AGENTS.md examples that explain the difference.

# Repository instructions

This repository is a user-facing web application built with React, TypeScript, and a server-side API. Preserve existing route, component, data-access, authentication, and design-system patterns.

## Start here

- Read the target route, component, server handler, schema, and tests before editing.
- Reuse installed UI primitives, tokens, and data clients before adding alternatives.
- Keep the change scoped to the requested user flow.
- Preserve user changes, the package manager, and the existing lockfile.

## Commands

- `pnpm install --frozen-lockfile`: install dependencies.
- `pnpm dev`: start the local application.
- `pnpm test`: run tests.
- `pnpm lint`: run lint checks.
- `pnpm build`: type-check and create the production build.

## Interface rules

- Use semantic HTML and accessible names for every interactive control.
- Preserve keyboard access, visible focus, readable contrast, reduced motion, and narrow-screen layouts.
- Include loading, empty, error, disabled, and success states when the flow can reach them.
- Keep client state close to its consumer and derive values during render when possible.

## Server, data, and security

- Validate untrusted input and enforce authorization at the server boundary.
- Do not expose secrets, internal errors, or personal data in client bundles, responses, or logs.
- Reuse established transaction and data-access patterns.
- Do not create or apply migrations unless the task explicitly includes a reviewed schema change.

## Validation

- Add focused coverage for the changed success and failure branches.
- Run the narrowest relevant test first, then lint and the production build.
- Verify the complete browser-to-server-to-data flow when a feature crosses those boundaries.

## Definition of done

- The requested flow works end to end with keyboard, pointer, and touch where relevant.
- Tests, lint, types, and the production build pass.
- Authorization and data behavior are correct for both allowed and denied users.
- The handoff states the behavior changed, checks run, and any deployment or migration risk.