create-tigra 3.1.0 → 3.2.0

package/README.md

@@ -40,7 +40,7 @@ npx create-tigra my-app
 
 ### Codex Development
 
-Includes concise Codex-native `AGENTS.md` guidance at the project root and scoped guidance inside `client/` and `server/`. Generated projects also include Cloudflare's MIT-licensed `security-audit` repository skill. Meaningful server changes must use its focused guidance and, when the Codex Security plugin is installed, complete a `security-diff-scan` of the working-tree patch before completion.
+Includes concise `AGENTS.md` guidance at the project root and scoped guidance inside `client/` and `server/`, with matching `CLAUDE.md` files that import them so Claude Code reads the same rules. Generated projects also include Cloudflare's MIT-licensed `security-audit` repository skill (in `.agents/skills/` for Codex, with a thin pointer in `.claude/skills/` for Claude Code). Meaningful server changes must use its focused guidance and, before completion, scan the working-tree patch: `security-diff-scan` when the Codex Security plugin is installed, or `/security-review` in Claude Code.
 
 The security workflow falls back to the bundled skill when Codex Security is unavailable, while full or deep repository audits remain explicit operations rather than an automatic cost on every edit.
 

package/bin/create-tigra.js

@@ -23,6 +23,7 @@ const JWT_SECRET_PLACEHOLDER = 'CHANGE_ME_generate_with_openssl_rand_hex_48';
 
 // Files that contain template variables and need replacement
 const FILES_TO_REPLACE = [
+  'AGENTS.md',
   'server/package.json',
   'server/.env.example',
   'server/docker-compose.yml',
@@ -104,10 +105,10 @@ async function copyTemplate(templateDir, targetDir) {
       continue;
     }
 
-    // The repository stores the gitignore without a leading dot so npm reliably
-    // includes it in the published template; generated projects receive the dotfile.
-    let destName = entry.name;
-    if (entry.name === 'gitignore') destName = '.gitignore';
+    // The repository stores the gitignore without a leading dot so npm reliably
+    // includes it in the published template; generated projects receive the dotfile.
+    let destName = entry.name;
+    if (entry.name === 'gitignore') destName = '.gitignore';
 
     const destPath = path.join(targetDir, destName);
 
@@ -404,7 +405,7 @@ async function main() {
           }
         }
 
-        spinner.succeed('Project scaffolded successfully!');
+        spinner.succeed('Project scaffolded successfully!');
       } catch (error) {
         spinner.fail('Failed to scaffold project');
         console.error(chalk.red(`\n  ${error.message}\n`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/.claude/skills/security-audit/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: security-audit
+description: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
+---
+
+# Security Audit (pointer)
+
+This is a thin pointer so Claude Code discovers the skill. The real skill is shared with Codex and lives in `.agents/skills/security-audit/` (vendored from Cloudflare's `security-audit-skill`; see its `SOURCE.md`). Do not copy it here, so the two agents never drift.
+
+Read `.agents/skills/security-audit/SKILL.md` in full and follow it exactly. Resolve every relative file it references (for example `HUNTING.md`, `report-schema.json`, the `validate-*.cjs` scripts) against `.agents/skills/security-audit/`, not this directory. Its "Task tool" is Claude Code's subagent mechanism.

package/template/AGENTS.md

@@ -4,6 +4,22 @@
 
 Every implementation change MUST include a human-readability pass. Add or update concise comments or doc comments for important functionality and for non-obvious contracts, invariants, edge cases, business rules, security boundaries, deployment constraints, performance choices, and workarounds. Explain why and what must remain true; do not narrate obvious syntax. Keep comments accurate and remove stale ones.
 
+<!-- project-facts:start -->
+## Project facts
+
+> Maintained by the `seed-project-facts` skill: run it once to fill the TODOs. This section is the source of truth for this project: keep it true. If your work changes any line (deployment, URLs, hosting, databases, Redis, integrations, rules), update it and the seed-plugins registry row in the same change. If it conflicts with reality, trust reality, fix it, and tell Tornike. No secrets here.
+
+- **Name:** {{PROJECT_NAME}}
+- **Purpose:** TODO
+- **Production:** TODO (client URL / server URL, or "not deployed")
+- **Hosting:** TODO (Coolify instance, or none)
+- **Local MySQL:** `{{DATABASE_NAME}}` on TODO (central-mysql | per-project container)
+- **Production MySQL:** TODO (`db` on shared MySQL on <instance> | dedicated Coolify MySQL | none)
+- **Redis:** TODO (local yes/no / production yes/no)
+- **Talks to:** TODO
+- **Special rules:** none
+<!-- project-facts:end -->
+
 ## Architecture and sources of truth
 
 - `client/` is a Next.js App Router application; `server/` is a Fastify API backed by Prisma/MySQL and Redis. They deploy independently.
@@ -11,6 +27,7 @@ Every implementation change MUST include a human-readability pass. Add or update
 - `server/prisma/schema.prisma` is the database-schema source of truth. Use Prisma migrations for schema changes.
 - `server/src/config/env.ts` and `client/src/lib/env.ts` define valid environment variables. Keep the corresponding `.env.example` files synchronized without real credentials.
 - Shared route/API constants, response helpers, and security middleware are canonical; extend them instead of creating competing shapes or duplicate policy.
+- Client font preset tokens are declared on `:root`. Apply every referenced `next/font` variable class to `<html>`, never only to `<body>`, so the root-scoped Tailwind tokens can resolve it.
 
 ## Naming
 
@@ -35,8 +52,8 @@ Every implementation change MUST include a human-readability pass. Add or update
 ## Required server security workflow
 
 - For every meaningful server implementation, bug fix, refactor, dependency update, or configuration change, use the repository-local `security-audit` skill in guidance mode while designing and reviewing the change. Treat authentication, authorization, validation, database access, outbound requests, uploads, cookies, CORS/origin handling, rate limits, environment configuration, and deployment behavior as security-sensitive surfaces.
-- Before completion, use the Codex Security plugin's `codex-security:security-diff-scan` skill to review the current working-tree patch when that plugin skill is available. Scope the review to the changed server behavior and the supporting code needed to establish impact; do not expand it into an unrelated repository audit.
-- If Codex Security is unavailable, perform an equivalent focused patch review with the bundled `security-audit` skill and explicitly report that the plugin scan was unavailable. Do not skip the security gate silently.
+- Before completion, review the current working-tree patch with the agent's own security scan when available: in Codex use the Codex Security plugin's `codex-security:security-diff-scan` skill; in Claude Code run `/security-review`. Scope the review to the changed server behavior and the supporting code needed to establish impact; do not expand it into an unrelated repository audit.
+- If that scan is unavailable, perform an equivalent focused patch review with the bundled `security-audit` skill and explicitly report that the scan was unavailable. Do not skip the security gate silently.
 - A full or deep repository audit remains explicit work: do not start one merely because ordinary server code changed. Fix confirmed in-scope findings, rerun affected checks, and disclose any unresolved or unverified security concern before claiming completion.
 - Documentation-only, comment-only, and formatting-only changes may skip the patch scan when they cannot affect runtime behavior, permissions, deployment, or security policy.
 

package/template/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/client/AGENTS.md

@@ -12,6 +12,7 @@
 - Server-rendered page data belongs in Server Components; client-fetched server data belongs in React Query; Redux is limited to the authenticated-user lifecycle; local and URL state stay local or in search params.
 - `src/lib/constants/routes.ts` and `api-endpoints.ts` own application and API paths.
 - `src/styles/themes/default.css` owns color values. Components use semantic Tailwind tokens; do not hardcode palette values or create competing theme variables.
+- If a `next/font` CSS variable is referenced by a token declared on `:root`, apply that font's generated variable class to `<html>`. Never attach it only to `<body>`, where it cannot resolve the root-scoped token.
 - `src/middleware.ts` is the single source of truth for security headers and nonce-based CSP. Do not add a second CSP in `next.config.ts`.
 
 ## Security and deployment

package/template/client/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/client/src/app/layout.tsx

@@ -40,8 +40,15 @@ export default async function RootLayout({
   const nonce = (await headers()).get('x-nonce') ?? undefined;
 
   return (
-    <html lang="en" suppressHydrationWarning>
-      <body className={`${inter.variable} ${jetbrainsMono.variable} font-sans antialiased`}>
+    // The font preset consumes these next/font variables from :root. Keep the
+    // generated classes on <html>; variables introduced only on <body> cannot
+    // resolve the root-scoped Tailwind font tokens.
+    <html
+      lang="en"
+      className={`${inter.variable} ${jetbrainsMono.variable}`}
+      suppressHydrationWarning
+    >
+      <body className="font-sans antialiased">
         <Providers nonce={nonce}>{children}</Providers>
       </body>
     </html>

package/template/client/src/styles/fonts/inter-jetbrains.css

@@ -5,8 +5,10 @@
  *
  * To switch fonts:
  * 1. Update the font imports in layout.tsx (next/font/google)
- * 2. Create a new preset file (or edit this one) with matching font-family names
- * 3. Update the import in globals.css to point to your preset
+ * 2. Apply every referenced next/font variable class to <html>, because these
+ *    preset tokens are declared on :root and cannot resolve body-only variables
+ * 3. Create a new preset file (or edit this one) with matching font-family names
+ * 4. Update the import in globals.css to point to your preset
  */
 
 :root {

package/template/server/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md