create-ec-app 1.7.0 → 1.9.0

package/templates/base/package.json

@@ -8,36 +8,31 @@
 		"build": "tsc -b && vite build",
 		"build:dev": "tsc -b && vite build --mode development",
 		"lint": "eslint .",
-		"preview": "vite preview",
-		"format": "biome format --write .",
-		"lint:biome": "biome lint .",
-		"check": "biome check --write --no-errors-on-unmatched .",
-		"format:check": "biome format --check .",
-		"lint:fix": "biome lint --apply ."
+		"preview": "vite preview"
 	},
 	"dependencies": {
-		"@tailwindcss/vite": "^4.3.0",
-		"tailwindcss": "^4.3.0",
-		"@tanstack/react-query": "^5.100.14",
+		"@tailwindcss/vite": "^4.3.1",
+		"@tanstack/react-query": "^5.101.2",
 		"@types/xrm": "^9.0.94",
 		"react": "^19.2.7",
 		"react-dom": "^19.2.7",
+		"tailwindcss": "^4.3.1",
 		"zod": "^4.4.3",
 		"zustand": "^5.0.14"
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
-		"@tanstack/eslint-plugin-query": "^5.100.14",
-		"@types/node": "^24.12.4",
-		"@types/react": "^19.2.16",
+		"@tanstack/eslint-plugin-query": "^5.101.2",
+		"@types/node": "^22.20.0",
+		"@types/react": "^19.2.17",
 		"@types/react-dom": "^19.2.3",
-		"@vitejs/plugin-react": "^6.0.2",
-		"eslint": "^10.4.1",
+		"@vitejs/plugin-react": "^6.0.3",
+		"eslint": "^10.6.0",
 		"eslint-plugin-react-hooks": "^7.1.1",
-		"eslint-plugin-react-refresh": "^0.5.2",
-		"globals": "^17.6.0",
-		"typescript": "~6.0.3",
-		"typescript-eslint": "^8.60.1",
-		"vite": "^8.0.16"
+		"eslint-plugin-react-refresh": "^0.5.3",
+		"globals": "^17.7.0",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.62.0",
+		"vite": "^8.1.0"
 	}
 }

package/templates/pcf/base/package-lock.json

@@ -124,9 +124,9 @@
       }
     },
     "node_modules/@azure/opentelemetry-instrumentation-azure-sdk/node_modules/@opentelemetry/core": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.7.1.tgz",
-      "integrity": "sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.8.0.tgz",
+      "integrity": "sha512-hd1Lfh8p545nNz+jq1Ejfz+Mn1hyLuxYn1YzTfFNrxr8urEWMNQLPf1Th8kjOH+HxwawCrtgBp8JpBUR4ZSgww==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2277,14 +2277,14 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.7.1.tgz",
-      "integrity": "sha512-K806OouCSOjMd8Nr7+ZCq3QT22tdAzzS/7h8vprfiKjkgFQ99/dvwU8d12WJANA6D5Qtme65hyBAqAu9CkQuxQ==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.8.0.tgz",
+      "integrity": "sha512-P3ZM8BGJ5mwjtyfAxRyxsCyWHvaj+xahdhLoS3YiPsEyTHcWTVzx2691C8SrGkpvro3tNFCsWuNNrvM+spKODg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.7.1",
-        "@opentelemetry/sdk-trace-base": "2.7.1"
+        "@opentelemetry/core": "2.8.0",
+        "@opentelemetry/sdk-trace-base": "2.8.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -2294,9 +2294,9 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/core": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.7.1.tgz",
-      "integrity": "sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.8.0.tgz",
+      "integrity": "sha512-hd1Lfh8p545nNz+jq1Ejfz+Mn1hyLuxYn1YzTfFNrxr8urEWMNQLPf1Th8kjOH+HxwawCrtgBp8JpBUR4ZSgww==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2310,13 +2310,13 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/resources": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.7.1.tgz",
-      "integrity": "sha512-DeT6KKolmC4e/dRQvMQ/RwlnzhaqeiFOXY5ngoOPJ07GgVVKxZOg9EcrNZb5aTzUn+iCrJldAgOfQm1O/QfPAQ==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.8.0.tgz",
+      "integrity": "sha512-qmXQ27ilDbUK/vGMqwL8D4/rhn76C+sherM4wTbjlfknR8Nvfc/hCxjRJPhkzZzUsPiNg16SA31NxMabwttRjg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/core": "2.8.0",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -2327,14 +2327,14 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.7.1.tgz",
-      "integrity": "sha512-NAYIlsF8MPUsKqJMiDQJTMPOmlbawC1Iz/omMLygZ1C9am8fTKYjTaI+OZM+WTY3t3Glo0wnOg/6/pac6RGPPw==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.8.0.tgz",
+      "integrity": "sha512-mhU4jp+vW0mGbFRd+GeXHvmfA4aDqWjBjLC3pE5XMpLs0IE2ryYb019Ts2AQrOq67gaTF25D91+fgvEHDZEnuQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.7.1",
-        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/core": "2.8.0",
+        "@opentelemetry/resources": "2.8.0",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -2483,9 +2483,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2507,9 +2504,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2531,9 +2525,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2555,9 +2546,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2579,9 +2567,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2603,9 +2588,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4094,9 +4076,9 @@
       }
     },
     "node_modules/engine.io": {
-      "version": "6.6.8",
-      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.8.tgz",
-      "integrity": "sha512-2agL3ueZhqxoVrfmntO8yuVj+uNSlIOnhykYHk3Cq0ShYPdUjjUiSJrQvXjq01I9jAuI0Zl2YO8Evv5Mqytm5g==",
+      "version": "6.6.9",
+      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.9.tgz",
+      "integrity": "sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4109,23 +4091,23 @@
         "cors": "~2.8.5",
         "debug": "~4.4.1",
         "engine.io-parser": "~5.2.1",
-        "ws": "~8.20.1"
+        "ws": "~8.21.0"
       },
       "engines": {
         "node": ">=10.2.0"
       }
     },
     "node_modules/engine.io-client": {
-      "version": "6.6.5",
-      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.5.tgz",
-      "integrity": "sha512-QCwxUDULPlXv8F6tqMMKx5dNkTe6OaBYRMPYeXKBlyOoKvAmE0ac6pW7fFhSscJ/5SI7666/U/B+MElbsrJlIg==",
+      "version": "6.6.6",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.6.tgz",
+      "integrity": "sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@socket.io/component-emitter": "~3.1.0",
         "debug": "~4.4.1",
         "engine.io-parser": "~5.2.1",
-        "ws": "~8.20.1",
+        "ws": "~8.21.0",
         "xmlhttprequest-ssl": "~2.1.1"
       }
     },
@@ -6439,14 +6421,14 @@
       }
     },
     "node_modules/socket.io-adapter": {
-      "version": "2.5.7",
-      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.5.7.tgz",
-      "integrity": "sha512-e0LyK91f3cUxTmv95/KzoLg47+zF+s/sbxRGDNsyG4dmIP8ZSX8ax6byOxfJXeNNtS/8AZlfD+uP7gBeR7DLlg==",
+      "version": "2.5.8",
+      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.5.8.tgz",
+      "integrity": "sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "debug": "~4.4.1",
-        "ws": "~8.20.1"
+        "ws": "~8.21.0"
       }
     },
     "node_modules/socket.io-client": {
@@ -7173,9 +7155,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "dev": true,
       "license": "MIT",
       "engines": {

package/templates/targets/code-apps/AGENTS.md

@@ -0,0 +1,187 @@
+## Purpose
+
+This repository is a Power Apps code app using React, TypeScript, Vite, and the Power Apps code app SDK.
+
+Treat it as a Power Apps-hosted code app, not a Dynamics web resource. Keep it small, readable, and easy to push with the Power Apps tooling.
+
+Use the global AGENTS.md rules first. This file adds project-specific constraints.
+
+## Hard Constraints
+
+- Keep Power Apps code app hosting working.
+- Keep local Power Apps play support working.
+- Keep generated connector and Dataverse service access working.
+- Keep the app client-side.
+- Make surgical changes.
+
+Do not add Dynamics `Xrm`, `token.json`, Power Pages ADAL, Static Web Apps routing, or direct Dataverse Web API auth patterns unless the target changes.
+
+## Runtime Modes
+
+The app supports two modes.
+
+### Power Apps-hosted
+
+- The Power Apps host manages end-user authentication, app loading, and runtime context.
+- Use `@microsoft/power-apps` APIs when app, environment, user, host, or query-parameter context is needed.
+- Use generated models and services for Dataverse and connector access.
+- Preserve `power.config.json` semantics after `npx power-apps init`.
+- Do not assume model-driven app `window.Xrm` context exists.
+
+### Local dev
+
+- Run Vite through `npm run dev`.
+- Open the Local Play URL printed by the Power Apps Vite plugin.
+- Use the same browser profile as the target Power Platform tenant.
+- Run `npx power-apps init` before real push/data-source work.
+- Treat `power.config.example.json` as documentation only; do not rename it to bypass initialization.
+
+Do not mix this with webresource `AuthService.ts`, `token.json`, or Power Pages `AuthContext`.
+
+## Critical Files
+
+| File | Rule |
+|---|---|
+| `vite.config.ts` | Preserve `powerApps()` plus React, Tailwind, and alias config. |
+| `power.config.json` | Generated by `npx power-apps init`; environment-specific app metadata and data references live here. |
+| `power.config.example.json` | Reference only. Do not make it the real config before initialization. |
+| `src/generated/models/*` | Generated data-source models. Do not hand-edit unless the generator output is known wrong. |
+| `src/generated/services/*` | Generated service methods for Dataverse/connectors/actions/functions. Prefer these over custom clients. |
+| `src/main.tsx` | Preserve bootstrap, providers, and global theme/style imports. |
+
+## API and Data Access
+
+Prefer generated Power Apps services.
+
+Use:
+
+- `npx power-apps add-data-source` for Dataverse and connector data sources
+- `npx power-apps add-dataverse-api` for Dataverse actions/functions
+- generated service methods from `src/generated/services`
+- generated model types from `src/generated/models`
+- `getContext` from `@microsoft/power-apps/app` when host context is needed
+- narrow `select` options when generated Dataverse services support them
+- clear errors when generated calls fail
+
+Avoid:
+
+- direct browser calls to Dataverse Web API
+- copied webresource `getApiUrl()` / `getAuthHeaders()` helpers
+- manually maintained connector clients
+- wrapping every generated service in another generic service layer
+- repository/client layers for small features
+- Zod schemas for every generated response
+- silent fallbacks for failed connector or Dataverse calls
+
+For known data sources, use the generated service for that source. Add a new data source only when the current feature needs it.
+
+## Validation
+
+Use generated TypeScript models for normal connector and Dataverse response shapes.
+
+Use runtime validation only when the current feature needs it, such as:
+
+- user-entered form data
+- URL/query parameters that control behavior
+- data sent to create/update/delete operations
+- genuinely variable connector data where the UI must branch safely
+- security-sensitive or data-loss-prone paths
+
+Do not validate values just because they are shaped like GUIDs, logical names, dates, URLs, or enum strings. If the generated service or platform will reject the value clearly and there is no local UX/security need, pass it through.
+
+Do not normalize strings by default. Trim, lowercase, strip braces, or reformat only when the app has a known input source that sends multiple formats.
+
+## Services, Queries, and Mutations
+
+Keep service files explicit.
+
+Preferred shape:
+
+- call the generated service directly from a small domain service when naming the operation helps
+- one TanStack Query hook when components need query state
+- one mutation hook when mutation state or invalidation is needed
+- query keys colocated with the hook when reused for invalidation
+
+Do not create wrapper chains such as:
+
+```text
+resolveConfig -> normalizeInput -> validateInput -> resolveGeneratedService -> buildRequest -> executeRequest
+```
+
+Prefer direct flow:
+
+```text
+call generated service -> check result/error -> return typed data
+```
+
+## State Management
+
+- Use TanStack Query for server/connector state.
+- Use local component state for local UI behavior.
+- Use Zustand only for shared client state that has outgrown local state.
+- Do not store server state in Zustand.
+- Do not add Redux unless explicitly requested.
+
+## UI and Styling
+
+Stay consistent with the project's existing UI system.
+
+- Shadcn/ui projects: use existing `@/components/ui` components and Tailwind utilities.
+- Kendo projects: use Kendo React components for rich controls and Tailwind for layout/composition.
+- Preserve the existing theme and global CSS imports.
+- Do not mix UI systems unless explicitly asked.
+- Do not hand-roll custom CSS unless component props and Tailwind are not enough.
+- Keep layouts compact, scannable, responsive, and suitable for Power Apps hosting.
+
+## Code Shape
+
+Prefer:
+
+- focused React components
+- direct typed functions
+- existing generated services and components
+- small local helpers only when they remove real duplication or name non-obvious domain logic
+- explicit connector/table/action handling over generic frameworks
+
+Avoid:
+
+- broad factories
+- generic service clients
+- classes for simple service logic
+- excessive configuration
+- defensive wrappers around every value
+- broad refactors while adding a feature
+
+## Error Handling
+
+Connector calls, Dataverse reads/saves/deletes, auth/context failures, uploads, downloads, and required parsing failures should throw.
+
+Do not swallow failed generated service calls and treat them as empty data unless the requirement explicitly says the feature is best-effort.
+
+Include useful operation context and platform error text where practical.
+
+## Build and Deployment
+
+Do not replace Vite, remove `powerApps()`, add SSR, add Next.js, or change the app into a webresource/Power Pages/SWA deployment unless explicitly asked.
+
+Use `npm run build` for production assets and `npx power-apps push` for the npm CLI path. Use PAC CLI only when a required option is not available through the npm CLI.
+
+## Checks
+
+Run the smallest relevant command for the changed area, such as:
+
+- typecheck
+- lint
+- targeted tests
+- Vite build when deployment shape could be affected
+- local Power Apps play smoke test when SDK/plugin/data-source behavior changes
+
+Do not run broad expensive checks unless the change touches shared infrastructure or the project requires it.
+
+## Figma MCP
+
+When using the Figma MCP server, ensure that you are not just blindly copying the designs. Take note and always place a focus on the following:
+
+- Ensure responsiveness on all screen sizes
+- If there are icons as part of the design, use those, don't blindly look for Lucide-React equivalents.
+- Use the exact colours in the design. Don't make up your own.

package/templates/targets/code-apps/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/targets/code-apps/package.patch.json

@@ -1,6 +1,6 @@
 {
 	"dependencies": {
-		"@microsoft/power-apps": "^1.1.9"
+		"@microsoft/power-apps": "^1.2.2"
 	},
 	"devDependencies": {
 		"@microsoft/power-apps-vite": "^1.0.2"

package/templates/targets/power-pages/AGENTS.md

@@ -0,0 +1,192 @@
+## Purpose
+
+This repository is a Power Pages single-page application using React, TypeScript, and Vite.
+
+Treat it as a Power Pages code site. Keep it small, readable, and easy to upload to Power Pages.
+
+Use the global AGENTS.md rules first. This file adds project-specific constraints.
+
+## Hard Constraints
+
+- Keep Power Pages code-site deployment working.
+- Keep Power Pages `_api` access working.
+- Keep local Vite development working.
+- Keep the app client-side.
+- Make surgical changes.
+
+Do not add Dynamics `Xrm`, `token.json`, Static Web Apps routing, or Power Apps code app SDK patterns unless the target changes.
+
+## Runtime Modes
+
+The app supports two modes.
+
+### Power Pages-hosted
+
+- Run as a browser SPA hosted by Power Pages.
+- Use Power Pages `_api` for Dataverse access from the site.
+- Rely on Power Pages web roles, table permissions, and site settings for data authorization.
+- Preserve code-site build output and `powerpages.config.json`.
+- Do not call the Dataverse organization Web API directly from the browser.
+- Do not assume `window.Xrm` or model-driven app context exists.
+
+### Local dev
+
+- Use Vite for local UI development.
+- Use the existing Vite `/_api` proxy when local code needs to call a Power Pages site.
+- Keep the proxy target explicit and environment-specific.
+- Use the existing `AuthContext` flow only where this template already requires it.
+- Never commit client secrets, tenant-specific secrets, or real token values.
+
+Do not mix Power Pages auth with webresource `AuthService.ts` or `token.json`.
+
+## Critical Files
+
+| File | Rule |
+|---|---|
+| `src/context/AuthContext.tsx` | Current auth boundary for this template. Reuse it; do not add a second auth system. |
+| `src/main.tsx` | Preserve `AuthProvider`, `QueryClientProvider`, bootstrap, and global style imports. |
+| `vite.config.ts` | Preserve React, Tailwind, alias, and the `/_api` dev proxy when API calls are used locally. |
+| `powerpages.config.json` | Power Pages code-site configuration. Keep compiled path and landing page accurate. |
+| `src/App.tsx` | Keep app behavior client-side and provider-aware. |
+
+## API and Data Access
+
+Prefer direct, boring Power Pages Web API calls.
+
+Use:
+
+- relative `_api/...` URLs
+- the existing auth context only where the current template flow already uses it
+- Power Pages request verification/CSRF handling where the portal Web API requires it
+- Power Pages table permissions and web roles for authorization
+- narrow `$select` queries
+- `URLSearchParams` for normal query parameters
+- direct `fetch` inside service files
+- small TypeScript interfaces for response shapes
+- clear `response.ok` checks with useful status text
+
+Avoid:
+
+- direct calls to `https://<org>.crm*.dynamics.com/api/data/v9.2` from the browser
+- duplicated auth contexts
+- raw fetch calls inside UI components
+- repository/client layers for small features
+- generic OData builders
+- Zod schemas for every Power Pages response
+- GUID or logical-name regex validation by default
+- silent fallbacks for failed Power Pages calls
+
+For known tables, use known entity set names. Fetch metadata only when the feature truly supports arbitrary table names.
+
+Escape OData string literals when interpolating inside quoted OData expressions. Do not create a broad escaping/parsing layer for simple queries.
+
+## Validation
+
+Use TypeScript types for normal Power Pages Web API response shapes.
+
+Use runtime validation only when the current feature needs it, such as:
+
+- user-entered form data
+- URL/search parameters that control behavior
+- local config that can be wrong
+- genuinely variable API data where the UI must branch safely
+- security-sensitive or data-loss-prone paths
+
+Do not validate values just because they are shaped like GUIDs, logical names, dates, URLs, or enum strings. If Power Pages or Dataverse will reject the value clearly and there is no local UX/security need, pass it through.
+
+Do not normalize strings by default. Trim, lowercase, strip braces, or reformat only when the app has a known input source that sends multiple formats.
+
+## Services, Queries, and Mutations
+
+Keep service files explicit.
+
+Preferred shape:
+
+- one fetch/save function for the operation
+- one TanStack Query hook when components need it
+- one mutation hook when mutation state or invalidation is needed
+- query keys colocated with the hook when reused for invalidation
+
+Do not create wrapper chains such as:
+
+```text
+resolveConfig -> normalizeInput -> validateInput -> resolveMetadata -> buildRequest -> executeRequest
+```
+
+Prefer direct flow:
+
+```text
+read auth/context -> fetch -> check response -> return typed data
+```
+
+## State Management
+
+- Use TanStack Query for server state.
+- Use local component state for local UI behavior.
+- Use Zustand only for shared client state that has outgrown local state.
+- Do not store server state in Zustand.
+- Do not add Redux unless explicitly requested.
+
+## UI and Styling
+
+Stay consistent with the project's existing UI system.
+
+- Shadcn/ui projects: use existing `@/components/ui` components and Tailwind utilities.
+- Kendo projects: use Kendo React components for rich controls and Tailwind for layout/composition.
+- Preserve the existing theme and global CSS imports.
+- Do not mix UI systems unless explicitly asked.
+- Do not hand-roll custom CSS unless component props and Tailwind are not enough.
+- Keep layouts compact, scannable, responsive, and suitable for Power Pages.
+
+## Code Shape
+
+Prefer:
+
+- focused React components
+- direct typed functions
+- existing auth, services, and components
+- small local helpers only when they remove real duplication or name non-obvious domain logic
+- explicit Power Pages table/field handling over generic frameworks
+
+Avoid:
+
+- broad factories
+- generic service clients
+- classes for simple service logic
+- excessive configuration
+- defensive wrappers around every value
+- broad refactors while adding a feature
+
+## Error Handling
+
+Power Pages reads, saves, deletes, uploads, downloads, auth failures, and required parsing failures should throw.
+
+Do not swallow failed fetches and treat them as "not found" unless the requirement explicitly says the feature is best-effort.
+
+Include response status and useful response text where practical.
+
+## Build and Deployment
+
+Do not replace Vite, add SSR, add Next.js, change the code-site output shape, or introduce backend coupling unless explicitly asked.
+
+Keep output deployable through the Power Pages code-site flow and keep `powerpages.config.json` aligned with the built `dist` folder.
+
+## Checks
+
+Run the smallest relevant command for the changed area, such as:
+
+- typecheck
+- lint
+- targeted tests
+- Vite build when deployment shape could be affected
+- local `/_api` proxy smoke test when API routing changes
+
+Do not run broad expensive checks unless the change touches shared infrastructure or the project requires it.
+
+## Figma MCP
+
+When using the Figma MCP server, ensure that you are not just blindly copying the designs. Take note and always place a focus on the following:
+
+- Ensure responsiveness on all screen sizes
+- If there are icons as part of the design, use those, don't blindly look for Lucide-React equivalents.
+- Use the exact colours in the design. Don't make up your own.

package/templates/targets/power-pages/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md