@baldurpan/create-ai-workflow 0.2.0

package/templates/standards/security/validation.md

@@ -0,0 +1,89 @@
+# Input Validation
+
+## Core Rule
+
+Validate all external input at system boundaries. Never trust data from users, external APIs, or environment variables.
+
+## System Boundaries
+
+External data that must always be validated:
+
+- HTTP request bodies, query params, path params, headers
+- Form submissions
+- URL search params parsed client-side
+- Environment variables
+- File uploads
+- Data from third-party APIs
+- `localStorage` / `sessionStorage` values
+- `postMessage` events
+
+Internal data (function calls within the same service, TypeScript types) does not need runtime validation — trust the type system.
+
+## Preferred Tool: Zod
+
+```ts
+// API route — validate request body
+import { z } from "zod";
+
+const createInvoiceBody = z.object({
+  title: z.string().min(1).max(200),
+  amount: z.number().positive(),
+  dueDate: z.coerce.date().min(new Date()),
+  recipientEmail: z.string().email(),
+});
+
+app.post("/api/invoices", async (req, res) => {
+  const result = createInvoiceBody.safeParse(req.body);
+  if (!result.success) {
+    return res.status(422).json({ errors: result.error.flatten() });
+  }
+  const invoice = await createInvoice(result.data);
+  return res.status(201).json(invoice);
+});
+```
+
+## Path and Query Params
+
+```ts
+const getInvoiceParams = z.object({
+  id: z.string().cuid(),
+});
+
+const getInvoicesQuery = z.object({
+  status: z.enum(["all", "open", "paid"]).default("all"),
+  page: z.coerce.number().int().positive().default(1),
+  limit: z.coerce.number().int().positive().max(100).default(20),
+});
+```
+
+## File Uploads
+
+```ts
+const uploadSchema = z.object({
+  file: z
+    .instanceof(File)
+    .refine((f) => f.size <= 5 * 1024 * 1024, "Max file size is 5MB")
+    .refine(
+      (f) => ["image/jpeg", "image/png", "application/pdf"].includes(f.type),
+      "Only JPEG, PNG, and PDF files are allowed",
+    ),
+});
+```
+
+## DO NOT
+
+- Pass `req.body` directly to a database query or ORM
+- Use `any` for data received from external sources
+- Trust `Content-Type` headers alone to determine what data was sent
+- Rely on client-side validation as the only validation
+
+## PRIORITY
+
+```
+Validate all external input > Trust internal TypeScript types
+```
+
+## See Also
+
+- [typescript/validation.md](../typescript/validation.md) — Zod patterns
+- [api-security.md](api-security.md) — additional API-level protections

package/templates/standards/templates/.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+max_line_length = 100
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

package/templates/standards/templates/.nvmrc

@@ -0,0 +1 @@
+22

package/templates/standards/templates/AGENTS.md

@@ -0,0 +1,46 @@
+# AGENTS.md
+
+This project follows the [AI Engineering Standards](https://github.com/baldurpan/ai-engineering-standards).
+
+Load that repo's [`README.md`](https://github.com/baldurpan/ai-engineering-standards/blob/main/README.md) and follow its conditional-loading guidance based on the task at hand.
+
+---
+
+## Project
+
+<!-- One sentence: what this project is and who it is for. -->
+
+## Stack
+
+<!-- Adjust to match this project. -->
+
+- Language: TypeScript (strict)
+- Framework: <!-- Next.js / Remix / Vite -->
+- Styling: Tailwind CSS + shadcn/ui
+- Data fetching: TanStack Query
+- Forms: TanStack Form / React Hook Form + Zod
+- Testing: Vitest + Testing Library + Playwright
+
+## Commands
+
+```bash
+pnpm dev          # start dev server
+pnpm build        # production build
+pnpm test         # unit + integration tests
+pnpm test:e2e     # Playwright E2E tests
+pnpm typecheck    # TypeScript type check
+pnpm lint         # Biome lint
+pnpm format       # Biome format
+```
+
+## Key Directories
+
+| Path | Purpose |
+|---|---|
+| `src/features/` | Feature-driven modules — colocate components, hooks, schemas, tests |
+| `src/shared/` | Reusable code used across 3+ features |
+| `src/lib/` | Third-party adapters (db, auth, email) |
+
+## Project-Specific Rules
+
+<!-- Optional: any additions or overrides to the standards. Keep these focused on this project. -->

package/templates/standards/templates/CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+Read [AGENTS.md](AGENTS.md) — it is the authoritative configuration for this project.

package/templates/standards/templates/_dot_gitignore

@@ -0,0 +1,50 @@
+# Dependencies
+node_modules
+.pnpm-store
+.yarn
+
+# Build output
+dist
+build
+out
+.next
+.turbo
+.nx/cache
+.vercel
+
+# TypeScript
+*.tsbuildinfo
+
+# Testing
+coverage
+.vitest
+playwright-report
+test-results
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Environment
+.env
+.env.local
+.env.*.local
+!.env.example
+
+# Editor / OS
+.DS_Store
+.idea
+.vscode/*
+!.vscode/extensions.json
+!.vscode/settings.json
+*.swp
+*.swo
+Thumbs.db
+
+# Secrets / credentials
+*.pem
+*.key
+secrets.json

package/templates/standards/templates/biome.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
+  "organizeImports": {
+    "enabled": true
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100,
+    "lineEnding": "lf"
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "trailingCommas": "all",
+      "semicolons": "always",
+      "arrowParentheses": "always"
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "a11y": {
+        "recommended": true,
+        "noAriaHiddenOnFocusable": "error",
+        "noAutofocus": "warn",
+        "useAltText": "error",
+        "useButtonType": "error",
+        "useSemanticElements": "warn"
+      },
+      "correctness": {
+        "noUnusedImports": "error",
+        "noUnusedVariables": "error",
+        "useExhaustiveDependencies": "warn"
+      },
+      "style": {
+        "noNonNullAssertion": "warn",
+        "useConst": "error",
+        "useTemplate": "error",
+        "useConsistentArrayType": { "level": "error", "options": { "syntax": "shorthand" } }
+      },
+      "suspicious": {
+        "noExplicitAny": "error",
+        "noConsoleLog": "warn"
+      }
+    }
+  },
+  "files": {
+    "ignore": ["node_modules", "dist", "build", ".next", "coverage"]
+  }
+}

package/templates/standards/templates/eslint.config.js

@@ -0,0 +1,61 @@
+// @ts-check
+// Fallback for projects not using Biome. Biome is the recommended single tool (see tooling/biome.md).
+import tseslint from "@typescript-eslint/eslint-plugin";
+import tsParser from "@typescript-eslint/parser";
+import jsxA11y from "eslint-plugin-jsx-a11y";
+import reactHooks from "eslint-plugin-react-hooks";
+
+/** @type {import("eslint").Linter.Config[]} */
+const config = [
+  {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: tsParser,
+      parserOptions: {
+        projectService: true,
+      },
+    },
+    plugins: {
+      "@typescript-eslint": tseslint,
+      "react-hooks": reactHooks,
+      "jsx-a11y": jsxA11y,
+    },
+    rules: {
+      // TypeScript
+      ...tseslint.configs["recommended-type-checked"].rules,
+      "@typescript-eslint/no-explicit-any": "error",
+      "@typescript-eslint/no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
+      "@typescript-eslint/consistent-type-imports": ["error", { prefer: "type-imports" }],
+      "@typescript-eslint/consistent-type-definitions": ["error", "interface"],
+      "@typescript-eslint/no-non-null-assertion": "warn",
+      "@typescript-eslint/prefer-nullish-coalescing": "error",
+      "@typescript-eslint/prefer-optional-chain": "error",
+
+      // Function style — prefer function declarations for named, module-level functions.
+      // Anonymous arrow callbacks (e.g. arr.map((x) => x)) are unaffected by this rule.
+      "func-style": ["error", "declaration"],
+
+      // React Hooks
+      ...reactHooks.configs.recommended.rules,
+
+      // Accessibility
+      ...jsxA11y.configs.recommended.rules,
+
+      // General
+      "no-console": ["warn", { allow: ["warn", "error"] }],
+      "prefer-const": "error",
+      "no-var": "error",
+    },
+  },
+  {
+    files: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+    rules: {
+      "@typescript-eslint/no-explicit-any": "off",
+    },
+  },
+  {
+    ignores: ["node_modules", "dist", "build", ".next", "coverage"],
+  },
+];
+
+export default config;

package/templates/standards/templates/project-readme.md

@@ -0,0 +1,76 @@
+# [Project Name]
+
+<!-- One sentence describing what this project is and who it is for -->
+
+## Getting Started
+
+### Prerequisites
+
+- Node.js v22+
+- pnpm v9+
+
+### Install and Run
+
+```bash
+pnpm install
+cp .env.example .env.local
+# Fill in required values in .env.local
+pnpm dev
+```
+
+App runs at [http://localhost:3000](http://localhost:3000).
+
+## Development Commands
+
+```bash
+pnpm dev          # start development server
+pnpm build        # production build
+pnpm preview      # preview production build locally
+pnpm test         # run unit and integration tests
+pnpm test:e2e     # run Playwright end-to-end tests
+pnpm typecheck    # TypeScript type checking
+pnpm lint         # Biome linting
+pnpm format       # Biome formatting
+```
+
+## Project Structure
+
+```
+src/
+  features/       # feature modules (colocated components, hooks, schemas, tests)
+  shared/         # reusable components, hooks, utils (used by 3+ features)
+  lib/            # third-party adapters (db, auth, email)
+  app/            # routing, layout, providers
+```
+
+See [CLAUDE.md](CLAUDE.md) for AI agent configuration and engineering standards.
+
+## Tech Stack
+
+| Area | Tool |
+|---|---|
+| Framework | <!-- Next.js / Remix / Vite --> |
+| Language | TypeScript (strict) |
+| Styling | Tailwind CSS + shadcn/ui |
+| Data fetching | TanStack Query |
+| Forms | TanStack Form / React Hook Form |
+| Validation | Zod |
+| Testing | Vitest + Testing Library + Playwright |
+| Linting | Biome |
+| ORM | <!-- Prisma / Drizzle --> |
+
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `DATABASE_URL` | Yes | PostgreSQL connection string |
+| `VITE_API_BASE_URL` | Yes | Public API base URL |
+
+See `.env.example` for all required variables.
+
+## Contributing
+
+1. Branch from `main`
+2. Open a draft PR early for visibility
+3. Ensure `pnpm typecheck`, `pnpm lint`, and `pnpm test` pass
+4. Request review when ready

package/templates/standards/templates/pull-request-template.md

@@ -0,0 +1,46 @@
+## Summary
+
+<!-- What does this PR do? Why? (2–3 bullet points) -->
+
+-
+-
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Refactor (no behavior change)
+- [ ] Documentation
+- [ ] Dependency update
+- [ ] Infrastructure / tooling
+
+## Test Plan
+
+<!-- How did you verify this works? What edge cases did you test? -->
+
+- [ ] Tested locally
+- [ ] Unit / integration tests added or updated
+- [ ] E2E tests added or updated (if critical flow)
+- [ ] Tested on mobile / small screen (if UI change)
+- [ ] Tested keyboard navigation (if interactive UI)
+- [ ] Tested with a screen reader (if significant UI change)
+
+## Checklist
+
+- [ ] `pnpm typecheck` passes
+- [ ] `pnpm lint` passes
+- [ ] `pnpm test` passes
+- [ ] No new `any` types
+- [ ] No new `useEffect` for derived state or data fetching
+- [ ] Accessible markup (semantic HTML, labels, keyboard navigable)
+- [ ] No secrets or sensitive data committed
+- [ ] `.env.example` updated (if new env var added)
+- [ ] Documentation updated (if behavior changed)
+
+## Screenshots
+
+<!-- Add screenshots or recordings for UI changes -->
+
+## Notes for Reviewer
+
+<!-- Anything the reviewer should know — decisions made, things to pay attention to, known limitations -->

package/templates/standards/templates/tsconfig.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "compilerOptions": {
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noUncheckedIndexedAccess": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "noFallthroughCasesInSwitch": true,
+    "allowUnreachableCode": false,
+    "allowUnusedLabels": false,
+    "noUncheckedSideEffectImports": true,
+    "erasableSyntaxOnly": true,
+    "exactOptionalPropertyTypes": true,
+    "forceConsistentCasingInFileNames": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "moduleDetection": "force",
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "jsx": "react-jsx",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "baseUrl": ".",
+    "paths": {
+      "~/*": ["./src/*"]
+    }
+  },
+  "include": ["src/**/*", "vite.config.ts"],
+  "exclude": ["node_modules", "dist", "build", "coverage"]
+}

package/templates/standards/tooling/biome.md

@@ -0,0 +1,92 @@
+# Biome
+
+## Purpose
+
+Biome replaces both ESLint and Prettier with a single fast tool. It handles formatting, linting, and import organization.
+
+## Why Biome
+
+- 10–100× faster than ESLint + Prettier
+- Single config, single tool, single install
+- Zero-conflict formatting (no Prettier vs. ESLint format fights)
+- Built-in import organizer
+
+## Setup
+
+```bash
+pnpm add --save-dev --save-exact @biomejs/biome
+pnpm biome init
+```
+
+Or copy [`templates/biome.json`](../templates/biome.json) into your project as a starting point.
+
+## Key Commands
+
+```bash
+# Check (lint + format check, no writes)
+pnpm biome check .
+
+# Format files
+pnpm biome format --write .
+
+# Lint files
+pnpm biome lint .
+
+# Fix lint + format in one pass
+pnpm biome check --write .
+
+# CI — no writes, exit non-zero on error
+pnpm biome ci .
+```
+
+## CI Integration
+
+```yaml
+# .github/workflows/ci.yml
+- name: Biome check
+  run: pnpm biome ci .
+```
+
+`biome ci` is equivalent to `biome check` but never writes files and always exits non-zero on any finding.
+
+## Editor Integration
+
+Install the Biome VS Code extension: `biomejs.biome`
+
+Enable format on save:
+
+```json
+// .vscode/settings.json
+{
+  "[typescript]": { "editor.defaultFormatter": "biomejs.biome" },
+  "[typescriptreact]": { "editor.defaultFormatter": "biomejs.biome" },
+  "[javascript]": { "editor.defaultFormatter": "biomejs.biome" },
+  "[json]": { "editor.defaultFormatter": "biomejs.biome" },
+  "editor.formatOnSave": true
+}
+```
+
+## Config Reference
+
+See [`templates/biome.json`](../templates/biome.json) for the canonical Biome config.
+
+## Migrating from ESLint + Prettier
+
+```bash
+pnpm biome migrate eslint --include-inspired
+pnpm biome migrate prettier
+```
+
+Biome can automatically migrate most ESLint and Prettier configs.
+
+## DO NOT
+
+- Run both Biome and Prettier on the same files — they will conflict
+- Disable rules with `// biome-ignore` without a specific comment explaining why
+- Skip `biome ci` in CI pipelines
+
+## See Also
+
+- [`ci.md`](ci.md) — `biome ci` as the gating command
+- [`dependencies.md`](dependencies.md) — replacing ESLint + Prettier
+- [`vite.md`](vite.md) — editor integration