@inbeat/standards 0.7.0

package/template/.agents/skills/ib-toolkit/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: ib-toolkit
+description: Use the inBeat toolkit (@inbeat/core, @inbeat/next, @inbeat/config) correctly in an inBeat app. Use when writing server actions, route handlers, auth checks, env, rate limits, webhooks, Sentry or logging, or when the user mentions ib-toolkit or @ib-toolkit.
+---
+
+# ib-toolkit
+
+Read the "inBeat toolkit standard" block in `AGENTS.md` first. This skill is the how-to. Examples use `authorizeStaff` as a stand-in for the app's own `authorize` check; public endpoints use `publicAccess` plus a rate limiter.
+
+## Server action
+
+```ts
+"use server";
+import { ok } from "@inbeat/core/result";
+import { action } from "@inbeat/next/action";
+import { authorizeStaff } from "@/shared/lib/auth";
+import { createClientSchema } from "../schemas";
+import { createClientRecord } from "../server/create-client-record";
+
+export const createClient = action({
+  name: "clients.create",
+  schema: createClientSchema,
+  authorize: authorizeStaff,
+  run: async (input, viewer) => ok(await createClientRecord(input, viewer.userId)),
+  revalidate: () => ["/clients"],
+});
+```
+
+Client side: `const result = await createClient(values); if (!result.ok) toast.error(result.error);`
+
+Public action: `authorize: publicAccess`, then first thing in `run`:
+`await rateLimiter.enforce(\`apply:${clientIp(await headers())}\`, { limit: 5, window: "10 m" })`.
+The limiter is one shared instance in `src/shared/lib/rate-limit.ts` (`createRateLimiter({ prefix, upstash })`
+with the `upstashEnv` values) imported by every action and route. Get the IP only from `clientIp` in
+`@inbeat/next/rate-limit` (routes pass `request.headers`); never write your own header parsing.
+`clientIp` is reliable on Vercel only; self-hosted apps behind a proxy pass `{ trustedProxyHops: n }`,
+otherwise it returns `"unknown"`. Public forms using Turnstile without Clerk must add its hosts via
+`securityHeaders({ sources: { script: ["https://challenges.cloudflare.com"], frame: ["https://challenges.cloudflare.com"] } })`.
+
+## Route handler
+
+```ts
+import { route } from "@inbeat/next/route";
+export const GET = route({
+  name: "clients.list",
+  authorize: authorizeStaff,
+  query: z.object({ cursor: z.string().optional() }),
+  handler: async ({ query }) => listClients(query.cursor),
+});
+```
+
+## Errors
+
+- Deny: `throw new AppError("forbidden", "reason for logs")`. The user sees safe default copy.
+- Expected business failure: `return fail("That handle is taken", "conflict")`.
+- Anything else: let it throw. The wrapper classifies, reports to Sentry and returns `ERR_xxxx`.
+- Postgres: `isUniqueViolation(err)` from `@inbeat/core/errors`, never string matching.
+
+## Authorization
+
+`authorize` is the app's own check: it returns the viewer or throws `AppError("auth" | "forbidden")`. Roles, admin rules and ownership are app decisions; write them in the app (for example `src/shared/lib/auth.ts`) and pass them to `action()` and `route()`.
+
+## Integrations
+
+Sentry is already wired in the template.
+
+Run `ib mcp` to give your AI tool access to Vercel, GitHub, Sentry, Neon, Clerk, Cloudflare.
+
+### Auth (Clerk)
+
+1. Run `npx -y clerk@latest init` (works with `bunx`). It detects Next.js and applies Clerk's setup; `npx -y clerk@latest doctor` verifies it.
+2. In `proxy.ts`, exclude `/monitoring` (the Sentry tunnel) from the matcher, and keep `/api/health` and `/robots.txt` public.
+3. Pass `clerkFrontendApi(process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY)` to `securityHeaders` (the base `next.config.ts` already does).
+4. Add `clerkServerEnv` and `clerkClientEnv` from `@inbeat/core/env` to `src/shared/config/env.ts` (see Env below).
+
+Access pattern. Clerk's development and production instances are configured separately: apply every
+dashboard step to both.
+
+- Who gets in: a staff-only app turns on the Clerk allowlist (`*@inbeat.agency`, …). It only blocks
+  new sign-ups, so review existing users once after enabling it. Apps with external users keep
+  sign-ups open and rely on roles.
+- Roles: `publicMetadata.role`, assigned in the Clerk dashboard (users cannot edit it). Expose it
+  with the session token claim `{"metadata": "{{user.public_metadata}}"}`, read it from
+  `sessionClaims.metadata.role`. No role or an unknown one means no access.
+- Checks run on the server, twice: the proxy requires sign-in outside the public routes and blocks
+  role-gated areas; every role-gated page, action and route checks again (`authorize`). Hiding UI
+  is not access control.
+- Stays in the app: users table (if joins need it), ownership ("owner or admin"), rate limits,
+  maintenance mode.
+- Deviation: deriving a role from a verified email domain is allowed when the app documents it in
+  AGENTS.md "Deliberate deviations".
+
+### Database (Neon + Drizzle)
+
+1. Run `npx neon@latest init` to link the Neon project and install the agent tooling.
+2. Set up Drizzle per its Neon guide: `drizzle-orm`, `@neondatabase/serverless`, `drizzle-kit`, and a `drizzle.config.ts` with `dialect: "postgresql"`.
+3. Conventions from the standard's Data section: tables in `src/db/schema/<table>.ts`, UUID primary keys, migrations generated with `drizzle-kit generate` and reviewed, and never run migrations or destructive SQL against production.
+
+## Env
+
+```ts
+import { createEnv } from "@t3-oss/env-nextjs";
+import { clerkClientEnv, clerkServerEnv, dbEnv, upstashEnv } from "@inbeat/core/env";
+export const env = createEnv({
+  server: { ...dbEnv, ...clerkServerEnv, ...upstashEnv },
+  client: { ...clerkClientEnv },
+  experimental__runtimeEnv: { NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY },
+  emptyStringAsUndefined: true,
+});
+```
+
+## Other building blocks
+
+| Need | Import |
+|---|---|
+| Neon pool | `createDb` from `@inbeat/next/db` |
+| Clerk webhook | `createClerkWebhookHandler` from `@inbeat/next/clerk-webhook` |
+| Headers/CSP | `securityHeaders`, `clerkFrontendApi` from `@inbeat/next/security-headers` |
+| Sentry | `sentryServerOptions` from `@inbeat/next/sentry` (server, edge); `sentryClientOptions` from `@inbeat/next/sentry-client` (browser only) |
+| Redirect param | `safeRedirectPath` from `@inbeat/next/safe-redirect` |
+
+## Changing the toolkit
+
+Edit `~/Desktop/@inbeat/ib-toolkit`, run its tests, then `bun run sync <app-dir>` there to copy
+the sources into the app's `node_modules/@inbeat/*` (use `--watch` while iterating).

package/template/.agents/skills/ib-ui/SKILL.md

@@ -0,0 +1,155 @@
+---
+name: ib-ui
+description: Build UI in an inBeat app with @inbeat/ui primitives and tokens. Use when creating or editing components, pages, dialogs, tables, forms, empty states, or when the user mentions ib-ui or @ib-ui.
+---
+
+# ib-ui
+
+## Before writing any UI
+
+Check the [Catalog](#catalog). Build pages and domain compositions only from catalog components
+and tokens. Icons are always `lucide-react`.
+
+**Allowed in the app**: page layouts and domain compositions (a `CreatorCard` from `Avatar` +
+`Badge`) in `src/shared/components/blocks` or the feature's `components/`. Different apps may
+compose different layouts.
+
+**Not allowed**: new generic primitives or variants (a local button, modal, select, table or
+toast), copying or restyling a toolkit component, faking a variant with override classes,
+installing another UI library, running `shadcn add`.
+
+**Missing component**: stop. Tell the user which component or variant is missing and why, and
+propose adding it to ib-toolkit (`packages/ui` plus its story). Only with the user's explicit
+agreement, use a workaround and mark it `// toolkit-gap: <what is missing>` so it is greppable.
+
+## Rules
+
+- Import `@inbeat/ui/components/<name>`; `cn` from `@inbeat/ui/lib/utils`.
+- Tokens only: `bg-background`, `text-muted-foreground`, `border-border`, `bg-primary`, radius
+  scale `rounded-{sm..4xl}`, shadows `shadow-hairline|subtle|elevated`. No hex colors, no
+  arbitrary spacing unless no token fits.
+- App shells: `AppShell` + `AppNav`, never Sidebar primitives. Links come in via `renderLink`;
+  app sidebar content goes in the `sidebar` slot. Products differ only through `AppShell` props
+  (`variant`, `collapsible`, `sidebarWidth`, `headerVariant`), never classes or local shell markup.
+- Variants are only the ones an app uses. `Button`: default, secondary, outline, ghost, link,
+  dots; sizes xs, sm, default, lg, icon*; always `rounded-full`, no destructive variant.
+  `Badge`: default, secondary, outline. `TabsList` is pills only.
+- Tabs: `Tabs` + `TabsList tabs={[{ value, label, count? }]}` + `TabsContent`; drop
+  `TabsContent` for a filter bar.
+- Destructive flows open `DestructiveActionDialog` (owns the confirm step; `variant="typed"`
+  makes the user type `DELETE <name>`). Confirm never closes it: call `onOpenChange(false)` on
+  success, so a pending or failed action keeps it open.
+- Action menus: `Button variant="dots"` + `DropdownMenu`. Inside an element with `data-row` it
+  reveals on row hover; elsewhere it stays visible.
+- Icon-only buttons are `IconButton` (required `label` = tooltip + `aria-label`), except `dots`.
+  It works as a `DropdownMenuTrigger asChild` child; with `asChild` it renders a link. Show/hide
+  toggles: `label="Show filters" pressedLabel="Hide filters" pressed={isOpen}`; `pressed` owns the
+  look. Menu and popover triggers are not toggles: static label, no `pressed`.
+- Labels are one to three words, no ids or emails.
+- Lists: `DataTableShell` + `DataTable`. With no data render `EmptyState` instead of the table;
+  DataTable's "No results." is only for an empty filter result.
+- Forms (client leaf): `schema.safeParse(values)` with the schema shared with the action; on
+  failure keep one message per field from `issues` (`issue.path[0]`). Per field:
+  `<Field data-invalid={Boolean(errors.name)}><Label/><Input aria-invalid={Boolean(errors.name)}
+  aria-describedby="name-error"/><FieldError id="name-error">{errors.name}</FieldError></Field>`.
+  On success `const result = await action(parsed.data)`; `if (!result.ok) toast.error(result.error)`
+  (`sonner`; `result.errorId` when present is the support reference).
+- Animation: `motion/react` only, respecting `prefers-reduced-motion`.
+- `page.tsx` stays a Server Component (title, layout, data loading); only the stateful leaf (a
+  table with dialogs, a form) is `"use client"`.
+
+## Catalog
+
+Every module of `@inbeat/ui`, imported as `@inbeat/ui/<path>`.
+
+### Actions
+- `components/button` — Button with variants, sizes and `buttonVariants` for link styling.
+- `components/icon-button` — icon-only Button with a required label, tooltip and toggle state.
+
+### Forms
+- `components/field` — Field, FieldLabel, FieldDescription, FieldError, FieldGroup, FieldSet and friends for form layout.
+- `components/label` — accessible form Label.
+- `components/input` — text Input.
+- `components/textarea` — multi-line Textarea.
+- `components/checkbox` — Checkbox.
+- `components/select` — single-choice Select.
+- `components/combobox` — searchable Combobox with chips for multiple values.
+- `components/multi-select-popover` — popover multi-select over a list of options.
+- `components/toggle-pills` — pill buttons toggling a set of string options, for filters.
+- `components/input-group` — Input or Textarea with inline addons, buttons and text.
+- `components/search-input` — controlled search Input with a loading state.
+- `components/calendar` — date Calendar (react-day-picker) in the toolkit style.
+
+### Display
+- `components/avatar` — Avatar, AvatarImage, AvatarFallback, AvatarGroup and AvatarGroupCount.
+- `components/person-identity` — PersonAvatar, PersonName and PersonIdentity for a person's image and name.
+- `components/member-avatar-stack` — overlapping avatars of up to three members plus a remainder count.
+- `components/badge` — Badge chip.
+- `components/number-dot` — small count pill, renders nothing at zero.
+- `components/labeled-field` — read-only label and value pair.
+- `components/empty-state` — EmptyState with icon, title, description and an optional labelled action.
+- `components/separator` — horizontal or vertical Separator.
+- `components/carousel` — Embla Carousel, CarouselContent and CarouselItem.
+- `components/collapsible-section` — animated CollapsibleSection with trigger and content.
+
+### Feedback
+- `components/alert` — Alert, AlertTitle and AlertDescription (default, destructive).
+- `components/sonner` — Toaster for `sonner` toasts; mount once in the root layout.
+- `components/spinner` — Spinner and SectionSpinner for loading states.
+- `components/skeleton` — Skeleton placeholder.
+- `components/progress` — Progress bar.
+- `components/platform-disclaimer` — dismissible notice whose dismissal is stored in a cookie.
+
+### Navigation
+- `components/app-nav` — sidebar navigation list driven by `items` and `renderLink`.
+- `components/nav-user` — sidebar user menu with name, email, avatar and dropdown.
+- `components/breadcrumb` — Breadcrumb trail.
+- `components/tabs` — Tabs, TabsList (pills from a `tabs` array) and TabsContent.
+- `components/sidebar` — Sidebar primitives that AppShell is built from; apps do not use them directly.
+
+### Overlays
+- `components/dialog` — modal Dialog.
+- `components/alert-dialog` — AlertDialog for interrupting confirmations.
+- `components/destructive-action-dialog` — confirm step for destructive actions, optionally typed.
+- `components/sheet` — side Sheet panel.
+- `components/popover` — Popover.
+- `components/dropdown-menu` — DropdownMenu.
+- `components/tooltip` — Tooltip and TooltipProvider.
+- `components/portal-container` — PortalContainerProvider and usePortalContainer to portal overlays into a chosen element.
+
+### Data
+- `components/data-table` — DataTable driven by TanStack `columns` and `data`.
+- `components/data-table-shell` — scrollable wrapper that holds a DataTable.
+- `components/data-table-sortable-header` — sortable column header for DataTable columns.
+- `components/table` — Table, TableHeader, TableBody, TableRow, TableHead and TableCell primitives.
+- `components/load-more-sentinel` — invisible marker that triggers infinite loading.
+
+### Layout
+- `components/app-shell` — AppShell page frame with sidebar and header, and AppShellLogo.
+
+### Hooks and lib
+- `hooks/use-mobile` — `useIsMobile()` breakpoint hook.
+- `lib/utils` — `cn()` class merging.
+- `lib/easing` — `EASING_FUNCTION` curves shared with motion animations.
+- `lib/initials` — `getInitials(name, fallback)`.
+
+## Setup in an app
+
+```css
+/* src/app/globals.css */
+@import "tailwindcss";
+@import "tw-animate-css";
+@import "shadcn/tailwind.css";
+@import "@inbeat/ui/theme.css";
+```
+
+`next.config.ts`: `transpilePackages: ["@inbeat/ui"]` (ui ships source; core and next ship compiled JS).
+The template installs every peer the catalog needs.
+
+## Adding or changing a component
+
+Do it in `ib-toolkit/packages/ui/src/components`, add or update its story in `packages/ui/stories`
+(`bun run storybook`; stories are grouped like the catalog, render every variant and size from a
+declared list, and use the neutral data in `stories/lib/fixtures.ts`), add it to the Catalog
+above (a test enforces this), then `bun run sync <app-dir>`. Domain compositions tied to one app's
+data stay in the app; once a second app needs one, promote it here.

package/template/.dependency-cruiser.cjs

@@ -0,0 +1 @@
+module.exports = require("@inbeat/config/dependency-cruiser");

package/template/.env.example

@@ -0,0 +1,12 @@
+# Origin for links that leave the app; Vercel provides VERCEL_URL and VERCEL_PROJECT_PRODUCTION_URL.
+APP_URL=http://localhost:3000
+
+# Optional
+NEXT_PUBLIC_SENTRY_DSN=
+# Set by Vercel: VERCEL_ENV. Mirror it as NEXT_PUBLIC_VERCEL_ENV for browser Sentry events.
+NEXT_PUBLIC_VERCEL_ENV=
+
+# Build-time only (source map upload in next.config.ts)
+SENTRY_ORG=inbeat-67
+SENTRY_PROJECT=
+SENTRY_AUTH_TOKEN=

package/template/.github/workflows/ci.yml

@@ -0,0 +1,14 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  verify:
+    uses: Genoux/ib-toolkit/.github/workflows/verify.yml@main

package/template/AGENTS.md

@@ -0,0 +1,139 @@
+# AGENTS.md
+
+<!-- ib:standard:start — generated by @inbeat/standards, edit in ib-toolkit -->
+## inBeat toolkit standard
+
+Stack: Next.js App Router, TypeScript strict, React 19, Drizzle + Neon, Clerk, Sentry, Vercel, Bun.
+Shared code comes from `@inbeat/*` (ui ships source via `transpilePackages`; core and next ship compiled JS). Never fork a toolkit
+file into the app; change it in ib-toolkit.
+
+### Before you build
+
+- If "Product brief" under "This app" is empty, write the user's brief there first (problem,
+  users, core flows), then build.
+- Read the matching guide before the work, whatever tool you are: `.agents/skills/ib-ui/SKILL.md`
+  (component catalog, UI rules) before any UI, `.agents/skills/ib-feature/SKILL.md` for a new
+  feature, `.agents/skills/ib-toolkit/SKILL.md` for actions, routes, auth, env and rate limits.
+- Read the version-matched Next.js docs in `node_modules/next/dist/docs/` before Next.js work.
+
+### Two tiers
+
+- **Required** (CI enforces): `@inbeat/config` presets (extend them: biome, tsconfig, dependency-cruiser, vitest; `ib check`
+  enforces it), the action/route error contract,
+  `securityHeaders()`, Sentry presets, rate limiting on public entry points, this block.
+- **Opt-in**: `@inbeat/ui` blocks, extra layer rules.
+- A deliberate departure is allowed when the app states it under **Deliberate deviations**
+  in its own section of this file (what, why, owner). Undeclared drift is a bug.
+
+### Layout
+
+```
+src/app/                    routes + composition; private pieces in _components/
+src/features/<f>/actions/   "use server" mutations, one per file, via action()
+src/features/<f>/queries/   server-only reads for Server Components
+src/features/<f>/server/    domain commands and policies ("server-only", no "use server")
+src/features/<f>/components/ hooks/ lib/ schemas.ts types.ts
+src/entities/               leaf: domain types, zod schemas, constants
+src/integrations/<vendor>/  external adapters
+src/shared/{components,config,lib,hooks}/
+src/db/schema/<table>.ts, src/db/migrations/
+```
+
+Layers (dependency-cruiser, `@inbeat/config/dependency-cruiser`): features never import each
+other; entities import nothing internal; db imports entities only; shared and integrations never
+import features or app.
+
+### Reads and writes
+
+| Need | Use |
+|---|---|
+| Page data | Server Component calls `queries/*` |
+| Mutation from own UI | `action()` from `@inbeat/next/action`, returns `Result` |
+| Client polling, infinite lists | `GET` via `route()`, React Query |
+| Webhooks, presign, redirects, cron | `route()` |
+
+Server actions are queued per client; never use them for reads.
+
+### Errors
+
+- Actions resolve to `{ ok: true, data } | { ok: false, error, code?, errorId? }`.
+  Routes answer `{ error, code, errorId? }` with the status from `APP_ERROR_STATUS`.
+- Throw `AppError(kind)` from `@inbeat/core/errors`; never `new Error("Forbidden")`.
+  Kinds: validation, auth, forbidden, not_found, conflict, rate_limited, db_transient,
+  db_query, timeout, external_service, unknown.
+- Unexpected errors are classified, reported once, and replaced with safe copy + `ERR_xxxx`.
+- Log with `createLogger()`; ids only, never emails, names or payloads. No `console.log`.
+
+### Auth
+
+- New apps start without authentication; set it up per "Integrations" in the `ib-toolkit` skill.
+- `authorize` is required on every `action()` and `route()`, and it is the app's own check
+  (session, roles, ownership). `publicAccess` is an explicit choice and must be rate limited.
+- Redirect targets go through `safeRedirectPath`. `APP_URL` comes from env, never `Host`.
+
+### Security baseline
+
+- `securityHeaders()` in `next.config.ts`; CSP report-only until a clean week, then enforce.
+- `createRateLimiter()` (Upstash in prod) on every unauthenticated entry, presign and LLM call.
+- Webhooks verify the sender's signature. Secrets only in Vercel env.
+- `import "server-only"` in every module touching secrets or the DB.
+- Env through `@t3-oss/env-nextjs` + `@inbeat/core/env` fragments; no `process.env` elsewhere.
+
+### Data
+
+- UUID PKs, `timestamp({ withTimezone: true })`, snake_case, one table per file.
+- Migrations are generated, reviewed, forward-only, expand then contract; they run after the
+  build resolves. Never run migrations or destructive SQL against production unless the user
+  says "apply migrations to prod".
+- Deletes that own storage objects collect keys in the transaction and delete after commit.
+
+### UI
+
+- UI comes only from `@inbeat/ui` (catalog in the `ib-ui` skill) plus layouts composed from it. If a
+  component or variant is missing, stop and flag it for ib-toolkit; never invent, copy or patch
+  one (a workaround needs the user's OK and a `// toolkit-gap:` comment).
+- Primitives and generic blocks from `@inbeat/ui/components/*`; tokens from
+  `@inbeat/ui/theme.css`. A block moves to the toolkit only once an app actually uses it.
+- Buttons are `rounded-full` with no destructive variant; destructive flows use
+  `DestructiveActionDialog` from `@inbeat/ui`. Icon-only buttons get a tooltip. Lists use
+  `DataTableShell` + `DataTable`; empty lists use `EmptyState`.
+- Radix via `radix-ui`; animation via `motion` only.
+
+### Simplicity
+
+- Reuse before writing: the `ib-ui` catalog, `@inbeat/*`, the stdlib, then the platform. No speculative abstractions, config or "for later" scaffolding.
+- Comments carry only what code cannot. A deliberate shortcut is marked `// shortcut: <ceiling>; <upgrade path>`.
+- Claude Code reads `AGENTS.md` only when the app has no `CLAUDE.md`; if one exists it must contain an `@AGENTS.md` line (`ib check` fails otherwise).
+
+### Tests and CI
+
+- Vitest colocated `*.test.ts` for every `server/` command, policy and `lib/` function;
+  `*.integration.test.ts` against a Neon branch; Playwright in `tests/e2e` against previews.
+- CI: biome, tsc, dependency-cruiser, vitest, migration check, `ib check`, gitleaks.
+
+### Commits
+
+Conventional commits, lowercase, present tense, title under 60 chars. No AI attribution.
+Never commit, push or open a PR unless explicitly asked.
+<!-- ib:standard:end -->
+
+## This app
+
+### Stack deltas
+
+- No authentication by default; see "Integrations" in the `ib-toolkit` skill.
+- No database: add `@inbeat/next/db` with Drizzle and Neon when the app needs one.
+- No Playwright: add it when the app needs e2e coverage.
+
+### Deliberate deviations
+
+| What | Why | Owner |
+|---|---|---|
+
+### Known gaps
+
+- 
+
+### Learned facts
+
+- 

package/template/_gitignore

@@ -0,0 +1,10 @@
+node_modules
+.next
+next-env.d.ts
+.env*
+!.env.example
+*.tsbuildinfo
+.turbo
+coverage
+.vercel
+.DS_Store

package/template/biome.json

@@ -0,0 +1,6 @@
+{
+  "extends": ["@inbeat/config/biome"],
+  "files": {
+    "includes": ["**", "!!**/.next", "!**/next-env.d.ts"]
+  }
+}

package/template/next.config.ts

@@ -0,0 +1,32 @@
+import { clerkFrontendApi, securityHeaders } from "@inbeat/next/security-headers";
+import { withSentryConfig } from "@sentry/nextjs/config";
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  devIndicators: false,
+  transpilePackages: ["@inbeat/ui"],
+  headers: async () => [
+    {
+      source: "/(.*)",
+      headers: securityHeaders({
+        clerkFrontendApi: clerkFrontendApi(process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY),
+        dev: process.env.NODE_ENV !== "production",
+      }),
+    },
+  ],
+};
+
+export default withSentryConfig(nextConfig, {
+  org: process.env.SENTRY_ORG,
+  project: process.env.SENTRY_PROJECT,
+  silent: !process.env.CI,
+  widenClientFileUpload: true,
+  // Browser events go through this rewrite so ad-blockers don't drop them; the proxy matcher
+  // must never catch it.
+  tunnelRoute: "/monitoring",
+  webpack: {
+    treeshake: {
+      removeDebugLogging: true,
+    },
+  },
+});

package/template/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@inbeat/template",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "biome check .",
+    "lint:fix": "biome check . --write",
+    "format": "biome format --write .",
+    "lint:arch": "depcruise src --config .dependency-cruiser.cjs",
+    "ib:sync": "ib sync",
+    "ib:check": "ib check"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.2.0",
+    "@inbeat/core": "workspace:^",
+    "@inbeat/next": "workspace:^",
+    "@inbeat/ui": "workspace:^",
+    "@sentry/nextjs": "^10",
+    "@t3-oss/env-nextjs": "^0.13.8",
+    "@tanstack/react-table": "^8.21.3",
+    "class-variance-authority": "^0.7.1",
+    "embla-carousel-react": "^8.6.0",
+    "geist": "^1.7.2",
+    "lucide-react": "^1.14.0",
+    "motion": "^12.34.0",
+    "next": "16.3.8",
+    "next-themes": "^0.4.6",
+    "radix-ui": "^1.4.3",
+    "react": "19.2.3",
+    "react-day-picker": "^9.14.0",
+    "react-dom": "19.2.3",
+    "sonner": "^2.0.7",
+    "tailwind-merge": "^3.4.0",
+    "tw-animate-css": "^1.4.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@inbeat/config": "workspace:^",
+    "@inbeat/standards": "workspace:^",
+    "@tailwindcss/postcss": "^4.3.3",
+    "@types/node": "^22",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "dependency-cruiser": "^17.0.1",
+    "shadcn": "^4.21.0",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^5",
+    "vitest": "^4.1.1"
+  },
+  "packageManager": "bun@1.3.5",
+  "trustedDependencies": [
+    "@sentry/cli",
+    "sharp"
+  ]
+}

package/template/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;

package/template/sentry.edge.config.ts

@@ -0,0 +1,11 @@
+import { sentryServerOptions } from "@inbeat/next/sentry";
+import * as Sentry from "@sentry/nextjs";
+import { env } from "@/shared/config/env";
+
+Sentry.init(
+  sentryServerOptions({
+    dsn: env.NEXT_PUBLIC_SENTRY_DSN,
+    enabled: process.env.NODE_ENV === "production",
+    environment: env.VERCEL_ENV,
+  }),
+);

package/template/sentry.server.config.ts

@@ -0,0 +1,12 @@
+import { sentryServerOptions } from "@inbeat/next/sentry";
+import * as Sentry from "@sentry/nextjs";
+import { env } from "@/shared/config/env";
+
+Sentry.init({
+  ...sentryServerOptions({
+    dsn: env.NEXT_PUBLIC_SENTRY_DSN,
+    enabled: process.env.NODE_ENV === "production",
+    environment: env.VERCEL_ENV,
+  }),
+  integrations: [Sentry.consoleLoggingIntegration({ levels: ["log", "warn", "error"] })],
+});

package/template/src/app/api/health/route.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { GET } from "./route";
+
+describe("GET /api/health", () => {
+  it("answers ok without authentication", async () => {
+    const response = await GET(new Request("http://localhost/api/health"), {
+      params: Promise.resolve({}),
+    });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ status: "ok" });
+  });
+});

package/template/src/app/api/health/route.ts

@@ -0,0 +1,7 @@
+import { route } from "@inbeat/next/route";
+
+export const GET = route({
+  name: "health",
+  authorize: async () => null,
+  handler: async () => ({ status: "ok" }),
+});

package/template/src/app/error.tsx

@@ -0,0 +1,24 @@
+"use client";
+
+import { Button } from "@inbeat/ui/components/button";
+
+type ErrorPageProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+// `error.message` is never rendered: in production it is Next's generic copy, and in dev it can
+// carry internals. The digest is enough for support to find the server log.
+export default function ErrorPage({ error, reset }: ErrorPageProps) {
+  return (
+    <main className="flex min-h-screen flex-col items-center justify-center gap-2 px-6 text-center">
+      <h1 className="text-2xl font-medium">Something went wrong</h1>
+      {error.digest ? (
+        <p className="font-mono text-xs text-muted-foreground">{error.digest}</p>
+      ) : null}
+      <Button type="button" variant="outline" onClick={reset} className="mt-6">
+        Try again
+      </Button>
+    </main>
+  );
+}