agents-md-kit 0.0.0-stage → 0.1.0

package/packs/web/files/.claude/skills/html-syntax-and-semantics/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: html-syntax-and-semantics
+description: Rules for writing valid, semantic, accessible HTML. Use when writing or reviewing any HTML, JSX markup, templates or email-less web pages, including document structure, element choice, forms, images, links, tables and accessibility basics.
+---
+
+# HTML Syntax, Semantics and Accessibility
+
+Good HTML is the foundation for accessibility, SEO and maintainable CSS. In component frameworks (for example React/JSX, Vue or Svelte templates) the same rules apply to the rendered output.
+
+## 1. Document Skeleton
+
+Every page needs:
+
+```html
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Page Title | Brand</title>
+  </head>
+  <body>...</body>
+</html>
+```
+
+- `<!doctype html>` first, to avoid quirks mode.
+- `lang` on `<html>` (and on any inline foreign-language content).
+- `charset` as UTF-8, within the first 1024 bytes of the document.
+- A viewport meta tag. Never disable zoom (`user-scalable=no`, `maximum-scale=1`).
+- One unique, descriptive `<title>` per page.
+
+## 2. Syntax Rules
+
+- Lowercase element and attribute names.
+- Always quote attribute values with double quotes.
+- Close all non-void elements. Void elements (`img`, `input`, `br`, `meta`, `link`, `hr`) take no closing tag.
+- Nest correctly: no block elements inside `<p>`, no `<a>` inside `<a>`, no interactive elements inside `<button>` or `<a>`.
+- `id` values are unique per page. Don't duplicate them.
+- Use boolean attributes without values (`disabled`, `required`, `checked`).
+- Don't use obsolete or presentational elements (`<center>`, `<font>`, `<b>` for emphasis). Style belongs in CSS.
+- Validate with the W3C validator or an HTML linter in CI.
+
+## 3. Semantic Elements
+
+Pick the element for its meaning, not its looks.
+
+| Need | Use | Not |
+|---|---|---|
+| Site/section header | `<header>` | `<div class="header">` |
+| Primary navigation | `<nav>` | `<div class="nav">` |
+| Unique main content (once per page) | `<main>` | `<div id="main">` |
+| Self-contained content (post, card) | `<article>` | `<div>` |
+| Thematic grouping with a heading | `<section>` | `<div>` |
+| Tangential content | `<aside>` | `<div>` |
+| Footer | `<footer>` | `<div>` |
+| Figure with caption | `<figure>` + `<figcaption>` | `<div>` + `<p>` |
+| Lists | `<ul>`, `<ol>`, `<dl>` | repeated `<div>`/`<br>` |
+| Emphasis / importance | `<em>` / `<strong>` | `<i>` / `<b>` for meaning |
+| Dates | `<time datetime="2026-11-11">` | plain text |
+| Actions | `<button type="button">` | `<div onclick>` |
+| Navigation to another URL | `<a href>` | `<button>` or `<span onclick>` |
+
+Use `<div>` and `<span>` only when no semantic element fits.
+
+## 4. Headings
+
+- Exactly one `<h1>` per page, describing the page.
+- Don't skip levels (`h1` → `h2` → `h3`).
+- Choose heading level by document outline, never by font size. Size it with CSS.
+
+## 5. Links and Buttons
+
+- Link text must make sense out of context. Avoid "click here" and "read more" alone.
+- External links opened in a new tab: `target="_blank" rel="noopener noreferrer"`. Prefer not to force new tabs.
+- `<button>` triggers an action. Always set `type` (`button`, `submit`, `reset`) explicitly.
+- Never remove the focus outline without a visible replacement (`:focus-visible`).
+
+## 6. Images and Media
+
+- Every `<img>` has an `alt`. Informative image: describe its purpose. Decorative image: `alt=""`.
+- Always set `width` and `height` (or CSS `aspect-ratio`) to prevent layout shift.
+- Below-the-fold images: `loading="lazy"`. The main above-the-fold (LCP) image: don't lazy-load, and consider `fetchpriority="high"`.
+- Use `srcset` and `sizes` (or `<picture>`) for responsive images. Prefer modern formats (AVIF, WebP) with fallback.
+- Video: provide captions (`<track kind="captions">`) and avoid autoplay with sound.
+- Icons that carry meaning need accessible names. Decorative SVGs get `aria-hidden="true"`.
+
+## 7. Forms
+
+- Every control has a visible `<label for="id">` (or wraps the input). Placeholder is not a label.
+- Use the right `type` (`email`, `tel`, `url`, `number`, `date`, `password`) and `autocomplete` tokens (`email`, `given-name`, `current-password`, `new-password`, `one-time-code`).
+- Group related controls with `<fieldset>` and `<legend>`.
+- Use `required`, `min`, `max`, `pattern` for client hints, but always validate on the server too.
+- Show errors in text next to the field, linked via `aria-describedby`, and mark invalid fields with `aria-invalid="true"`. Don't rely on color alone.
+- Submit with a real `<button type="submit">` inside a `<form>`.
+
+## 8. Tables
+
+- Use tables only for tabular data, never for layout.
+- Include `<caption>`, `<thead>`, `<tbody>`, and `<th scope="col|row">`.
+
+## 9. Accessibility Essentials
+
+- Prefer native elements over ARIA. First rule of ARIA: don't use it if a native element does the job.
+- All functionality works with keyboard only. Logical tab order, no positive `tabindex`.
+- Skip link as the first focusable element: `<a href="#main" class="skip">Skip to content</a>`.
+- Text contrast of at least 4.5:1 (3:1 for large text and UI components), per WCAG 2.2 AA.
+- Don't convey information by color alone.
+- Landmarks (`header`, `nav`, `main`, `footer`) give screen readers navigation points. Label duplicates (`<nav aria-label="Footer">`).
+- Dynamic updates: use `aria-live` regions for status messages. Manage focus for modals and route changes.
+- Respect `prefers-reduced-motion`.
+- Target size for touch/click: at least 24x24 CSS px (aim for 44x44).
+
+## 10. Component Framework Notes (JSX shown as an example)
+
+- Use `className`, `htmlFor`, and self-close void elements (`<img />`).
+- Lists need stable `key`s, never array indexes for reorderable data.
+- Keep the rendered HTML semantic. A `<div onClick>` in JSX is still wrong.
+
+## Review Checklist
+
+- [ ] Valid doctype, `lang`, charset, viewport, unique `<title>`
+- [ ] Semantic elements; one `<h1>`; heading levels don't skip
+- [ ] All images have `alt` and dimensions
+- [ ] All form controls have labels and correct `type`/`autocomplete`
+- [ ] Buttons vs links used correctly; `type` set on buttons
+- [ ] Keyboard-operable with visible focus
+- [ ] No duplicate `id`s; passes an HTML validator and an accessibility check (axe/Lighthouse)

package/packs/web/files/.claude/skills/seo-best-practices/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: seo-best-practices
+description: Technical and on-page SEO rules for web applications. Use when building or reviewing pages, routing, metadata, structured data, sitemaps, rendering strategy (SSR/SSG/CSR), performance (Core Web Vitals), international sites, or when a page must rank in search.
+---
+
+# SEO Implementation Best Practices
+
+SEO is mostly good engineering: crawlable, fast, semantic pages with unique, useful content. Follow these rules when implementing pages. Verify current guidance against Google Search Central when in doubt, as recommendations change.
+
+## 1. Rendering Strategy (Crawlability)
+
+- Content that must rank must be in the initial HTML response. Prefer **SSG** (static) or **SSR** for public, indexable pages. Use client-side rendering (CSR) only for authenticated or non-indexable areas.
+- With a client-side framework (React, Vue, Svelte, etc.), render public pages with SSR/SSG (for example Next.js, Nuxt, SvelteKit, Astro).
+- Don't hide primary content behind clicks, tabs that require JS fetches, or infinite scroll without paginated URLs.
+- Use real `<a href>` links for navigation, not `onClick` handlers. Crawlers follow `href`.
+- Each distinct view has its own URL (no `#` fragment routing for indexable content). Use the History API / framework routing.
+- Return correct HTTP status codes: `200` OK, `301`/`308` permanent redirect, `404` for missing pages, `410` for permanently removed, `5xx` only for real errors. Never return `200` for a "not found" page (soft 404).
+
+## 2. URLs
+
+- Short, lowercase, hyphen-separated, descriptive: `/guides/react-solid-principles`.
+- No session IDs or unnecessary parameters in indexable URLs.
+- Pick one canonical form (trailing slash or not, `www` or not, HTTPS) and 301 the others to it.
+- Keep URLs stable. When they change, 301 redirect old to new (avoid redirect chains).
+
+## 3. Title and Meta Tags
+
+Per page, unique and written for humans:
+
+```html
+<title>Primary Keyword – Secondary | Brand</title>
+<meta name="description" content="One or two sentences that summarise the page and encourage a click.">
+<link rel="canonical" href="https://example.com/guides/react-solid-principles">
+<meta name="robots" content="index,follow">
+```
+
+- **Title:** unique per page, roughly 50–60 characters, key topic first, brand last.
+- **Meta description:** unique, roughly 120–160 characters. It doesn't directly affect ranking but influences click-through. Search engines may rewrite it.
+- **Canonical:** every indexable page has a self-referencing absolute canonical URL. Use it to consolidate duplicates (filters, tracking parameters).
+- **Robots:** `noindex` for thin, duplicate, internal-search, staging and account pages. Don't combine `noindex` with a `robots.txt` block, because the crawler must be able to fetch the page to see the tag.
+- `meta keywords` is ignored. Don't bother.
+
+## 4. Open Graph and Social Cards
+
+```html
+<meta property="og:type" content="article">
+<meta property="og:title" content="...">
+<meta property="og:description" content="...">
+<meta property="og:url" content="https://example.com/...">
+<meta property="og:image" content="https://example.com/og/page.png">
+<meta name="twitter:card" content="summary_large_image">
+```
+
+- Absolute URLs, image about 1200×630.
+- Not a ranking factor, but controls how links look when shared.
+
+## 5. Content Structure
+
+- One `<h1>` that matches the page's main topic. Logical `h2`/`h3` hierarchy (see `html-syntax-and-semantics`).
+- Content must be original, useful and satisfy search intent. No keyword stuffing, hidden text or doorway pages.
+- Descriptive link anchor text; link related pages together (internal linking). Every important page is reachable within a few clicks from the home page.
+- Image `alt` text that describes the image, descriptive filenames (`react-hooks-diagram.png`).
+- Use breadcrumbs (visible and in structured data) for hierarchical sites.
+
+## 6. Structured Data (JSON-LD)
+
+Add JSON-LD matching the visible content. Never mark up content that isn't on the page.
+
+```html
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "Article",
+  "headline": "The SOLID Principles in React",
+  "author": { "@type": "Person", "name": "Jane Doe" },
+  "datePublished": "2026-11-11",
+  "image": "https://example.com/og/solid.png"
+}
+</script>
+```
+
+- Common types: `Organization`, `WebSite`, `Article`/`BlogPosting`, `BreadcrumbList`, `Product` (+ `Offer`, `AggregateRating` only with real reviews), `FAQPage`, `LocalBusiness`, `Event`, `JobPosting`.
+- Check eligibility for rich results in Google's docs, since some types are restricted.
+- Validate with Google's Rich Results Test and the Schema Markup Validator.
+
+## 7. Performance and Core Web Vitals
+
+Page experience metrics influence ranking and conversions. Targets (at the 75th percentile of real users):
+
+| Metric | Good |
+|---|---|
+| LCP (Largest Contentful Paint) | ≤ 2.5 s |
+| INP (Interaction to Next Paint) | ≤ 200 ms |
+| CLS (Cumulative Layout Shift) | ≤ 0.1 |
+
+How to hit them:
+- **LCP:** optimize and preload the hero image, use `fetchpriority="high"`, serve via CDN, use SSR/SSG, minimize render-blocking CSS/JS, compress (Brotli/gzip), cache aggressively.
+- **INP:** break up long JS tasks, defer non-critical scripts, avoid heavy synchronous work in handlers, code-split.
+- **CLS:** set image/video dimensions, reserve space for ads/embeds, avoid inserting content above existing content, use `font-display: swap` with size-adjusted fallback fonts.
+- Use modern image formats, responsive `srcset`, lazy loading below the fold.
+- Measure with real-user data (CrUX, `web-vitals` library) and Lighthouse/PageSpeed Insights. Lab results alone are not enough.
+
+## 8. Mobile and Security
+
+- Responsive design and the viewport meta tag. Google indexes the mobile version first, so mobile content must equal desktop content.
+- HTTPS everywhere with HSTS. No mixed content.
+- Fix intrusive interstitials.
+
+## 9. Crawl Control
+
+**robots.txt** (at the site root):
+```
+User-agent: *
+Disallow: /admin/
+Disallow: /api/
+Sitemap: https://example.com/sitemap.xml
+```
+- `robots.txt` controls crawling, not indexing. Use `noindex` (meta or `X-Robots-Tag`) to keep pages out of results.
+- Don't block CSS/JS/images that are needed to render pages.
+
+**XML sitemap:**
+- List only canonical, indexable, `200` URLs. Include accurate `<lastmod>`. Max 50,000 URLs or 50 MB per file; use a sitemap index beyond that.
+- Generate it automatically at build or request time. Reference it in `robots.txt` and submit it in Google Search Console and Bing Webmaster Tools.
+
+## 10. Pagination, Filters and Duplicates
+
+- Paginated lists use crawlable links (`?page=2` or `/page/2`) with self-canonical URLs. Don't canonicalize page 2+ to page 1.
+- Faceted/filter URLs that create near-infinite combinations: canonicalize to the main category, or `noindex`/disallow low-value combinations.
+- Avoid duplicate content across `http/https`, `www`, trailing slash, and uppercase/lowercase variants.
+
+## 11. International SEO
+
+- Use `hreflang` annotations (HTML `<link>`, HTTP header or sitemap), bidirectional and including `x-default`:
+```html
+<link rel="alternate" hreflang="en" href="https://example.com/en/">
+<link rel="alternate" hreflang="pt-PT" href="https://example.com/pt/">
+<link rel="alternate" hreflang="x-default" href="https://example.com/">
+```
+- Distinct URLs per language (subdirectory, subdomain or ccTLD). Don't auto-redirect users based on IP without letting crawlers reach every version.
+- Set `<html lang>` correctly.
+
+## 12. Site Migrations and Maintenance
+
+- Before changing URLs or domains: map every old URL to a new one with 301 redirects, keep the sitemap updated, and monitor Search Console for coverage errors.
+- Regularly fix broken links, redirect chains, soft 404s and slow pages.
+- Monitor indexing and queries in Google Search Console. Track Core Web Vitals field data.
+
+## Review Checklist
+
+- [ ] Indexable content is present in server-rendered/static HTML
+- [ ] Unique `<title>`, meta description, self-referencing canonical on each page
+- [ ] One `<h1>`, semantic headings, descriptive links, image `alt`
+- [ ] Correct status codes and 301s; no soft 404s or redirect chains
+- [ ] `robots.txt` and XML sitemap present, accurate and submitted
+- [ ] JSON-LD that matches visible content and validates
+- [ ] Core Web Vitals meet targets in field data
+- [ ] `hreflang` set up (if multilingual); mobile parity; HTTPS only
+- [ ] Non-public pages (admin, staging, search, cart) are `noindex` or protected

package/packs/web/fragments/agents-web.md

@@ -0,0 +1,11 @@
+## Web Skills
+
+| Area | Skill | Load when |
+|---|---|---|
+| HTML & accessibility | `html-syntax-and-semantics` | Writing any markup or component templates (JSX etc.), forms, images, a11y |
+| SEO | `seo-best-practices` | Public pages, metadata, routing, rendering mode, performance |
+
+Definition of Done additions for user-facing pages:
+
+- [ ] Accessible (keyboard, labels, contrast), checked against `html-syntax-and-semantics`
+- [ ] Discoverable and performant (metadata, Core Web Vitals) where relevant, checked against `seo-best-practices`

package/packs/web/manifest.txt

@@ -0,0 +1,5 @@
+# description: Web pack. HTML/accessibility and SEO skills for any web stack, plus their AGENTS.md block.
+
+block  web  AGENTS.md  agents-web.md
+copy   .claude/skills/html-syntax-and-semantics/SKILL.md
+copy   .claude/skills/seo-best-practices/SKILL.md

package/presets/node-backend/docs/node-backend.md

@@ -0,0 +1,60 @@
+# node-backend preset: setup
+
+Installed by agent-kit. This preset adds tooling for a Node.js + TypeScript backend: ESLint (typescript-eslint, Node globals), Prettier, EditorConfig, and commitlint + husky + lint-staged. With `--pack github` it also adds CI, release-please and Dependabot. It adds no skills of its own: the core skills (`backend-architecture-principles`, `api-design-rest`, `backend-security`, `database-best-practices`) already cover backend work.
+
+The installer never edits `package.json`. Run the commands below yourself.
+
+## 1. Install the tooling
+
+```bash
+npm install -D \
+  eslint @eslint/js typescript typescript-eslint globals eslint-config-prettier \
+  prettier husky lint-staged @commitlint/cli @commitlint/config-conventional
+
+npm pkg set scripts.prepare="husky"
+npm pkg set scripts.lint="eslint ."
+npm pkg set scripts.format="prettier --write ."
+npm pkg set scripts.format:check="prettier --check ."
+npm pkg set scripts.typecheck="tsc --noEmit"
+
+npm run prepare          # activates the git hooks in .husky/ (sets core.hooksPath)
+```
+
+Verified on 2026-11-11 with npm 11: this resolves ESLint 10 and TypeScript 6.0.x. `typescript-eslint` 8.x supports ESLint 10 but only TypeScript below 6.1, and npm picks a compatible TypeScript automatically. If you pin TypeScript yourself, stay on 6.0.x until `typescript-eslint` supports TypeScript 7 (`npm view typescript-eslint peerDependencies`).
+
+Add `tsconfig.json`, a test runner (`node:test`, Vitest or Jest) and `test` / `build` scripts for your project. They are intentionally not included.
+
+Using pnpm or yarn? Swap the install commands, replace `npm ci` / `npm audit` in `.github/workflows/ci.yml`, and change `npx` in `.husky/*` to `pnpm exec` / `yarn`.
+
+## 2. Check it works
+
+```bash
+echo "feat(api): add order export" | npx commitlint      # passes
+echo "Added stuff." | npx commitlint                     # fails
+npm run lint
+npx prettier --check .
+```
+
+Husky v9 hook files have no shebang and need the exec bit on macOS/Linux (the installer sets it there). On Windows, run `git update-index --chmod=+x .husky/pre-commit .husky/commit-msg` before committing them.
+
+## 3. GitHub repository settings (only with `--pack github`)
+
+1. **Pull requests: allow squash merging only**, with *Default to pull request title* as the commit message. This makes the PR title the release note.
+2. **Branch protection on `main`**: require a pull request, require the `checks` and `pr-title` status checks, block force pushes.
+3. **Actions > General > Workflow permissions**: *Read and write*, and tick **Allow GitHub Actions to create and approve pull requests** (needed by release-please).
+4. Optional: add a `RELEASE_PLEASE_TOKEN` secret (PAT or GitHub App token) and pass it in `.github/workflows/release-please.yml`. PRs opened with the default `GITHUB_TOKEN` do not trigger other workflows, so without it CI does not run on the release PR.
+
+CI (`.github/workflows/ci.yml`) runs `npm ci`, then lint, format check, typecheck, test and build (each with `--if-present`; remove the flag once the script exists so a missing script fails the build), and `npm audit --omit=dev --audit-level=high`. Set `node-version` to the version you deploy on.
+
+## 4. How releases work (only with `--pack github`)
+
+release-please uses `release-type: node`: it bumps `version` in `package.json`, writes `CHANGELOG.md` and tags `vX.Y.Z` when you merge its release PR. The first release starts from `0.0.0` in `.release-please-manifest.json`. `feat` is Added, `fix` is Fixed, `perf` and `revert` are Changed; other types are hidden. Below 1.0.0, breaking changes bump minor.
+
+Without the github pack, release-please files are not installed and the `changelog-and-versioning` skill uses manual mode.
+
+## 5. Customize
+
+- **Scopes:** uncomment `scope-enum` in `commitlint.config.mjs`.
+- **Type-aware lint rules:** switch to `tseslint.configs.recommendedTypeChecked` and add `languageOptions.parserOptions.projectService: true` once `tsconfig.json` exists (slower, catches floating promises and unsafe `any`).
+- **Ignore lists:** add your own lines to `.gitignore` / `.prettierignore` outside the `agent-kit` markers.
+- **Not using release-please?** Delete `release-please-config.json`, `.release-please-manifest.json` and `.github/workflows/release-please.yml`; the `changelog-and-versioning` skill switches to manual mode.

package/presets/node-backend/files/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

package/presets/node-backend/files/.husky/commit-msg

@@ -0,0 +1 @@
+npx --no -- commitlint --edit "$1"

package/presets/node-backend/files/.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

package/presets/node-backend/files/.lintstagedrc.json

@@ -0,0 +1,4 @@
+{
+  "*.{js,jsx,mjs,cjs,ts,tsx}": ["eslint --fix", "prettier --write"],
+  "*.{json,md,css,scss,html,yml,yaml}": ["prettier --write"]
+}

package/presets/node-backend/files/.prettierrc.json

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "arrowParens": "always"
+}

package/presets/node-backend/files/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

package/presets/node-backend/files/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+This file is generated by [release-please](https://github.com/googleapis/release-please) from Conventional Commits. Do not edit it by hand. See the `changelog-and-versioning` skill.

package/presets/node-backend/files/commitlint.config.mjs

@@ -0,0 +1,12 @@
+// Enforces Conventional Commits. See the git-commit-and-workflow skill.
+export default {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    // Subject line (header) at most 72 characters.
+    'header-max-length': [2, 'always', 72],
+    // Body lines: warn above 100 chars (URLs and stack traces can be long).
+    'body-max-line-length': [1, 'always', 100],
+    // Uncomment to restrict scopes to your project's modules:
+    // 'scope-enum': [2, 'always', ['auth', 'checkout', 'api', 'db', 'ui', 'deps', 'release']],
+  },
+};

package/presets/node-backend/files/eslint.config.mjs

@@ -0,0 +1,38 @@
+// ESLint flat config for a Node.js + TypeScript backend.
+// Rules here back up the backend-architecture-principles and backend-security skills.
+import js from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import prettier from 'eslint-config-prettier';
+
+export default [
+  { ignores: ['dist', 'build', 'coverage', 'node_modules', 'CHANGELOG.md'] },
+
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+
+  {
+    files: ['**/*.{js,mjs,cjs,ts,mts,cts}'],
+    languageOptions: {
+      globals: { ...globals.node },
+    },
+    rules: {
+      // TypeScript
+      '@typescript-eslint/no-explicit-any': 'warn',
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+
+      // General
+      eqeqeq: ['error', 'always'],
+      'no-console': ['warn', { allow: ['warn', 'error'] }], // use the app logger
+      'no-eval': 'error',
+      'no-implied-eval': 'error',
+      'no-new-func': 'error',
+    },
+  },
+
+  // Must stay last: turns off rules that conflict with Prettier.
+  prettier,
+];

package/presets/node-backend/files/release-please-config.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": false,
+  "packages": {
+    ".": {
+      "changelog-path": "CHANGELOG.md"
+    }
+  },
+  "changelog-sections": [
+    { "type": "feat", "section": "Added" },
+    { "type": "fix", "section": "Fixed" },
+    { "type": "perf", "section": "Changed" },
+    { "type": "revert", "section": "Changed" },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "style", "section": "Styles", "hidden": true },
+    { "type": "refactor", "section": "Refactoring", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "build", "section": "Build", "hidden": true },
+    { "type": "ci", "section": "CI", "hidden": true },
+    { "type": "chore", "section": "Chores", "hidden": true }
+  ]
+}

package/presets/node-backend/fragments/agents-node-backend-github.md

@@ -0,0 +1,7 @@
+### GitHub automation (node-backend preset + github pack)
+
+| Tool | Config | Enforces |
+|---|---|---|
+| CI | `.github/workflows/ci.yml` | Lint, format check, typecheck, test, build, dependency audit |
+| release-please | `release-please-config.json`, `.release-please-manifest.json`, `.github/workflows/release-please.yml` | Version bumps, `CHANGELOG.md`, tags. Don't hand-edit `CHANGELOG.md` or version fields |
+| Dependabot | `.github/dependabot.yml` | Weekly npm and GitHub Actions updates with Conventional Commit messages |

package/presets/node-backend/fragments/agents-node-backend.md

@@ -0,0 +1,13 @@
+## Node.js backend (TypeScript)
+
+### Tooling (installed by the node-backend preset; don't work around it)
+
+| Tool | Config | Enforces |
+|---|---|---|
+| commitlint + husky `commit-msg` | `commitlint.config.mjs`, `.husky/commit-msg` | Conventional Commit format on every commit |
+| lint-staged + husky `pre-commit` | `.lintstagedrc.json`, `.husky/pre-commit` | ESLint and Prettier on staged files |
+| ESLint | `eslint.config.mjs` | TypeScript rules, Node globals, no `eval`, no stray `console` |
+| Prettier | `.prettierrc.json`, `.prettierignore` | Formatting |
+| EditorConfig | `.editorconfig` | Charset, line endings, indentation |
+
+Never bypass these (`--no-verify`, disabling rules to make a check pass). Fix the underlying issue. Setup and versions: `docs/agent-kit/node-backend.md`.

package/presets/node-backend/fragments/gitignore.txt

@@ -0,0 +1,19 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+build/
+coverage/
+
+# Environment and secrets (keep .env.example)
+.env
+.env.*
+!.env.example
+
+# Logs and OS/editor files
+*.log
+.DS_Store
+.idea/
+.vscode/*
+!.vscode/extensions.json

package/presets/node-backend/fragments/prettierignore.txt

@@ -0,0 +1,16 @@
+node_modules
+dist
+build
+coverage
+package-lock.json
+pnpm-lock.yaml
+yarn.lock
+CHANGELOG.md
+.release-please-manifest.json
+# Files agent-kit owns and compares on every install (formatting them would cause .new conflicts)
+AGENTS.md
+CLAUDE.md
+.claude/
+docs/agent-kit/
+.github/ISSUE_TEMPLATE/
+.github/pull_request_template.md

package/presets/node-backend/github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: build
+      include: scope # produces "build(deps): bump ..."
+    groups:
+      dev-dependencies:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+      include: scope

package/presets/node-backend/github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24 # adjust to your project's supported Node version
+          cache: npm
+
+      - run: npm ci
+
+      # Scripts are skipped if not defined (--if-present). Remove the flag once
+      # your project defines them, so a missing script fails the build.
+      - run: npm run lint --if-present
+      - run: npm run format:check --if-present
+      - run: npm run typecheck --if-present
+      - run: npm test --if-present
+      - run: npm run build --if-present
+
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high

package/presets/node-backend/github/workflows/release-please.yml

@@ -0,0 +1,21 @@
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+          # PRs opened with the default GITHUB_TOKEN do not trigger other workflows (e.g. CI).
+          # If you want CI to run on the release PR, create a PAT or GitHub App token
+          # and pass it here: token: ${{ secrets.RELEASE_PLEASE_TOKEN }}