@next-friday/create-app 2.1.5 → 2.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/rules/agent-owned-work.md

@@ -0,0 +1,3 @@
+# Agent-Owned Work
+
+Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.

package/templates/base/.agents/rules/constitution-changes.md

@@ -0,0 +1,5 @@
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/base/.agents/rules/dependency-security.md

@@ -1,5 +1,5 @@
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.agents/rules/evidence-before-claims.md

@@ -0,0 +1,3 @@
+# Evidence
+
+Verify a claim about files, commands, APIs, versions, or limits before you state or write it, and cite its source: `path:line`, command output, or an official documentation URL. Do not write a value without a source into code or docs; state it as unverified and give the reason.

package/templates/base/.agents/rules/platform-and-library-first.md

@@ -0,0 +1,9 @@
+# Platform and Library First
+
+Meet a need with the first option that covers it:
+
+1. A built-in feature of the framework or platform.
+2. A maintained library or an official template.
+3. Custom code. State in the pull request why the first two fall short.
+
+Add a library as `dependency-security.md` describes.

package/templates/base/.agents/rules/structured-logging.md

@@ -0,0 +1,3 @@
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/base/.claude/rules/agent-owned-work.md

@@ -0,0 +1 @@
+@../../.agents/rules/agent-owned-work.md

package/templates/base/.claude/rules/constitution-changes.md

@@ -0,0 +1 @@
+@../../.agents/rules/constitution-changes.md

package/templates/base/.claude/rules/dependency-security.md

@@ -7,6 +7,6 @@ paths:
 
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.claude/rules/evidence-before-claims.md

@@ -0,0 +1 @@
+@../../.agents/rules/evidence-before-claims.md

package/templates/base/.claude/rules/platform-and-library-first.md

@@ -0,0 +1 @@
+@../../.agents/rules/platform-and-library-first.md

package/templates/base/.claude/rules/structured-logging.md

@@ -0,0 +1 @@
+@../../.agents/rules/structured-logging.md

package/templates/base/.cursor/BUGBOT.md

@@ -3,17 +3,22 @@
 Review pull requests against the project's agent guide and rules:
 
 - [Agent guide](../AGENTS.md)
+- [Agent-Owned Work](../.agents/rules/agent-owned-work.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)
 - [Required Comments](../.agents/rules/code-comments.md)
 - [Codebase Hygiene](../.agents/rules/codebase-hygiene.md)
+- [Constitution Changes](../.agents/rules/constitution-changes.md)
 - [Current State](../.agents/rules/current-state-authority.md)
 - [Demand-Driven Configuration](../.agents/rules/demand-driven-configuration.md)
 - [Dependencies](../.agents/rules/dependency-security.md)
 - [Descriptive Naming](../.agents/rules/descriptive-naming.md)
 - [Test Admission](../.agents/rules/deterministic-testing.md)
 - [Diagnostics](../.agents/rules/diagnostics-and-error-handling.md)
+- [Evidence](../.agents/rules/evidence-before-claims.md)
 - [Git Workflow](../.agents/rules/git-workflow.md)
 - [Findings](../.agents/rules/no-suppression.md)
+- [Platform and Library First](../.agents/rules/platform-and-library-first.md)
 - [Scripts](../.agents/rules/script-driven-changes.md)
 - [Sibling Style](../.agents/rules/single-author-style.md)
+- [Logging](../.agents/rules/structured-logging.md)
 - [TypeScript-First](../.agents/rules/typescript-first.md)

package/templates/base/.cursor/rules/agent-owned-work.mdc

@@ -0,0 +1,8 @@
+---
+description: "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+alwaysApply: true
+---
+
+# Agent-Owned Work
+
+Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.

package/templates/base/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,10 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+alwaysApply: true
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/base/.cursor/rules/dependency-security.mdc

@@ -6,6 +6,6 @@ alwaysApply: false
 
 # Dependencies
 
-Add a dependency when active code, tests, build tooling, or a documented contract uses it, and native or existing project capabilities do not. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
+Add a dependency when active code, tests, build tooling, or a documented contract uses it, and neither the platform nor existing project code covers the need. A maintained library that replaces custom code meets this test; `platform-and-library-first.md` sets the order. Assess cadence, license, advisories, compatibility, and transitives first. Place it in the manifest of the project that imports it, in the ecosystem category that matches its role.
 
 Resolve a vulnerability that Dependabot or OSV-Scanner reports by upgrading the dependency. For a transitive dependency, add a pnpm override in `pnpm-workspace.yaml`. When no fix exists, record the accepted risk as `no-suppression.md` describes.

package/templates/base/.cursor/rules/evidence-before-claims.mdc

@@ -0,0 +1,8 @@
+---
+description: "Evidence: verify and cite a claim before stating or writing it"
+alwaysApply: true
+---
+
+# Evidence
+
+Verify a claim about files, commands, APIs, versions, or limits before you state or write it, and cite its source: `path:line`, command output, or an official documentation URL. Do not write a value without a source into code or docs; state it as unverified and give the reason.

package/templates/base/.cursor/rules/platform-and-library-first.mdc

@@ -0,0 +1,14 @@
+---
+description: "Platform and library first: use built-in features, then maintained libraries, then custom code"
+alwaysApply: true
+---
+
+# Platform and Library First
+
+Meet a need with the first option that covers it:
+
+1. A built-in feature of the framework or platform.
+2. A maintained library or an official template.
+3. Custom code. State in the pull request why the first two fall short.
+
+Add a library as `dependency-security.md` describes.

package/templates/base/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,8 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+alwaysApply: true
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nestjs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -28,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",
     "globs": ["**/*.ts", "**/*.js"]

package/templates/nestjs/AGENTS.md

@@ -3,6 +3,5 @@
 NestJS service on pnpm. Source lives in `src/`, end-to-end tests in `test/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put end-to-end tests in `test/` as `*.e2e.test.ts`.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.

package/templates/nextjs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -28,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/nextjs/AGENTS.md

@@ -3,7 +3,6 @@
 Next.js App Router application on pnpm. Routes live in `app/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put Playwright end-to-end tests in `test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.
 

package/templates/nodejs/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -28,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",
     "globs": ["**/*.ts", "**/*.js"]

package/templates/nodejs/AGENTS.md

@@ -3,6 +3,5 @@
 Node.js HTTP service on pnpm, without a framework. Source lives in `src/`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put tests next to the code as `*.test.ts`.
 - Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.

package/templates/payload/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -28,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/payload/AGENTS.md

@@ -3,7 +3,6 @@
 Payload CMS on Next.js App Router and PostgreSQL, on pnpm. Source lives in `src/`: the site in `src/app/(frontend)/`, collections in `src/collections/`, and the Payload config in `src/payload.config.ts`.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`; put Playwright end-to-end tests in `test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - Payload generates `src/app/(payload)/`, `src/payload-types.ts`, and `src/migrations/`. After changing a collection, regenerate them with `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`, and commit the results.
 - Read configuration through `requireEnvironment` in `src/environment.ts`; document each variable in `.env.example`.

package/templates/turborepo/.agents/rules.json

@@ -1,4 +1,7 @@
 {
+  "agent-owned-work": {
+    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+  },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
   },
@@ -8,6 +11,9 @@
   "codebase-hygiene": {
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
+  "constitution-changes": {
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -28,18 +34,27 @@
   "diagnostics-and-error-handling": {
     "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
   },
+  "evidence-before-claims": {
+    "description": "Evidence: verify and cite a claim before stating or writing it"
+  },
   "git-workflow": {
     "description": "Git workflow: trunk-based branches, commits, and pull requests"
   },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
+  "platform-and-library-first": {
+    "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
+  },
   "script-driven-changes": {
     "description": "Scripts: apply a repeated edit across many files with a script"
   },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
+  "structured-logging": {
+    "description": "Logging: log through a logging library in structured, durable records"
+  },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
     "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]

package/templates/turborepo/AGENTS.md

@@ -3,7 +3,6 @@
 Turborepo workspace on pnpm. `apps/app` is the Next.js site. `apps/backoffice` is the Payload CMS. Root scripts run the same checks as the other Next Friday templates and delegate framework commands with Turborepo.
 
 - Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
-- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
 - Put unit tests next to the code as `*.test.ts`. Put Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
 - The Next.js site lives in `apps/app/app/`. The backoffice site lives in `apps/backoffice/src/app/(frontend)/`, collections in `apps/backoffice/src/collections/`, and the Payload config in `apps/backoffice/src/payload.config.ts`.
 - Payload generates `apps/backoffice/src/app/(payload)/`, `apps/backoffice/src/payload-types.ts`, and `apps/backoffice/src/migrations/`. After changing a collection, regenerate them with `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`, and commit the results.