@next-friday/create-app 2.1.4 → 2.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/rules/agent-owned-work.md

@@ -0,0 +1,3 @@
+# Agent-Owned Work
+
+Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.

package/templates/base/.agents/rules/constitution-changes.md

@@ -0,0 +1,5 @@
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/base/.agents/rules/dependency-security.md

@@ -1,5 +1,5 @@
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.agents/rules/descriptive-naming.md

@@ -0,0 +1,12 @@
+# Descriptive Naming
+
+A path or identifier names what it holds. A reader knows what a file, directory, module, or route contains without opening it.
+
+- **Name the responsibility.** Each file and directory name states the feature, domain concept, or role it holds.
+- **No organization names.** Do not put an organization, brand, customer, or tenant name in a path or identifier. User-visible text that names the organization reads it from one configured source, not from a literal.
+- **Distinguishable siblings.** Qualify a generic word such as `settings`, `config`, `utils`, `helpers`, `common`, or `detail` with its domain noun. Files that sit together each name the role they play.
+- **Do not copy a name that breaks this rule.** Sibling style does not override it. Give new code a descriptive name and report the existing name to the user.
+
+Folder names and file suffixes that the framework or toolchain requires follow that tool's convention.
+
+_Completion criterion_: Every path and identifier the diff adds names its responsibility, contains no organization name, and is distinguishable from its siblings.

package/templates/base/.agents/rules/evidence-before-claims.md

@@ -0,0 +1,3 @@
+# Evidence
+
+Verify a claim about files, commands, APIs, versions, or limits before you state or write it, and cite its source: `path:line`, command output, or an official documentation URL. Do not write a value without a source into code or docs; state it as unverified and give the reason.

package/templates/base/.agents/rules/platform-and-library-first.md

@@ -0,0 +1,9 @@
+# Platform and Library First
+
+Meet a need with the first option that covers it:
+
+1. A built-in feature of the framework or platform.
+2. A maintained library or an official template.
+3. Custom code. State in the pull request why the first two fall short.
+
+Add a library as `dependency-security.md` describes.

package/templates/base/.agents/rules/single-author-style.md

@@ -2,6 +2,6 @@
 
 Treat each application, package, or component as one author's work. Match representative siblings for layout, naming, exports, helpers, composition, errors, and abstraction. Use the language's standard idiom when no sibling exists. Name the convention when a conflict affects the design.
 
-Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`.
+Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`. Names follow `descriptive-naming.md`, which matching siblings does not override.
 
 Keep edits in the requested component, its call sites, and the workspace metadata it needs. Cross-project convention changes are in scope only when the task names them.

package/templates/base/.agents/rules/structured-logging.md

@@ -0,0 +1,3 @@
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/base/.claude/rules/agent-owned-work.md

@@ -0,0 +1 @@
+@../../.agents/rules/agent-owned-work.md

package/templates/base/.claude/rules/constitution-changes.md

@@ -0,0 +1 @@
+@../../.agents/rules/constitution-changes.md

package/templates/base/.claude/rules/dependency-security.md

@@ -7,6 +7,6 @@ paths:
 
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.claude/rules/descriptive-naming.md

@@ -0,0 +1 @@
+@../../.agents/rules/descriptive-naming.md

package/templates/base/.claude/rules/evidence-before-claims.md

@@ -0,0 +1 @@
+@../../.agents/rules/evidence-before-claims.md

package/templates/base/.claude/rules/platform-and-library-first.md

@@ -0,0 +1 @@
+@../../.agents/rules/platform-and-library-first.md

package/templates/base/.claude/rules/structured-logging.md

@@ -0,0 +1 @@
+@../../.agents/rules/structured-logging.md

package/templates/base/.cursor/BUGBOT.md

@@ -3,16 +3,22 @@
 Review pull requests against the project's agent guide and rules:
 
 - [Agent guide](../AGENTS.md)
+- [Agent-Owned Work](../.agents/rules/agent-owned-work.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)
 - [Required Comments](../.agents/rules/code-comments.md)
 - [Codebase Hygiene](../.agents/rules/codebase-hygiene.md)
+- [Constitution Changes](../.agents/rules/constitution-changes.md)
 - [Current State](../.agents/rules/current-state-authority.md)
 - [Demand-Driven Configuration](../.agents/rules/demand-driven-configuration.md)
 - [Dependencies](../.agents/rules/dependency-security.md)
+- [Descriptive Naming](../.agents/rules/descriptive-naming.md)
 - [Test Admission](../.agents/rules/deterministic-testing.md)
 - [Diagnostics](../.agents/rules/diagnostics-and-error-handling.md)
+- [Evidence](../.agents/rules/evidence-before-claims.md)
 - [Git Workflow](../.agents/rules/git-workflow.md)
 - [Findings](../.agents/rules/no-suppression.md)
+- [Platform and Library First](../.agents/rules/platform-and-library-first.md)
 - [Scripts](../.agents/rules/script-driven-changes.md)
 - [Sibling Style](../.agents/rules/single-author-style.md)
+- [Logging](../.agents/rules/structured-logging.md)
 - [TypeScript-First](../.agents/rules/typescript-first.md)

package/templates/base/.cursor/rules/agent-owned-work.mdc

@@ -0,0 +1,8 @@
+---
+description: "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+alwaysApply: true
+---
+
+# Agent-Owned Work
+
+Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.

package/templates/base/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,10 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+alwaysApply: true
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/base/.cursor/rules/dependency-security.mdc

@@ -6,6 +6,6 @@ alwaysApply: false
 
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.cursor/rules/descriptive-naming.mdc

@@ -0,0 +1,17 @@
+---
+description: "Descriptive naming: paths and identifiers name what they hold, without organization names"
+alwaysApply: true
+---
+
+# Descriptive Naming
+
+A path or identifier names what it holds. A reader knows what a file, directory, module, or route contains without opening it.
+
+- **Name the responsibility.** Each file and directory name states the feature, domain concept, or role it holds.
+- **No organization names.** Do not put an organization, brand, customer, or tenant name in a path or identifier. User-visible text that names the organization reads it from one configured source, not from a literal.
+- **Distinguishable siblings.** Qualify a generic word such as `settings`, `config`, `utils`, `helpers`, `common`, or `detail` with its domain noun. Files that sit together each name the role they play.
+- **Do not copy a name that breaks this rule.** Sibling style does not override it. Give new code a descriptive name and report the existing name to the user.
+
+Folder names and file suffixes that the framework or toolchain requires follow that tool's convention.
+
+_Completion criterion_: Every path and identifier the diff adds names its responsibility, contains no organization name, and is distinguishable from its siblings.

package/templates/base/.cursor/rules/evidence-before-claims.mdc

@@ -0,0 +1,8 @@
+---
+description: "Evidence: verify and cite a claim before stating or writing it"
+alwaysApply: true
+---
+
+# Evidence
+
+Verify a claim about files, commands, APIs, versions, or limits before you state or write it, and cite its source: `path:line`, command output, or an official documentation URL. Do not write a value without a source into code or docs; state it as unverified and give the reason.

package/templates/base/.cursor/rules/platform-and-library-first.mdc

@@ -0,0 +1,14 @@
+---
+description: "Platform and library first: use built-in features, then maintained libraries, then custom code"
+alwaysApply: true
+---
+
+# Platform and Library First
+
+Meet a need with the first option that covers it:
+
+1. A built-in feature of the framework or platform.
+2. A maintained library or an official template.
+3. Custom code. State in the pull request why the first two fall short.
+
+Add a library as `dependency-security.md` describes.

package/templates/base/.cursor/rules/single-author-style.mdc

@@ -7,6 +7,6 @@ alwaysApply: true
 
 Treat each application, package, or component as one author's work. Match representative siblings for layout, naming, exports, helpers, composition, errors, and abstraction. Use the language's standard idiom when no sibling exists. Name the convention when a conflict affects the design.
 
-Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`.
+Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`. Names follow `descriptive-naming.md`, which matching siblings does not override.
 
 Keep edits in the requested component, its call sites, and the workspace metadata it needs. Cross-project convention changes are in scope only when the task names them.

package/templates/base/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,8 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+alwaysApply: true
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nestjs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -18,6 +24,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts"]
@@ -25,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",
     "globs": ["**/*.ts", "**/*.js"]

package/templates/nestjs/AGENTS.md

@@ -3,6 +3,5 @@
 NestJS service on pnpm. Source lives in `src/`, end-to-end tests in `test/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put end-to-end tests in `test/` as `*.e2e.test.ts`.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.

package/templates/nextjs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -18,6 +24,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
@@ -25,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/nextjs/AGENTS.md

@@ -3,7 +3,6 @@
 Next.js App Router application on pnpm. Routes live in `app/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put Playwright end-to-end tests in `test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.
 

package/templates/nodejs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -18,6 +24,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts"]
@@ -25,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",
     "globs": ["**/*.ts", "**/*.js"]

package/templates/nodejs/AGENTS.md

@@ -3,6 +3,5 @@
 Node.js HTTP service on pnpm, without a framework. Source lives in `src/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put tests next to the code as `*.test.ts`.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.

package/templates/payload/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -18,6 +24,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
@@ -25,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/payload/AGENTS.md

@@ -3,7 +3,6 @@
 Payload CMS on Next.js App Router and PostgreSQL, on pnpm. Source lives in `src/`: the site in `src/app/(frontend)/`, collections in `src/collections/`, and the Payload config in `src/payload.config.ts`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put Playwright end-to-end tests in `test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - Payload generates `src/app/(payload)/`, `src/payload-types.ts`, and `src/migrations/`. After changing a collection, regenerate them with `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`, and commit the results.
 - Read configuration through `requireEnvironment` in `src/environment.ts`; document each variable in `.env.example`.

package/templates/turborepo/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -18,6 +24,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
@@ -25,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/turborepo/AGENTS.md

@@ -3,7 +3,6 @@
 Turborepo workspace on pnpm. `apps/app` is the Next.js site. `apps/backoffice` is the Payload CMS. Root scripts run the same checks as the other Next Friday templates and delegate framework commands with Turborepo.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`. Put Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - The Next.js site lives in `apps/app/app/`. The backoffice site lives in `apps/backoffice/src/app/(frontend)/`, collections in `apps/backoffice/src/collections/`, and the Payload config in `apps/backoffice/src/payload.config.ts`.
 - Payload generates `apps/backoffice/src/app/(payload)/`, `apps/backoffice/src/payload-types.ts`, and `apps/backoffice/src/migrations/`. After changing a collection, regenerate them with `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`, and commit the results.