@next-friday/create-app 9.8.0 → 9.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/templates/base/SETUP.md +8 -6
- package/templates/nestjs/AGENTS.md +12 -6
- package/templates/nestjs/CONTRIBUTING.md +7 -0
- package/templates/nextjs/AGENTS.md +12 -6
- package/templates/nextjs/CONTRIBUTING.md +7 -0
- package/templates/nodejs/AGENTS.md +12 -6
- package/templates/nodejs/CONTRIBUTING.md +7 -0
- package/templates/payload/AGENTS.md +12 -6
- package/templates/payload/CONTRIBUTING.md +7 -0
- package/templates/turborepo/AGENTS.md +12 -6
- package/templates/turborepo/CONTRIBUTING.md +7 -0
package/package.json
CHANGED
package/templates/base/SETUP.md
CHANGED
|
@@ -97,12 +97,14 @@ Replace `security@example.com` in `SECURITY.md` with the contact the security po
|
|
|
97
97
|
- **Sources of truth (engineering lead):** for each artifact, name one system as the source of truth: this repository, an existing tool such as Jira, or, as the minimum, a link both ways (the record id in the file and the commit SHA in the record).
|
|
98
98
|
- **Higher risk (engineering lead):** decide which changes count as higher risk. A tech lead or architect approves their specs and plans.
|
|
99
99
|
- **Policies (each policy owner, with an engineer):** the plugin ships a default for each area, `plugins/sdlc/claude-code/skills/<area>-policy/SKILL.md` (security: OWASP ASVS 5.0.0 Level 1; UX: WCAG 2.2 Level AA; compliance: the OECD privacy principles; brand: one declared source for every brand value). Review it. To replace a default, add the organization's own rules in `.agents/skills/<area>-policy/SKILL.md` in the project: that file wins over the plugin's default, and the `CODEOWNERS` line of step 2 for that area makes the policy owner its code owner. Do not edit the plugin's copy. Then run `pnpm rules:sync`, which renders the project's own policy skill for Claude Code and Cursor. Test that the skill triggers: ask for the relevant task in different ways and confirm the skill loads each time.
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
<!-- deploy:
|
|
104
|
-
|
|
105
|
-
|
|
100
|
+
- **Production gate (engineering leadership, with change management and compliance):** name the release managers and add them as required reviewers on the `prod` environment, as the README's deploy section describes. `.agents/hooks/agent-production-gate.sh` blocks an agent's shell commands that dispatch a `prod`
|
|
101
|
+
<!-- deploy:railway -->
|
|
102
|
+
deploy, run a Railway command with `prod` as its environment,
|
|
103
|
+
<!-- deploy:end -->
|
|
104
|
+
<!-- deploy:none -->
|
|
105
|
+
deploy
|
|
106
|
+
<!-- deploy:end -->
|
|
107
|
+
or push a release tag. It does not read MCP tools. A release manager whose own agent session must do one of these starts the agent with `RELEASE_APPROVAL` set to the approval record, for example `RELEASE_APPROVAL=CHG-123 claude`. The value lifts the gate only when it matches the extended regular expression on the first line of `.agents/release-approval-form`, shipped as `^[A-Z]+-[0-9]+$`; set that line to the form of your organization's approval records. Each gate hook appends its decisions to `.agents/logs/gate-decisions.jsonl`, which git ignores: the time, the hook, the decision, the session, and the reason for a block, and, when the production gate is lifted, the approval value and the Git user name. A record holds no command text and no path.
|
|
106
108
|
- **Review (tech lead):** `.agents/review.md` names this stack's generated files to skip; add a path when the project gains a generated file, then run `pnpm rules:sync`, which renders it to `REVIEW.md` for Claude Code Review. Once a month, rate the review findings and tune `.agents/review.md`.
|
|
107
109
|
- **People without Git experience:** connect GitHub to Claude (claude.ai or Cowork), so Claude commits `intent.md` for them.
|
|
108
110
|
|
|
@@ -45,12 +45,18 @@ The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the c
|
|
|
45
45
|
|
|
46
46
|
When Claude makes a mistake twice, add the correction here.
|
|
47
47
|
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
<!-- deploy:
|
|
52
|
-
|
|
53
|
-
|
|
48
|
+
- **Production gate**: `.agents/hooks/agent-production-gate.sh` blocks a shell command that deploys to
|
|
49
|
+
<!-- deploy:railway -->
|
|
50
|
+
`prod`, runs a Railway CLI command that names `prod`,
|
|
51
|
+
<!-- deploy:end -->
|
|
52
|
+
<!-- deploy:none -->
|
|
53
|
+
`prod`
|
|
54
|
+
<!-- deploy:end -->
|
|
55
|
+
or pushes a release tag, unless a release manager started the session with `RELEASE_APPROVAL` set to a value that matches the extended regular expression on the first line of `.agents/release-approval-form`. Report what is ready to promote instead. When a gated command appears only inside a message, write the text to a file with your file-editing tool, not a shell heredoc, and pass it with `git commit -F <file>` or `gh pr create --body-file <file>`. The gate reads only shell commands, so an MCP tool
|
|
56
|
+
<!-- deploy:railway -->
|
|
57
|
+
or a Railway command without `-e` or `--environment`
|
|
58
|
+
<!-- deploy:end -->
|
|
59
|
+
passes it.
|
|
54
60
|
- **Issues**: open an issue only to hand work to another person, never to give a pull request a number to close. A pull request closes an issue that already exists with `Closes #<issue>`.
|
|
55
61
|
- **What belongs in the repository**: files, commit messages, and pull requests hold the change, its reason, and the checks. Write no date, log, history, mistake count, token figure, or session note into a file.
|
|
56
62
|
- **Sourced requirements**: add a requirement to an intent, spec, or plan only when a person decided it or a named source says it. This includes a requirement a review bot suggests. When no person decided it and no source says it, leave it out and answer the thread with that.
|
|
@@ -45,8 +45,15 @@ Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. A
|
|
|
45
45
|
|
|
46
46
|
## Pull requests
|
|
47
47
|
|
|
48
|
+
<!-- deploy:railway -->
|
|
48
49
|
We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
|
|
49
50
|
|
|
51
|
+
<!-- deploy:end -->
|
|
52
|
+
<!-- deploy:none -->
|
|
53
|
+
We use trunk-based development. `main` is the only long-lived branch.
|
|
54
|
+
|
|
55
|
+
<!-- deploy:end -->
|
|
56
|
+
|
|
50
57
|
- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
|
|
51
58
|
- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
|
|
52
59
|
- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
|
|
@@ -46,12 +46,18 @@ The `verifier` subagent starts the app with `pnpm dev`. It exercises the changed
|
|
|
46
46
|
When Claude makes a mistake twice, add the correction here.
|
|
47
47
|
|
|
48
48
|
- **First end-to-end run**: run `pnpm exec playwright install chromium` once. `pnpm test:e2e` starts the development server unless one is already running.
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
<!-- deploy:
|
|
53
|
-
|
|
54
|
-
|
|
49
|
+
- **Production gate**: `.agents/hooks/agent-production-gate.sh` blocks a shell command that deploys to
|
|
50
|
+
<!-- deploy:railway -->
|
|
51
|
+
`prod`, runs a Railway CLI command that names `prod`,
|
|
52
|
+
<!-- deploy:end -->
|
|
53
|
+
<!-- deploy:none -->
|
|
54
|
+
`prod`
|
|
55
|
+
<!-- deploy:end -->
|
|
56
|
+
or pushes a release tag, unless a release manager started the session with `RELEASE_APPROVAL` set to a value that matches the extended regular expression on the first line of `.agents/release-approval-form`. Report what is ready to promote instead. When a gated command appears only inside a message, write the text to a file with your file-editing tool, not a shell heredoc, and pass it with `git commit -F <file>` or `gh pr create --body-file <file>`. The gate reads only shell commands, so an MCP tool
|
|
57
|
+
<!-- deploy:railway -->
|
|
58
|
+
or a Railway command without `-e` or `--environment`
|
|
59
|
+
<!-- deploy:end -->
|
|
60
|
+
passes it.
|
|
55
61
|
- **Issues**: open an issue only to hand work to another person, never to give a pull request a number to close. A pull request closes an issue that already exists with `Closes #<issue>`.
|
|
56
62
|
- **What belongs in the repository**: files, commit messages, and pull requests hold the change, its reason, and the checks. Write no date, log, history, mistake count, token figure, or session note into a file.
|
|
57
63
|
- **Sourced requirements**: add a requirement to an intent, spec, or plan only when a person decided it or a named source says it. This includes a requirement a review bot suggests. When no person decided it and no source says it, leave it out and answer the thread with that.
|
|
@@ -45,8 +45,15 @@ Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. A
|
|
|
45
45
|
|
|
46
46
|
## Pull requests
|
|
47
47
|
|
|
48
|
+
<!-- deploy:railway -->
|
|
48
49
|
We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
|
|
49
50
|
|
|
51
|
+
<!-- deploy:end -->
|
|
52
|
+
<!-- deploy:none -->
|
|
53
|
+
We use trunk-based development. `main` is the only long-lived branch.
|
|
54
|
+
|
|
55
|
+
<!-- deploy:end -->
|
|
56
|
+
|
|
50
57
|
- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
|
|
51
58
|
- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
|
|
52
59
|
- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
|
|
@@ -44,12 +44,18 @@ The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the c
|
|
|
44
44
|
|
|
45
45
|
When Claude makes a mistake twice, add the correction here.
|
|
46
46
|
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
<!-- deploy:
|
|
51
|
-
|
|
52
|
-
|
|
47
|
+
- **Production gate**: `.agents/hooks/agent-production-gate.sh` blocks a shell command that deploys to
|
|
48
|
+
<!-- deploy:railway -->
|
|
49
|
+
`prod`, runs a Railway CLI command that names `prod`,
|
|
50
|
+
<!-- deploy:end -->
|
|
51
|
+
<!-- deploy:none -->
|
|
52
|
+
`prod`
|
|
53
|
+
<!-- deploy:end -->
|
|
54
|
+
or pushes a release tag, unless a release manager started the session with `RELEASE_APPROVAL` set to a value that matches the extended regular expression on the first line of `.agents/release-approval-form`. Report what is ready to promote instead. When a gated command appears only inside a message, write the text to a file with your file-editing tool, not a shell heredoc, and pass it with `git commit -F <file>` or `gh pr create --body-file <file>`. The gate reads only shell commands, so an MCP tool
|
|
55
|
+
<!-- deploy:railway -->
|
|
56
|
+
or a Railway command without `-e` or `--environment`
|
|
57
|
+
<!-- deploy:end -->
|
|
58
|
+
passes it.
|
|
53
59
|
- **Issues**: open an issue only to hand work to another person, never to give a pull request a number to close. A pull request closes an issue that already exists with `Closes #<issue>`.
|
|
54
60
|
- **What belongs in the repository**: files, commit messages, and pull requests hold the change, its reason, and the checks. Write no date, log, history, mistake count, token figure, or session note into a file.
|
|
55
61
|
- **Sourced requirements**: add a requirement to an intent, spec, or plan only when a person decided it or a named source says it. This includes a requirement a review bot suggests. When no person decided it and no source says it, leave it out and answer the thread with that.
|
|
@@ -44,8 +44,15 @@ Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. A
|
|
|
44
44
|
|
|
45
45
|
## Pull requests
|
|
46
46
|
|
|
47
|
+
<!-- deploy:railway -->
|
|
47
48
|
We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
|
|
48
49
|
|
|
50
|
+
<!-- deploy:end -->
|
|
51
|
+
<!-- deploy:none -->
|
|
52
|
+
We use trunk-based development. `main` is the only long-lived branch.
|
|
53
|
+
|
|
54
|
+
<!-- deploy:end -->
|
|
55
|
+
|
|
49
56
|
- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
|
|
50
57
|
- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
|
|
51
58
|
- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
|
|
@@ -49,12 +49,18 @@ The `verifier` subagent starts the app with `pnpm dev`, which needs a PostgreSQL
|
|
|
49
49
|
When Claude makes a mistake twice, add the correction here.
|
|
50
50
|
|
|
51
51
|
- **Database for `pnpm dev` and end-to-end tests**: both need a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm exec playwright install chromium` once before the first `pnpm test:e2e`.
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
<!-- deploy:
|
|
56
|
-
|
|
57
|
-
|
|
52
|
+
- **Production gate**: `.agents/hooks/agent-production-gate.sh` blocks a shell command that deploys to
|
|
53
|
+
<!-- deploy:railway -->
|
|
54
|
+
`prod`, runs a Railway CLI command that names `prod`,
|
|
55
|
+
<!-- deploy:end -->
|
|
56
|
+
<!-- deploy:none -->
|
|
57
|
+
`prod`
|
|
58
|
+
<!-- deploy:end -->
|
|
59
|
+
or pushes a release tag, unless a release manager started the session with `RELEASE_APPROVAL` set to a value that matches the extended regular expression on the first line of `.agents/release-approval-form`. Report what is ready to promote instead. When a gated command appears only inside a message, write the text to a file with your file-editing tool, not a shell heredoc, and pass it with `git commit -F <file>` or `gh pr create --body-file <file>`. The gate reads only shell commands, so an MCP tool
|
|
60
|
+
<!-- deploy:railway -->
|
|
61
|
+
or a Railway command without `-e` or `--environment`
|
|
62
|
+
<!-- deploy:end -->
|
|
63
|
+
passes it.
|
|
58
64
|
- **Issues**: open an issue only to hand work to another person, never to give a pull request a number to close. A pull request closes an issue that already exists with `Closes #<issue>`.
|
|
59
65
|
- **What belongs in the repository**: files, commit messages, and pull requests hold the change, its reason, and the checks. Write no date, log, history, mistake count, token figure, or session note into a file.
|
|
60
66
|
- **Sourced requirements**: add a requirement to an intent, spec, or plan only when a person decided it or a named source says it. This includes a requirement a review bot suggests. When no person decided it and no source says it, leave it out and answer the thread with that.
|
|
@@ -46,8 +46,15 @@ Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. A
|
|
|
46
46
|
|
|
47
47
|
## Pull requests
|
|
48
48
|
|
|
49
|
+
<!-- deploy:railway -->
|
|
49
50
|
We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
|
|
50
51
|
|
|
52
|
+
<!-- deploy:end -->
|
|
53
|
+
<!-- deploy:none -->
|
|
54
|
+
We use trunk-based development. `main` is the only long-lived branch.
|
|
55
|
+
|
|
56
|
+
<!-- deploy:end -->
|
|
57
|
+
|
|
51
58
|
- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
|
|
52
59
|
- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
|
|
53
60
|
- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
|
|
@@ -52,12 +52,18 @@ When Claude makes a mistake twice, add the correction here.
|
|
|
52
52
|
|
|
53
53
|
- **Next.js docs live per app**: this Next.js version differs from your training data. Read the guide in `apps/app/node_modules/next/dist/docs/` or `apps/backoffice/node_modules/next/dist/docs/` before writing Next.js code; the workspace root has no `next` package.
|
|
54
54
|
- **Database for `pnpm dev` and end-to-end tests**: the backoffice needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first `pnpm test:e2e`.
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
<!-- deploy:
|
|
59
|
-
|
|
60
|
-
|
|
55
|
+
- **Production gate**: `.agents/hooks/agent-production-gate.sh` blocks a shell command that deploys to
|
|
56
|
+
<!-- deploy:railway -->
|
|
57
|
+
`prod`, runs a Railway CLI command that names `prod`,
|
|
58
|
+
<!-- deploy:end -->
|
|
59
|
+
<!-- deploy:none -->
|
|
60
|
+
`prod`
|
|
61
|
+
<!-- deploy:end -->
|
|
62
|
+
or pushes a release tag, unless a release manager started the session with `RELEASE_APPROVAL` set to a value that matches the extended regular expression on the first line of `.agents/release-approval-form`. Report what is ready to promote instead. When a gated command appears only inside a message, write the text to a file with your file-editing tool, not a shell heredoc, and pass it with `git commit -F <file>` or `gh pr create --body-file <file>`. The gate reads only shell commands, so an MCP tool
|
|
63
|
+
<!-- deploy:railway -->
|
|
64
|
+
or a Railway command without `-e` or `--environment`
|
|
65
|
+
<!-- deploy:end -->
|
|
66
|
+
passes it.
|
|
61
67
|
- **Issues**: open an issue only to hand work to another person, never to give a pull request a number to close. A pull request closes an issue that already exists with `Closes #<issue>`.
|
|
62
68
|
- **What belongs in the repository**: files, commit messages, and pull requests hold the change, its reason, and the checks. Write no date, log, history, mistake count, token figure, or session note into a file.
|
|
63
69
|
- **Sourced requirements**: add a requirement to an intent, spec, or plan only when a person decided it or a named source says it. This includes a requirement a review bot suggests. When no person decided it and no source says it, leave it out and answer the thread with that.
|
|
@@ -47,8 +47,15 @@ Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. A
|
|
|
47
47
|
|
|
48
48
|
## Pull requests
|
|
49
49
|
|
|
50
|
+
<!-- deploy:railway -->
|
|
50
51
|
We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
|
|
51
52
|
|
|
53
|
+
<!-- deploy:end -->
|
|
54
|
+
<!-- deploy:none -->
|
|
55
|
+
We use trunk-based development. `main` is the only long-lived branch.
|
|
56
|
+
|
|
57
|
+
<!-- deploy:end -->
|
|
58
|
+
|
|
52
59
|
- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
|
|
53
60
|
- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
|
|
54
61
|
- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
|