Extract reusable frontend/admin package and refresh the demo

.env.example

@@ -67,6 +67,8 @@ VITE_APP_NAME="${APP_NAME}"
 
 # Demo Mode Configuration (set to true on demo server only)
 DEMO_MODE=false
+# Optional host-only Packagist snapshots; requires Laravel's scheduler.
+LARACOREKIT_COLLECT_STATS=false
 DEMO_RESET_INTERVAL=30
 DEMO_ADMIN_EMAIL=admin@laracorekit.com
 DEMO_ADMIN_PASSWORD=Admin@123

.github/IMPLEMENTATION_CHECKLIST.md

@@ -1,5 +1,7 @@
 # LaraCoreKit - Implementation Checklist
 
+Historical checklist from the earlier host audit. For the current package extraction, validation evidence and external release blockers, see [implementation report](../docs/implementation-report.md).
+
 This document tracks the implementation of improvements based on the comprehensive audit report.
 
 ## Must-Fix Priority Items

.github/README_REPOSITORY.md

@@ -3,7 +3,7 @@
 Use this for the GitHub repository About/Description section:
 
 ```
-Modular Laravel 13 starter kit with Filament 5, Livewire 4, Tailwind 4, multilingual content, RTL support, auth, roles/permissions, blog, settings, media, and publishable add-on modules.
+Modular Laravel foundation for public websites and Filament administration. Reusable Composer package, documentation, demo host and component examples.
 ```
 
 ## Topics/Tags

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: composer
+    directory: /packages/core
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/package-workflows/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/package-workflows/prepare-release.yml

@@ -0,0 +1,62 @@
+name: Prepare Release PR
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Reviewed stable version without v (example: 0.1.0)'
+        required: true
+permissions:
+  contents: read
+jobs:
+  propose:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Validate version and prepare release notes
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          python3 - <<'PY'
+          import os, re, subprocess
+          from pathlib import Path
+          from datetime import date
+          version = os.environ['RELEASE_VERSION']
+          if not re.fullmatch(r'(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)', version):
+              raise SystemExit('Use a stable semantic version, e.g. 0.1.0.')
+          if subprocess.run(['git', 'rev-parse', '--verify', 'refs/tags/v'+version], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0:
+              raise SystemExit('That release tag already exists.')
+          path = Path('CHANGELOG.md')
+          text = path.read_text()
+          if '## Unreleased' not in text:
+              raise SystemExit('Missing Unreleased notes.')
+          text = text.replace('## Unreleased', '## Unreleased\n\n## '+version+' - '+date.today().isoformat(), 1)
+          path.write_text(text)
+          PY
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, mbstring, zip, pdo_sqlite, bcmath, intl, gd, exif
+          coverage: none
+      - run: composer validate --strict
+      - run: composer install --no-dev --prefer-dist --no-interaction
+      - run: composer audit
+      - name: Open draft release PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          branch="codex/release-$RELEASE_VERSION"
+          git switch -c "$branch"
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add CHANGELOG.md
+          git commit -m "Prepare v$RELEASE_VERSION release notes"
+          git push --set-upstream origin "$branch"
+          printf 'Prepare version %s.\n\nBefore publishing: verify monorepo regression/consumer checks and package export, review compatibility and these release notes. After merge, tag the reviewed package commit and publish the GitHub release; Packagist indexes the tag. This workflow creates no release tag and does not publish.\n' "$RELEASE_VERSION" > "$RUNNER_TEMP/release-body.md"
+          gh pr create --base main --head "$branch" --draft --title "Prepare v$RELEASE_VERSION" --body-file "$RUNNER_TEMP/release-body.md"

.github/package-workflows/sync-source.yml

@@ -0,0 +1,91 @@
+name: Sync Package Source
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 8 * * *'
+permissions:
+  contents: read
+jobs:
+  propose:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          path: distribution
+      - uses: actions/checkout@v6
+        with:
+          repository: ProgrammerNomad/LaraCoreKit
+          ref: main
+          path: source
+          persist-credentials: false
+      - name: Check source availability and pending proposals
+        id: source
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [ ! -f source/packages/core/composer.json ]; then
+            echo 'Package extraction is not on the monorepo main branch yet.'
+            exit 0
+          fi
+          pending=$(gh pr list --state open --label package-sync --json number --jq length)
+          if [ "$pending" != '0' ]; then
+            echo 'A package source proposal is already waiting for review.'
+            exit 0
+          fi
+          echo 'ready=true' >> "$GITHUB_OUTPUT"
+      - if: steps.source.outputs.ready == 'true'
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, mbstring, zip, pdo_sqlite, bcmath, intl, gd, exif
+          coverage: none
+      - if: steps.source.outputs.ready == 'true'
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: source/package-lock.json
+      - name: Validate the monorepo source and prepare the package
+        if: steps.source.outputs.ready == 'true'
+        working-directory: source
+        run: |
+          composer install --prefer-dist --no-interaction
+          cp .env.example .env
+          php artisan key:generate
+          composer validate --strict
+          composer --working-dir=packages/core validate --strict
+          composer review
+          composer audit --locked
+          npm ci
+          npm audit
+          npm run build:core
+          python3 tools/consumer-smoke.py
+          python3 tools/package-release.py
+      - name: Propose a package-only source update
+        if: steps.source.outputs.ready == 'true'
+        working-directory: distribution
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          branch="codex/package-sync-$GITHUB_RUN_ID"
+          source_sha=$(git -C ../source rev-parse HEAD)
+          git switch -c "$branch"
+          # Preserve this repository's own maintenance workflow.
+          git rm -r --ignore-unmatch -- . ':!.github'
+          unzip -oq ../source/storage/app/releases/laracorekit-preview.zip
+          git add -A
+          if git diff --cached --quiet; then
+            echo 'Package source is already current.'
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -m "Sync package source from $source_sha"
+          git push --set-upstream origin "$branch"
+          printf 'Update package source from LaraCoreKit commit %s.\n\nMonorepo checks, dependency audits and clean-consumer installation passed. Review and merge before creating a release tag.\n' "$source_sha" > "$RUNNER_TEMP/package-sync-body.md"
+          gh pr create --base main --head "$branch" --draft --label package-sync --title 'Sync LaraCoreKit package source' --body-file "$RUNNER_TEMP/package-sync-body.md"

.github/workflows/build.yml

@@ -1,38 +1,28 @@
 name: Build Assets
-
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main, develop ]
-
+    branches: [main, develop]
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
-    name: Build Frontend Assets
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: shivammathur/setup-php@v2
         with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build assets
-        run: npm run build
-
-      - name: Check for build errors
-        run: |
-          if [ -d "public/build" ]; then
-            echo "Build directory created successfully"
-            ls -la public/build
-          else
-            echo "Build directory not found!"
-            exit 1
-          fi
+          php-version: '8.3'
+          extensions: intl, gd, exif, zip
+          coverage: none
+      - run: composer install --prefer-dist --no-interaction
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+      - run: npm ci
+      - run: npm audit
+      - run: npm run build:core
+      - run: npm run build
+      - run: git diff --exit-code -- packages/core/resources/dist

.github/workflows/code-quality.yml

@@ -1,50 +1,23 @@
 name: Code Quality
-
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main, develop ]
-
+    branches: [main, develop]
+permissions:
+  contents: read
 jobs:
-  pint:
+  quality:
     runs-on: ubuntu-latest
-    name: Laravel Pint
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@v6
+      - uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.3
-          extensions: dom, curl, libxml, mbstring, zip
+          php-version: '8.3'
+          extensions: dom, curl, mbstring, zip, pdo_sqlite, bcmath, intl, gd, exif
           coverage: none
-
-      - name: Install dependencies
-        run: composer install --prefer-dist --no-interaction
-
-      - name: Run Pint
-        run: vendor/bin/pint --test
-
-  phpstan:
-    runs-on: ubuntu-latest
-    name: PHPStan
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: 8.3
-          extensions: dom, curl, libxml, mbstring, zip
-          coverage: none
-
-      - name: Install dependencies
-        run: composer install --prefer-dist --no-interaction
-
-      - name: Run PHPStan
-        run: vendor/bin/phpstan analyse --memory-limit=2G
+      - run: composer install --prefer-dist --no-interaction
+      - run: cp .env.example .env
+      - run: php artisan key:generate
+      - run: composer pint-test
+      - run: composer phpstan

.github/workflows/consumer.yml

@@ -0,0 +1,24 @@
+name: Clean Package Consumer
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+permissions:
+  contents: read
+jobs:
+  install:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        source: [path, packagist]
+    name: Install from ${{ matrix.source }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, mbstring, zip, pdo_sqlite, bcmath, intl, gd, exif
+          coverage: none
+      - run: python3 tools/consumer-smoke.py --source ${{ matrix.source }}