@next-friday/create-app 9.2.0 → 9.3.0

package/templates/base/.cursor/skills/sdlc/playbooks/question.md

@@ -1,8 +0,0 @@
-# Question
-
-1. Find the facts: read the files and run read-only commands.
-2. Answer, citing `path:line` or command output for each claim, as the **Write replies a person can check** convention in `AGENTS.md` says.
-3. Write no file, make no commit, push nothing, and post nothing to GitHub or another service.
-4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc write an intent for this` to start the change", and stop.
-
-**Next:** none; the person; when they send a new message.

package/templates/base/.cursor/skills/sdlc-help/SKILL.md

@@ -1,23 +0,0 @@
----
-name: sdlc-help
-description: Explains how this project's workflow runs and how to use /sdlc. It answers and starts no work. Run it with /sdlc-help.
-disable-model-invocation: true
----
-
-# SDLC help
-
-1. When the message asks for work rather than how, open no project file. The whole reply is two lines in the person's language: this command starts no work; and the message to send instead, which is `/sdlc` followed by their own words.
-2. When the topic is unclear, ask one question with these choices: how the workflow runs and starting work, keeping `/sdlc` on for a session, fixing a defect in behaviour that already exists, who decides at each gate, a mistake the agent repeats, or company policy.
-3. Read the files the topic points to before you answer. When a file disagrees with the map below, the file is right.
-4. When the person asks about a playbook, a command, or a file that this project does not have, the whole reply is three lines: it does not exist; what exists instead, as one file path; and one message they can send next. Stop there. Do not explain the topic from other files.
-5. Otherwise answer, then give one message the person can send as is, with real words from their question and no blanks to fill in, then list the files the answer came from.
-6. Write the reply as the **Write replies a person can check** convention in `AGENTS.md` says.
-
-## Map
-
-- **How the workflow runs, and starting work:** `intent/README.md` and the table in `.agents/skills/sdlc/SKILL.md`.
-- **Keeping `/sdlc` on for a session:** a person starts it; nothing routes work into it. In Claude Code, an invoked skill's content stays in the conversation across later turns, and after a compaction Claude Code re-attaches the most recent invocation within a token budget, so a person types `/sdlc` again only to restore the full text. In Cursor, pick `/sdlc` from the `/` menu and press Option+Enter (Mac) or Alt+Enter (Windows) instead of Enter, which makes it a custom mode that stays in context until the person exits it. Plain Enter attaches it to one message.
-- **Fixing a defect in behaviour that already exists:** `.agents/skills/sdlc/playbooks/fix.md` is the path with no intent and no spec, for a person's request: a plan an engineer accepts, then a failing test, the fix, and a pull request. A finding from a job always starts at intent. Every other change runs intent, spec, plan, then build.
-- **Who decides:** `.agents/rules/agent-owned-work.md` and `.github/CODEOWNERS`.
-- **A mistake the agent repeats:** **Things Claude gets wrong** in `AGENTS.md`.
-- **Company policy:** the policy skills in `.agents/skills/`, and `.github/CODEOWNERS` for each one's owner.

package/templates/base/.cursor/skills/security-policy/SKILL.md

@@ -1,41 +0,0 @@
----
-name: security-policy
-description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
----
-
-# Security policy
-
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
-Standard: [OWASP Application Security Verification Standard 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en), Level 1. This is the default; the owner replaces or tightens it by editing this file.
-
-## Rules
-
-1. Find the chapters the change touches in the table below. A change that touches none meets this policy; say "Does not apply" and why.
-2. For each chapter it touches, open that chapter's file in the standard and list every Level 1 requirement that applies to the change. Cite each as `v5.0.0-<chapter>.<section>.<requirement>`, for example `v5.0.0-8.2.1`.
-3. Each cited requirement becomes a requirement of the spec, and a test or a review step of the plan.
-4. When you cannot open the standard, name the chapters, cite no requirement number from memory, and report that as an area of concern.
-5. A Level 1 requirement the change cannot meet is an area of concern. Never drop it silently.
-6. Secrets stay out of the repository, logs, and error messages; `.env.example` holds names only.
-
-## Chapters
-
-| Chapter | Covers                              | Level 1 requirements |
-| :------ | :---------------------------------- | :------------------- |
-| V1      | Encoding and Sanitization           | 8                    |
-| V2      | Validation and Business Logic       | 4                    |
-| V3      | Web Frontend Security               | 8                    |
-| V4      | API and Web Service                 | 2                    |
-| V5      | File Handling                       | 4                    |
-| V6      | Authentication                      | 13                   |
-| V7      | Session Management                  | 6                    |
-| V8      | Authorization                       | 4                    |
-| V9      | Self-contained Tokens               | 4                    |
-| V10     | OAuth and OIDC                      | 5                    |
-| V11     | Cryptography                        | 3                    |
-| V12     | Secure Communication                | 3                    |
-| V13     | Configuration                       | 1                    |
-| V14     | Data Protection                     | 2                    |
-| V15     | Secure Coding and Architecture      | 3                    |
-| V16     | Security Logging and Error Handling | 0                    |
-| V17     | WebRTC                              | 0                    |

package/templates/base/.cursor/skills/ux-policy/SKILL.md

@@ -1,21 +0,0 @@
----
-name: ux-policy
-description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
----
-
-# UX policy
-
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
-Standard: [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/), Level AA: the page satisfies all the Level A and Level AA success criteria. This is the default; the owner replaces or tightens it by editing this file.
-
-## Rules
-
-1. A change with no user interface meets this policy; say "Does not apply" and why.
-2. For a change with a user interface, the spec lists the success criteria the change touches, by number and name, and each becomes a requirement.
-3. Every interactive element works with the keyboard alone, shows where the focus is, and has a name a screen reader announces.
-4. Text and meaningful graphics meet the contrast minimum, and no information is carried by colour alone.
-5. Every form field has a visible label, and every error says in text which field is wrong and how to fix it.
-6. Check the criteria that WCAG 2.2 added at Level A and AA: 2.4.11 Focus Not Obscured (Minimum), 2.5.7 Dragging Movements, 2.5.8 Target Size (Minimum), 3.2.6 Consistent Help, 3.3.7 Redundant Entry, and 3.3.8 Accessible Authentication (Minimum).
-7. Every state the user can reach is designed: loading, empty, error, and success.
-8. A criterion the change cannot meet is an area of concern. Never drop it silently.

package/templates/base/.github/workflows/agent-evals.yml

@@ -1,46 +0,0 @@
-name: Agent evals
-
-on:
-  pull_request:
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .agents/**
-      - .claude/**
-      - .cursor/**
-  schedule:
-    - cron: "0 2 * * *"
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  evals:
-    name: Run agent evals
-    if: vars.CLAUDE_CI_ENABLED == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Set up Node.js and pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          cache: true
-          require-lockfile: true
-      - name: Run the eval suite
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-        run: |
-          [[ -n "$ANTHROPIC_API_KEY" || -n "$CLAUDE_CODE_OAUTH_TOKEN" ]] || { echo "::error::Set the CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY repository secret"; exit 1; }
-          [[ -n "$ANTHROPIC_API_KEY" ]] || unset ANTHROPIC_API_KEY
-          [[ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]] || unset CLAUDE_CODE_OAUTH_TOKEN
-          pnpm evals:run