@next-friday/create-app 3.0.0 → 4.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "3.0.0",
+  "version": "4.0.1",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/{.cursor/rules/git-workflow.mdc → .agents/skills/git-workflow/SKILL.md}

@@ -1,6 +1,6 @@
 ---
-description: "Git workflow: trunk-based branches, commits, and pull requests"
-alwaysApply: true
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
 ---
 
 # Git Workflow

package/templates/base/{.cursor/rules/script-driven-changes.mdc → .agents/skills/script-driven-changes/SKILL.md}

@@ -1,6 +1,6 @@
 ---
-description: "Scripts: apply a repeated edit across many files with a script"
-alwaysApply: true
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
 ---
 
 # Scripts

package/templates/base/{.agents/rules/git-workflow.md → .claude/skills/git-workflow/SKILL.md}

@@ -1,3 +1,8 @@
+---
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
+---
+
 # Git Workflow
 
 The repository uses trunk-based development.

package/templates/base/{.agents/rules/script-driven-changes.md → .claude/skills/script-driven-changes/SKILL.md}

@@ -1,3 +1,8 @@
+---
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
+---
+
 # Scripts
 
 When a change repeats one pattern across more than a few files, run a script. Derive facts from the toolchain (TypeScript compiler API, `git`), not by reading files by eye. Edit by hand when the change needs judgment in one place.

package/templates/base/.cursor/BUGBOT.md

@@ -16,10 +16,10 @@ Review pull requests against the project's agent guide and rules:
 - [Test Admission](../.agents/rules/deterministic-testing.md)
 - [Diagnostics](../.agents/rules/diagnostics-and-error-handling.md)
 - [Evidence](../.agents/rules/evidence-before-claims.md)
-- [Git Workflow](../.agents/rules/git-workflow.md)
+- [Git Workflow](../.agents/skills/git-workflow/SKILL.md)
 - [Findings](../.agents/rules/no-suppression.md)
 - [Platform and Library First](../.agents/rules/platform-and-library-first.md)
-- [Scripts](../.agents/rules/script-driven-changes.md)
+- [Scripts](../.agents/skills/script-driven-changes/SKILL.md)
 - [Sibling Style](../.agents/rules/single-author-style.md)
 - [Logging](../.agents/rules/structured-logging.md)
 - [TypeScript-First](../.agents/rules/typescript-first.md)

package/templates/base/.cursor/skills/git-workflow/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
+---
+
+# Git Workflow
+
+The repository uses trunk-based development.
+
+- Branch from the latest `origin/main`, in a worktree or a new branch named `<type>/<short-description>`. `main` is the only long-lived branch. The Git hooks block commits and pushes on it, except the first commit and push that create `main` in a new repository.
+- Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. The `commit-msg` hook rejects anything else.
+- When work ends in a pull request, push its branch and open the pull request ready for review without asking. CI skips drafts. Work that does not end in one, such as an investigation or a prototype, opens none.
+- Fill the pull request body from `.github/pull_request_template.md`.
+- After you open a pull request, report its URL and continue. Drive it to merge-ready only when the user asks, and watch the checks with `gh pr checks --watch`. Merge only when the user asks to merge, land, or ship. Merge with `--squash`, bottom-up for a stack.
+- Rebase and `git push --force-with-lease` only branches you own.

package/templates/base/.cursor/skills/script-driven-changes/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
+---
+
+# Scripts
+
+When a change repeats one pattern across more than a few files, run a script. Derive facts from the toolchain (TypeScript compiler API, `git`), not by reading files by eye. Edit by hand when the change needs judgment in one place.
+
+Commit a script when a reviewer needs to rerun it or when the work outlives the session, and add it as a `package.json` script so knip counts it as an entry. Keep any other one-off script in a temporary directory outside the repository, and remove a committed script when its workflow ends. Fail on unmapped input. Back up before a destructive run.
+
+Print summaries: counts, first errors. Verify what owned checks omit, such as the running app.

package/templates/nestjs/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      ".prettierrc.json",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.js"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.js"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",

package/templates/nestjs/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - ".prettierrc.json"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/nestjs/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.js"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/nestjs/.claude/rules/structured-logging.md

@@ -0,0 +1,9 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.js"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/{base → nestjs}/.cursor/rules/constitution-changes.mdc

@@ -1,6 +1,7 @@
 ---
 description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
-alwaysApply: true
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
 ---
 
 # Constitution Changes

package/templates/{base → nestjs}/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -1,6 +1,7 @@
 ---
 description: "Diagnostics: fix runtime failures at the source and keep the root cause"
-alwaysApply: true
+globs: "**/*.ts,**/*.js"
+alwaysApply: false
 ---
 
 # Diagnostics

package/templates/{base → nestjs}/.cursor/rules/structured-logging.mdc

@@ -1,6 +1,7 @@
 ---
 description: "Logging: log through a logging library in structured, durable records"
-alwaysApply: true
+globs: "**/*.ts,**/*.js"
+alwaysApply: false
 ---
 
 # Logging

package/templates/nestjs/Dockerfile

@@ -1,8 +1,10 @@
 # Runs on any OCI platform (Railway, Vercel Container Runtime, Fly.io, Cloud Run). The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS base
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 
 FROM base AS build
 RUN pnpm install --frozen-lockfile --ignore-scripts
@@ -13,12 +15,20 @@ RUN pnpm build
 FROM base AS prod-deps
 RUN pnpm install --frozen-lockfile --ignore-scripts --prod
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 COPY package.json ./
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist

package/templates/nextjs/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      "prettier.config.ts",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",

package/templates/nextjs/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - "prettier.config.ts"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/nextjs/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/nextjs/.claude/rules/structured-logging.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nextjs/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,prettier.config.ts,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/nextjs/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/nextjs/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nextjs/Dockerfile

@@ -1,20 +1,30 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts
 COPY next.config.ts postcss.config.mjs tsconfig.json ./
 COPY app ./app
 RUN pnpm build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/public ./public` when the app has a public/ folder, and allow it in .dockerignore.
 COPY --from=build --chown=node:node /app/.next/standalone ./
 COPY --from=build --chown=node:node /app/.next/static ./.next/static

package/templates/nodejs/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      ".prettierrc.json",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.js"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.js"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts",

package/templates/nodejs/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - ".prettierrc.json"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/nodejs/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.js"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/nodejs/.claude/rules/structured-logging.md

@@ -0,0 +1,9 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.js"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nodejs/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/nodejs/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.js"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/nodejs/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.js"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/nodejs/Dockerfile

@@ -1,8 +1,10 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS base
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 
 FROM base AS build
 RUN pnpm install --frozen-lockfile --ignore-scripts
@@ -13,12 +15,20 @@ RUN pnpm build
 FROM base AS prod-deps
 RUN pnpm install --frozen-lockfile --ignore-scripts --prod
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 COPY package.json ./
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist

package/templates/payload/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      ".prettierrc.json",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",

package/templates/payload/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - ".prettierrc.json"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/payload/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/payload/.claude/rules/structured-logging.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/payload/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/payload/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/payload/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/payload/Dockerfile

@@ -1,9 +1,11 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts
 COPY next.config.ts tsconfig.json ./
 COPY src ./src
@@ -11,12 +13,20 @@ COPY src ./src
 # the platform sets the real ones at runtime, and the build never connects to the database.
 RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3000 pnpm build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-* \
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-* \
   && install -d -o node -g node media
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/public ./public` when the app has a public/ folder, and allow it in .dockerignore. Uploads go to the container filesystem, which is lost on redeploy; use a storage adapter or a mounted volume in production.
 COPY --from=build --chown=node:node /app/.next/standalone ./

package/templates/turborepo/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      "prettier.config.ts",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",

package/templates/turborepo/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - "prettier.config.ts"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/turborepo/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/turborepo/.claude/rules/structured-logging.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/turborepo/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,prettier.config.ts,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/turborepo/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/turborepo/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/turborepo/apps/app/Dockerfile

@@ -1,22 +1,32 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY apps/app/package.json apps/app/package.json
 COPY apps/backoffice/package.json apps/backoffice/package.json
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/app...
 COPY apps/app/next.config.ts apps/app/postcss.config.mjs apps/app/tsconfig.json apps/app/
 COPY apps/app/app apps/app/app
 RUN pnpm --filter ./apps/app build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/apps/app/public ./apps/app/public` when the app has a public/ folder.
 COPY --from=build --chown=node:node /app/apps/app/.next/standalone ./
 COPY --from=build --chown=node:node /app/apps/app/.next/static ./apps/app/.next/static

package/templates/turborepo/apps/backoffice/Dockerfile

@@ -1,11 +1,13 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY apps/app/package.json apps/app/package.json
 COPY apps/backoffice/package.json apps/backoffice/package.json
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/backoffice...
 COPY apps/backoffice/next.config.ts apps/backoffice/tsconfig.json apps/backoffice/
 COPY apps/backoffice/src apps/backoffice/src
@@ -13,12 +15,20 @@ COPY apps/backoffice/src apps/backoffice/src
 # The platform sets the real ones at runtime, and the build never connects to the database.
 RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3001 pnpm --filter ./apps/backoffice build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-* \
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-* \
   && install -d -o node -g node apps/backoffice/media
 # Next.js writes .next/cache at runtime. Uploads go to the container filesystem, which is lost on redeploy; use a storage adapter or a mounted volume in production.
 COPY --from=build --chown=node:node /app/apps/backoffice/.next/standalone ./

package/templates/base/.claude/rules/constitution-changes.md

@@ -1 +0,0 @@
-@../../.agents/rules/constitution-changes.md

package/templates/base/.claude/rules/diagnostics-and-error-handling.md

@@ -1 +0,0 @@
-@../../.agents/rules/diagnostics-and-error-handling.md

package/templates/base/.claude/rules/git-workflow.md

@@ -1 +0,0 @@
-@../../.agents/rules/git-workflow.md

package/templates/base/.claude/rules/script-driven-changes.md

@@ -1 +0,0 @@
-@../../.agents/rules/script-driven-changes.md

package/templates/base/.claude/rules/structured-logging.md

@@ -1 +0,0 @@
-@../../.agents/rules/structured-logging.md