@next-friday/create-app 9.2.0 → 9.3.0

package/templates/nodejs/CONTRIBUTING.md

@@ -37,7 +37,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts`, which starts the server and handles the shutdown signals. Keep other logic out of it, as `src/port.ts` and `src/server.ts` do.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nodejs/package.json

@@ -16,7 +16,6 @@
     "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src eslint.config.ts vitest.config.ts",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
@@ -48,8 +47,8 @@
     "@next-friday/prettier-config-friday": "4.0.0",
     "@swc/core": "1.16.22",
     "@types/node": "26.6.6",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
     "fast-check": "4.10.2",
@@ -60,7 +59,7 @@
     "prettier": "3.9.10",
     "sort-package-json": "4.1.0",
     "typescript": "7.0.2",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",

package/templates/payload/.agents/review.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/payload/AGENTS.md

@@ -14,7 +14,7 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 | Create a migration                 | `pnpm migrate:create <name>`                               | `INFO: Migration created at` the new file under `migrations/`, then `INFO: Done.`                                            |
 | What `pre-push` runs               | `pnpm check`                                               | exits 0; the last output is the route table of `next build` with `ƒ /health`                                                 |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                              | exits 0; the last output is the route table of `next build` with `ƒ /health`                                                 |
-| Render rules after a change        | `pnpm rules:sync`                                          | `Synced 69 agent rule files; 0 updated.`                                                                                     |
+| Render rules after a change        | `pnpm rules:sync`                                          | `Synced 37 agent rule files; 0 updated.`                                                                                     |
 
 ## Verifying your work
 
@@ -24,6 +24,8 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/payload.config.ts` wires the collections in `src/collections/` to PostgreSQL. The site lives in `src/app/(frontend)/`, and `src/app/health/route.ts` serves `/health`. `next.config.ts` builds `output: "standalone"` and leaves Cache Components off.
@@ -35,11 +37,11 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 2. **Put unit tests next to the code as `src/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
 3. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 4. **Read configuration through `requireEnvironment` in `src/environment.ts`.** Document each variable in `.env.example`.
-5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 6. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
-9. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+9. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 10. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.
 
 ## Things Claude gets wrong

package/templates/payload/CONTRIBUTING.md

@@ -39,7 +39,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts the development server unless one is already running, and needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `src/`, except layouts, the Payload config, and generated files.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/payload/REVIEW.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/payload/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts next.config.ts playwright.config.ts vitest.config.ts",
     "dev": "next dev",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
@@ -47,11 +46,11 @@
     "verify:static": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
-    "@payloadcms/db-postgres": "3.92.1",
-    "@payloadcms/next": "3.92.1",
-    "@payloadcms/richtext-lexical": "3.92.1",
-    "next": "16.4.3",
-    "payload": "3.92.1",
+    "@payloadcms/db-postgres": "3.93.0",
+    "@payloadcms/next": "3.93.0",
+    "@payloadcms/richtext-lexical": "3.93.0",
+    "next": "16.4.5",
+    "payload": "3.93.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "sharp": "0.35.5"
@@ -61,14 +60,14 @@
     "@next-friday/commitlint-config-friday": "4.0.0",
     "@next-friday/eslint-config-friday": "5.1.0",
     "@next-friday/prettier-config-friday": "4.0.0",
-    "@next/eslint-plugin-next": "16.4.3",
+    "@next/eslint-plugin-next": "16.4.5",
     "@playwright/test": "1.64.1",
     "@swc/core": "1.16.22",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
     "fast-check": "4.10.2",
@@ -79,7 +78,7 @@
     "prettier": "3.9.10",
     "sort-package-json": "4.1.0",
     "typescript": "7.0.2",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",

package/templates/turborepo/.agents/review.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/turborepo/AGENTS.md

@@ -15,7 +15,7 @@ Turborepo workspace in TypeScript on pnpm and Node.js `>=24.22.1 <25`. `apps/app
 | Create a migration                 | `pnpm migrate:create <name>`                                                               | `INFO: Migration created at` the new file under `migrations/`, then `INFO: Done.`                                            |
 | What `pre-push` runs               | `pnpm check`                                                                               | exits 0; the output ends with the summary `Tasks:    2 successful, 2 total`                                                  |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                                                              | exits 0; the output ends with the summary `Tasks:    2 successful, 2 total`                                                  |
-| Render rules after a change        | `pnpm rules:sync`                                                                          | `Synced 69 agent rule files; 0 updated.`                                                                                     |
+| Render rules after a change        | `pnpm rules:sync`                                                                          | `Synced 37 agent rule files; 0 updated.`                                                                                     |
 
 ## Verifying your work
 
@@ -25,6 +25,8 @@ Turborepo workspace in TypeScript on pnpm and Node.js `>=24.22.1 <25`. `apps/app
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - Root scripts run lint, format, Knip, and the agent checks once for the workspace, and hand `build`, `test`, `typecheck`, and `depcruise` to Turborepo for each app. `TURBO_FILTER` narrows them; the default is every app.
@@ -37,11 +39,11 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 2. **Put unit tests next to the code and Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`.** Vitest collects `apps/app/app/**/*.test.{ts,tsx}` and `apps/backoffice/src/**/*.test.{ts,tsx}`.
 3. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 4. **Read backoffice configuration through `requireEnvironment` in `apps/backoffice/src/environment.ts`.** Document each variable in `.env.example`.
-5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 6. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
-9. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+9. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 10. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.
 
 ## Things Claude gets wrong

package/templates/turborepo/CONTRIBUTING.md

@@ -40,7 +40,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It builds both apps first, then starts both development servers unless they are already running. The build and the backoffice need `DATABASE_URL`, `PAYLOAD_SECRET`, and `APP_URL` from `.env`. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `apps/app/app/` and `apps/backoffice/src/`, except layouts, the Payload config, and generated files.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/turborepo/REVIEW.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/turborepo/apps/app/package.json

@@ -18,22 +18,22 @@
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "next": "16.4.3",
+    "next": "16.4.5",
     "react": "19.3.1",
     "react-dom": "19.3.1"
   },
   "devDependencies": {
     "@playwright/test": "1.64.1",
     "@swc/core": "1.16.22",
-    "@tailwindcss/postcss": "4.3.3",
+    "@tailwindcss/postcss": "4.3.4",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
-    "tailwindcss": "4.3.3",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
+    "tailwindcss": "4.3.4",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.1.0"
   },
   "engines": {
     "node": ">=24.22.1 <25"

package/templates/turborepo/apps/backoffice/package.json

@@ -23,11 +23,11 @@
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@payloadcms/db-postgres": "3.92.1",
-    "@payloadcms/next": "3.92.1",
-    "@payloadcms/richtext-lexical": "3.92.1",
-    "next": "16.4.3",
-    "payload": "3.92.1",
+    "@payloadcms/db-postgres": "3.93.0",
+    "@payloadcms/next": "3.93.0",
+    "@payloadcms/richtext-lexical": "3.93.0",
+    "next": "16.4.5",
+    "payload": "3.93.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "sharp": "0.35.5"
@@ -38,11 +38,11 @@
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "fast-check": "4.10.2",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.1.0"
   },
   "engines": {
     "node": ">=24.22.1 <25"

package/templates/turborepo/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf apps/app/.next apps/app/coverage apps/backoffice/.next apps/backoffice/coverage .turbo coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "turbo run depcruise $TURBO_FILTER",
     "dev": "turbo run dev --filter=./apps/*",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
@@ -50,7 +49,7 @@
     "@next-friday/commitlint-config-friday": "4.0.0",
     "@next-friday/eslint-config-friday": "5.1.0",
     "@next-friday/prettier-config-friday": "4.0.0",
-    "@next/eslint-plugin-next": "16.4.3",
+    "@next/eslint-plugin-next": "16.4.5",
     "@types/node": "26.6.6",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",

package/templates/base/.agents/agents.json

@@ -1,7 +0,0 @@
-{
-  "verifier": {
-    "description": "Runs the app and checks the change works before the session reports done",
-    "readonly": true,
-    "tools": ["Bash", "Read"]
-  }
-}

package/templates/base/.agents/skill-evals/README.md

@@ -1,42 +0,0 @@
-# Skill evals
-
-Each case under `<skill>/<case>/` is a prompt plus checks that decide whether the agent did the work. `pnpm evals:run` runs every case with Claude Code and the developer's own Claude login; `pnpm evals:run <case> ...` runs the named cases. It copies the project (without `.git` and `node_modules`) to a temporary directory, makes one commit, applies the case's fixture, runs `claude -p` with the prompt, evaluates the checks, prints one line per case, and exits non-zero when any case that ran failed. `AGENT_EVALS_MODEL` sets the model; the default is `claude-haiku-5-5`.
-
-## Files of a case
-
-- `prompt.md`: the prompt, after its front matter.
-- `case.yaml`: `expected_outcome`, `timeout_seconds`, an optional `fixture`, and `checks`.
-- `fixture.md`: the state the case needs, in prose. A case with this file and no `fixture` in `case.yaml` is reported as `skipped: fixture not machine-applicable`.
-- `graders/*.md`: criteria that a model judges. The script does not read them.
-
-## Fixture steps
-
-Steps run in order in the copy. Each is one key:
-
-| Step                     | Effect                                                                                                     |
-| :----------------------- | :--------------------------------------------------------------------------------------------------------- |
-| `write: {path, content}` | Writes the file.                                                                                           |
-| `commit: <message>`      | Commits every change.                                                                                      |
-| `branch: <name>`         | Creates the branch from the current one and checks it out.                                                 |
-| `checkout: <name>`       | Checks out the branch.                                                                                     |
-| `bare_remote: <name>`    | Creates a bare repository next to the copy, adds it as the remote `<name>`, and pushes every branch to it. |
-
-The default branch is `main`.
-
-## Checks
-
-Each entry of `checks` is a kind, or a kind with its argument. Regular expressions use the `m` and `u` flags.
-
-| Check                         | Passes when                                                                     |
-| :---------------------------- | :------------------------------------------------------------------------------ |
-| `no_file_changes`             | The working tree is as the fixture left it.                                     |
-| `no_new_commits`              | No ref holds a commit that the fixture did not create.                          |
-| `no_new_branch`               | No local branch exists that the fixture did not create.                         |
-| `reply_matches: <regex>`      | The reply matches.                                                              |
-| `reply_lacks: <regex>`        | The reply does not match.                                                       |
-| `file_exists: <path>`         | The file exists. A glob matches only files the run created or changed.          |
-| `file_matches: {path, regex}` | A file at `path` matches. A glob matches only files the run created or changed. |
-| `commit_touches_only: <glob>` | Every file of the first commit the run made matches the glob.                   |
-| `branch_matches: <regex>`     | The checked-out branch matches.                                                 |
-
-A check decides only what a script can decide. What needs judgment stays in `graders/`.

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/case.yaml

@@ -1,12 +0,0 @@
-schema_version: "1.1"
-name: answers-question-without-writing
-expected_outcome: |
-  The agent answers why `pnpm verify` runs knip and cites the files it read. It writes no file and makes no commit.
-timeout_seconds: 600
-checks:
-  - reply_matches: "knip"
-  - reply_matches: '[\w./-]+\.(?:json|md|ts|ya?ml)'
-  - no_file_changes
-  - no_new_commits
-  - reply_matches: '[\u0E00-\u0E7F]{10}'
-  - reply_lacks: '(?:^|[\s`("''])/(?:home|tmp|root|Users|var|private)/'

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/01-the-reply-explains-why-pnpm.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The reply explains why `pnpm verify` runs knip and cites at least one file path or command output as its source

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/02-no-file-in-the-project.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-No file in the project is created or changed

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/03-no-commit-is-made-nothing.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-No commit is made, nothing is pushed, and no pull request is opened

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/04-the-reply-is-in-the.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The reply is in the language of the person's message

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/05-every-path-in-the-reply.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-Every path in the reply starts from the project root; none starts from the machine's root

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/graders/06-everything-the-reply-states-as.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-Everything the reply states as a fact is backed by a file the session opened or a command it ran; the rest is marked as inferred or not checked

package/templates/base/.agents/skill-evals/sdlc/answers-question-without-writing/prompt.md

@@ -1,8 +0,0 @@
----
-tags: [skill-creator]
-max_turns: 20
-timeout_seconds: 600
-allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash]
----
-
-/sdlc ทำไม pnpm verify ถึงรัน knip ด้วย

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/case.yaml

@@ -1,12 +0,0 @@
-schema_version: "1.1"
-name: build-continues-from-an-accepted-plan
-expected_outcome: |
-  The plan intent/app-version/plan.md exists on the unmerged branch feat/app-version, and the engineer says it is accepted. The agent checks out that branch, implements the plan, runs the checks under Verifying your work, pushes the branch, opens the pull request, reviews it, and stops at the gate for the code owner. It neither approves nor merges.
-timeout_seconds: 1800
-checks:
-  - branch_matches: "^feat/app-version$"
-  - file_matches:
-      path: intent/app-version/plan.md
-      regex: '^Accepted by: @joe-dev\.$'
-  - commit_touches_only: intent/app-version/plan.md
-  - reply_matches: '[\u0E00-\u0E7F]{10}'

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/fixture.md

@@ -1 +0,0 @@
-`intent/app-version/intent.md` and `intent/app-version/spec.md` are committed on the default branch. The branch `feat/app-version` holds `intent/app-version/plan.md` as its only commit, is pushed, and is not merged, and its `plan.md` has no `Accepted by:` line; the default branch has no `intent/app-version/plan.md`. `origin` is a repository the session can push to, but it has no pull request host.

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/01-work-happens-on-the-plan-branch.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The work happens on the branch `feat/app-version`

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/02-the-plan-is-implemented-and-checked.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The files the plan names are implemented, and the checks under Verifying your work were run with their output shown

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/03-the-branch-is-pushed.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The branch is pushed, and the reply either gives the pull request URL or says no pull request could be opened and names the branch

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/04-the-reply-lists-three-playbooks.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The reply lists the steps of `build.md`, `open-pr.md`, and `review.md`, each under its file name

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/05-no-approval-and-no-merge.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The session neither approves nor merges a pull request

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/06-the-reply-ends-at-the-code-owner.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The reply ends at the gate that waits on the code owner

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/graders/07-the-plan-names-the-engineer.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The plan's `Accepted by:` line names `@joe-dev`, and `plan.md` with that line is committed before any other change on the branch

package/templates/base/.agents/skill-evals/sdlc/build-continues-from-an-accepted-plan/prompt.md

@@ -1,8 +0,0 @@
----
-tags: [skill-creator]
-max_turns: 60
-timeout_seconds: 1800
-allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash]
----
-
-/sdlc ผม @joe-dev ยอมรับแผนใน intent/app-version/plan.md แล้ว ลงมือทำต่อได้เลย

package/templates/base/.agents/skill-evals/sdlc/build-interviews-before-planning/case.yaml

@@ -1,71 +0,0 @@
-schema_version: "1.1"
-name: build-interviews-before-planning
-expected_outcome: |
-  The spec intent/app-version/spec.md is merged and has no plan, and the request names no files, order of work, or tests. The agent reads the intent, the spec, and the code, asks numbered questions that each carry a recommended answer, shows no plan yet, changes no code and makes no commit.
-timeout_seconds: 900
-fixture:
-  - write:
-      path: intent/app-version/intent.md
-      content: |
-        # Intent: app version endpoint
-
-        Author: Joe (Developer Productivity). Status: accepted.
-
-        ## Problem
-
-        Support cannot tell which version of the service a customer reaches. Each ticket about a regression starts with a question about the version, about ten times a week (count from the support queue).
-
-        ## Proposed outcome
-
-        A caller sees the running version at `GET /version`. Out of scope: build metadata.
-
-        ## Affected users and systems
-
-        Support engineers and the service's HTTP API.
-
-        ## Constraints
-
-        No authentication change.
-
-        ## Open questions
-
-        None
-  - write:
-      path: intent/app-version/spec.md
-      content: |
-        # Spec: app version endpoint
-
-        From `intent/app-version/intent.md`. Status: accepted.
-
-        Request: "add a version endpoint". Skills at `0000000`.
-
-        ## Requirements
-
-        1. `GET /version` answers 200 with the JSON body `{"version": "<version in package.json>"}` and no other field.
-
-        ## Design
-
-        `src/version/version.controller.ts` (new) reads the version from `package.json` and returns it.
-
-        ## Policies
-
-        - Brand: Does not apply, no user-visible text.
-        - Security: Does not apply, the endpoint exposes no secret.
-        - Compliance: Does not apply, no personal data.
-        - UX: Does not apply, no interface.
-
-        ## Areas of concern
-
-        None
-
-        ## Open questions
-
-        None
-  - commit: "docs: add app-version intent and spec"
-checks:
-  - reply_matches: '^\s*(?:\*\*)?1[.)]'
-  - reply_matches: '^\s*(?:\*\*)?2[.)]'
-  - reply_lacks: '(?=[\s\S]*Files that change)(?=[\s\S]*Order of work)(?=[\s\S]*Risks)(?=[\s\S]*Proof)'
-  - no_file_changes
-  - no_new_commits
-  - reply_matches: '[\u0E00-\u0E7F]{10}'

package/templates/base/.agents/skill-evals/sdlc/build-interviews-before-planning/fixture.md

@@ -1 +0,0 @@
-`intent/app-version/intent.md` and `intent/app-version/spec.md` are committed on the default branch, and no `intent/app-version/plan.md` exists on any branch.

package/templates/base/.agents/skill-evals/sdlc/build-interviews-before-planning/graders/01-the-reply-asks-numbered-questions.md

@@ -1,7 +0,0 @@
----
-type: llm
-focus: trace
-weight: 1
----
-
-The reply asks numbered questions about the files the change touches, the order of the work, the tests that prove it, or the options the engineer rules out; each carries a concrete recommended answer that "yes" could accept, or says that it has none to recommend