphone=(), payment=()',
  }},
}

Content Security Policy (CSP)

CSP is not hardcoded in the scaffold because it requires knowing your application's specific external resources (CDNs, analytics, fonts, etc.). Configure CSP per-environment:

For production, add to nuxt.config.ts:

routeRules: {
  '/**': { headers: {
    'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.example.com;",
  }}
}

Common CSP directives:

• default-src 'self' — default allowlist
• script-src 'self' — allowed script sources
• style-src 'self' 'unsafe-inline' — CSS (add nonce for CSP-compliant inline styles)
• img-src 'self' data: https: — images (add your CDN domains)
• font-src 'self' data: — fonts
• connect-src 'self' — fetch/XHR origins
• frame-ancestor 'none' — prevent framing (already set via X-Frame-Options)

Test your CSP with Report-URI or Chrome DevTools Security tab before deploying.

License

MIT