@next-friday/create-app 0.0.0-stage → 0.1.0

package/templates/nestjs/.github/workflows/ci.yml

@@ -0,0 +1,181 @@
+name: Verify
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read # Needed by paths-filter to inspect pull request changes.
+    outputs:
+      heavy: ${{ steps.filter.outputs.heavy }}
+      ci_policy: ${{ steps.filter.outputs.ci_policy }}
+      full_verification: ${{ steps.mode.outputs.full_verification }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Detect relevant changes
+        id: filter
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: some-with-excludes
+          filters: .github/file-filters.yml
+      - name: Select verification mode
+        id: mode
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          HEAVY: ${{ steps.filter.outputs.heavy }}
+          CI_POLICY: ${{ steps.filter.outputs.ci_policy }}
+        run: |
+          full_verification=false
+          if [[ "$EVENT_NAME" == "push" || ( "$EVENT_NAME" == "pull_request" && "$DRAFT" != "true" && ( "$HEAVY" == "true" || "$CI_POLICY" == "true" ) ) ]]; then
+            full_verification=true
+          fi
+
+          echo "full_verification=$full_verification" >> "$GITHUB_OUTPUT"
+
+  checks:
+    name: Static Checks, Tests & Build
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: Reject suppression directives
+        run: pnpm suppressions:check
+      - name: Check Cursor rules match .agents/rules
+        run: pnpm rules:check
+      - name: Check agent gates
+        run: pnpm gates:check
+      - name: Check lint
+        run: pnpm lint:check
+      - name: Check formatting
+        run: pnpm format:check
+        env:
+          GITHUB_TOKEN: ${{ github.token }} # editorconfig-checker downloads its binary from GitHub releases; the token avoids the anonymous rate limit.
+      - name: Check package.json ordering
+        run: pnpm sort-package-json:check
+      - name: Validate peer dependency contracts
+        run: pnpm peers:check
+      - name: Check types
+        run: pnpm typecheck
+      - name: Run Knip
+        run: pnpm knip
+      - name: Check dependency graph
+        run: pnpm depcruise
+      - name: Run tests with coverage
+        run: pnpm test:coverage
+      - name: Run end-to-end tests
+        run: pnpm test:e2e
+      - name: Build
+        run: pnpm build
+      - name: Check patch coverage
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          python3 -m venv "$RUNNER_TEMP/diff-cover"
+          "$RUNNER_TEMP/diff-cover/bin/pip" install --quiet --require-hashes --only-binary=:all: -r .github/requirements/diff-cover.txt
+          "$RUNNER_TEMP/diff-cover/bin/diff-cover" coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95
+
+  image:
+    name: Container Image
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      HADOLINT_VERSION: 2.15.1
+      HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      TRIVY_VERSION: 0.76.1
+      TRIVY_SHA256: c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Lint Dockerfile
+        run: |
+          curl --silent --show-error --fail --location --output hadolint \
+            "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
+          echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
+          chmod +x hadolint
+          ./hadolint Dockerfile
+      - name: Build image
+        run: docker build --tag app:ci .
+      - name: Smoke test image
+        id: smoke
+        run: |
+          docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
+          curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
+      - name: Show container logs
+        if: failure() && steps.smoke.outcome == 'failure'
+        run: docker logs app
+      - name: Scan image for vulnerabilities
+        run: |
+          archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+          echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" trivy
+          ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
+
+  deploy-dev:
+    name: Deploy to dev
+    needs:
+      - checks
+      - image
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_ENABLED == 'true'
+    permissions:
+      contents: read
+      actions: read # Needed by deploy.yml to find the CI run of the deployed commit.
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: dev
+      commit_sha: ${{ github.sha }}
+
+  ci:
+    name: All Checks
+    if: always()
+    timeout-minutes: 5
+    needs:
+      - changes
+      - checks
+      - image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all verification jobs
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

package/templates/nestjs/.github/workflows/sast.yml

@@ -0,0 +1,45 @@
+name: SAST
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - ".agents/**"
+      - ".claude/**"
+      - ".cursor/**"
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  semgrep:
+    name: Semgrep (OWASP)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    container:
+      image: semgrep/semgrep:1.179.0@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Scan source
+        run: >-
+          semgrep scan
+          --config p/owasp-top-ten
+          --config p/typescript
+          --config p/nodejsscan
+          --severity ERROR --severity WARNING
+          --error --metrics=off
+          --timeout 60 --timeout-threshold 0
+          .

package/templates/nestjs/.lintstagedrc.json

@@ -0,0 +1,10 @@
+{
+  "*.{ts,tsx,js,jsx,mjs,cjs}": [
+    "pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config",
+    "prettier --write --cache"
+  ],
+  "!(package).json": ["prettier --write --cache"],
+  "*.{md,yml,yaml}": ["prettier --write --cache"],
+  "package.json": ["sort-package-json", "prettier --write --cache"],
+  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"]
+}

package/templates/nestjs/.prettierignore

@@ -0,0 +1,2 @@
+.husky/_
+pnpm-lock.yaml

package/templates/nestjs/.prettierrc.json

@@ -0,0 +1 @@
+"@next-friday/prettier-config-friday"

package/templates/nestjs/AGENTS.md

@@ -0,0 +1,8 @@
+# Agent guide
+
+NestJS service on pnpm. Source lives in `src/`, end-to-end tests in `test/`.
+
+- Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
+- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
+- Put unit tests next to the code as `*.test.ts`; put end-to-end tests in `test/` as `*.e2e.test.ts`.
+- Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.

package/templates/nestjs/CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing
+
+Use this guide to prepare changes to this repository.
+
+## Prerequisites
+
+- Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
+- Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
+- Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
+- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
+
+From the repository root:
+
+```sh
+npm install --global pnpm
+pnpm install
+```
+
+## Quality standards
+
+- Fix lint, type, and test failures at their root cause.
+- Put unit tests next to the code as `*.test.ts` and end-to-end tests in `test/` as `*.e2e.test.ts`.
+- Treat `coverage/` as generated output.
+- Do not commit `.env` files or credentials.
+
+## Verification
+
+Run the narrowest check that covers the change while you work. Git hooks run these checks:
+
+| Hook               | Checks                                                                                                                                                |
+| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
+| `commit-msg`       | commitlint                                                                                                                                            |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **End-to-end tests:** run `pnpm test:e2e` when you change endpoints. CI runs it on every pull request that is ready for review and changes code.
+- **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts` and `*.module.ts`, which hold only wiring. Keep logic out of them, as `src/port.ts` does for `main.ts`. CI does not gate branch coverage, because NestJS decorators emit metadata branches that never run.
+
+Run `pnpm verify` for repository changes.
+
+Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. After you change either, run `pnpm rules:sync` to regenerate `.claude/rules/` and `.cursor/rules/`.
+
+## Pull requests
+
+We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
+
+- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
+- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
+- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
+- Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. Pull request titles use `<type>(<scope>): <subject>`, which `.github/workflows/validate-pr-title.yml` checks.
+- Keep each pull request focused on one cohesive change.
+- Describe observable endpoint, request or response, or configuration effects.
+- Report only checks that actually ran and include their results.
+- Add or update tests only when they protect a distinct observable contract.

package/templates/nestjs/Dockerfile

@@ -0,0 +1,27 @@
+# Runs on any OCI platform (Railway, Vercel Container Runtime, Fly.io, Cloud Run). The platform sets `PORT`.
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
+WORKDIR /app
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+
+FROM base AS build
+RUN pnpm install --frozen-lockfile --ignore-scripts
+COPY nest-cli.json tsconfig.json tsconfig.build.json ./
+COPY src ./src
+RUN pnpm build
+
+FROM base AS prod-deps
+RUN pnpm install --frozen-lockfile --ignore-scripts --prod
+
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+ENV NODE_ENV=production
+WORKDIR /app
+# Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
+RUN apk upgrade --no-cache \
+  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+COPY package.json ./
+COPY --from=prod-deps /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+USER 1000
+HEALTHCHECK --interval=30s --timeout=5s CMD ["node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/health').then(response => process.exit(response.ok ? 0 : 1), () => process.exit(1))"]
+CMD ["node", "dist/main.js"]

package/templates/nestjs/README.md

@@ -0,0 +1,78 @@
+# next-friday-template-nestjs
+
+Next Friday starter for NestJS services.
+
+## Getting started
+
+```sh
+npm install --global pnpm
+pnpm install
+pnpm start:dev
+```
+
+The server listens on the port set by `PORT` in `.env`, which the CLI created from `.env.example`.
+
+## After creating a project from this template
+
+1. Install gitleaks and jq (see [CONTRIBUTING.md](CONTRIBUTING.md)). Make the first commit on `main` and push it. The Git hooks allow only this first commit and push on `main`; work on branches after that.
+
+   ```sh
+   git add --all
+   git commit -m "chore(repo): start from template"
+   git push --set-upstream origin main
+   ```
+
+2. Add your team as the owner of every file in `.github/CODEOWNERS`, and replace the owner placeholder in `.github/zizmor.yml`.
+3. Replace the template's description and owner: `package.json#description`, `repository.url`, and `author`. Change `license` from `UNLICENSED` if the project is open source.
+4. In the repository settings:
+   - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
+   - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
+   - **Cursor Bugbot:** enable the repository at [Bugbot](https://cursor.com/automations/from-cursor/bugbot). Bugbot reviews pull requests against the rules linked from `.cursor/BUGBOT.md`.
+   - **Rules → Rulesets:** protect `main` with squash merges only, a linear history, no force pushes or deletion, and the required checks `All Checks` and `Validate pull request title`. Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
+   - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
+
+## Scripts
+
+| Script             | Purpose                                                                         |
+| :----------------- | :------------------------------------------------------------------------------ |
+| `pnpm start`       | Start once, without watch mode; loads `.env` when present                       |
+| `pnpm start:dev`   | Start in watch mode; loads `.env` when present                                  |
+| `pnpm start:debug` | Start in watch mode with the Node.js inspector; loads `.env` when present       |
+| `pnpm build`       | Compile to `dist/`                                                              |
+| `pnpm start:prod`  | Run `dist/main.js`; the environment sets `PORT`                                 |
+| `pnpm test`        | Run unit tests (`src/**/*.test.ts`)                                             |
+| `pnpm test:e2e`    | Run end-to-end tests (`test/**/*.e2e.test.ts`)                                  |
+| `pnpm check`       | Run the static checks and the unit tests for changed code (the `pre-push` hook) |
+| `pnpm verify`      | Run the static checks and all unit tests with coverage                          |
+
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+
+## Container
+
+The `Dockerfile` builds a production image that runs as the `node` user. The platform must set `PORT`; Railway sets it automatically.
+
+```sh
+docker build -t app .
+docker run --env PORT=3000 --publish 3000:3000 app
+```
+
+On Vercel, the zero-configuration NestJS preset takes precedence over the `Dockerfile`. Set the project framework to Container to use the image, and set `PORT` in the project settings.
+
+## Deploy
+
+`.github/workflows/deploy.yml` deploys the `Dockerfile` to Railway and promotes one commit through `dev`, `uat`, and `prod`. `railway.json` sets the Railway health check to `/health`. The workflow stays off until you configure it:
+
+1. In Railway, create a project with one service for this repository and the environments `dev`, `uat`, and `prod`. The workflow passes these names to `railway up --environment`. Create one project token per environment under **Project Settings → Tokens**.
+2. In GitHub, create the `dev`, `uat`, and `prod` environments under **Settings → Environments**, and add to each:
+   - the `RAILWAY_TOKEN` secret: that environment's project token;
+   - the `RAILWAY_SERVICE` variable: the service name;
+   - the `APP_URL` variable: the public `https://` URL.
+
+   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+
+3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
+4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
+
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.

package/templates/nestjs/_gitignore

@@ -0,0 +1,47 @@
+node_modules
+.pnpm-store
+
+coverage
+*.tsbuildinfo
+
+.cache
+
+*.pem
+
+npm-debug.log*
+pnpm-debug.log*
+*.log
+
+**/.env*
+!.env.example
+
+.eslintcache
+
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
+/.idea
+
+logs
+.temp
+.tmp
+
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+**/.DS_Store
+
+*.key
+*.p12
+*.pfx
+id_rsa*
+id_ed25519*
+
+/.claude/settings.local.json
+/.claude/worktrees/
+
+/dist

package/templates/nestjs/eslint.config.ts

@@ -0,0 +1,7 @@
+import {defineConfig, globalIgnores} from "eslint/config";
+import friday from "@next-friday/eslint-config-friday";
+
+export default defineConfig(
+  globalIgnores([".agents/**", ".claude/**", ".cursor/**", "coverage/**", "dist/**"]),
+  friday(),
+);

package/templates/nestjs/nest-cli.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "deleteOutDir": true
+  }
+}

package/templates/nestjs/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "next-friday-template-nestjs",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Next Friday NestJS template.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/next-friday/next-friday-template-nestjs.git"
+  },
+  "license": "UNLICENSED",
+  "author": "Next Friday",
+  "type": "module",
+  "scripts": {
+    "build": "nest build",
+    "check": "pnpm verify:static && pnpm test:changed",
+    "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
+    "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts vitest.config.ts vitest.e2e.config.ts",
+    "format": "prettier --write --cache .",
+    "format:check": "prettier --check --cache . && editorconfig-checker",
+    "gates:check": "node scripts/check-agent-gates.ts",
+    "knip": "knip",
+    "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
+    "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
+    "peers:check": "pnpm peers check",
+    "prepare": "husky",
+    "rules:check": "node scripts/sync-agent-rules.ts --check",
+    "rules:sync": "node scripts/sync-agent-rules.ts",
+    "sort-package-json": "sort-package-json package.json",
+    "sort-package-json:check": "sort-package-json --check package.json",
+    "start": "node --env-file-if-exists=.env node_modules/@nestjs/cli/bin/nest.js start",
+    "start:debug": "node --env-file-if-exists=.env node_modules/@nestjs/cli/bin/nest.js start --debug --watch",
+    "start:dev": "node --env-file-if-exists=.env node_modules/@nestjs/cli/bin/nest.js start --watch",
+    "start:prod": "node dist/main",
+    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
+    "test": "vitest run --passWithNoTests",
+    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- pnpm-lock.yaml pnpm-workspace.yaml \"*package.json\" \"*tsconfig.json\" .husky; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
+    "test:coverage": "vitest run --coverage --passWithNoTests",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+  },
+  "dependencies": {
+    "@nestjs/common": "12.3.2",
+    "@nestjs/core": "12.3.2",
+    "@nestjs/platform-express": "12.3.2",
+    "@nestjs/terminus": "12.1.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "21.2.4",
+    "@nestjs/cli": "12.0.11",
+    "@nestjs/schematics": "12.0.11",
+    "@nestjs/testing": "12.3.2",
+    "@next-friday/commitlint-config-friday": "4.0.0",
+    "@next-friday/eslint-config-friday": "5.0.0",
+    "@next-friday/prettier-config-friday": "4.0.0",
+    "@types/node": "24.19.2",
+    "@types/supertest": "7.2.1",
+    "@vitest/coverage-v8": "5.0.5",
+    "dependency-cruiser": "18.7.0",
+    "editorconfig-checker": "7.0.0",
+    "eslint": "10.13.0",
+    "fast-check": "4.10.2",
+    "husky": "9.1.7",
+    "jiti": "2.7.0",
+    "knip": "6.43.0",
+    "lint-staged": "17.6.0",
+    "prettier": "3.9.10",
+    "sort-package-json": "4.1.0",
+    "supertest": "7.3.1",
+    "typescript": "6.0.3",
+    "vitest": "5.0.5"
+  },
+  "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",
+  "engines": {
+    "node": ">=24.15.0 <25"
+  }
+}

package/templates/nestjs/src/app.controller.test.ts

@@ -0,0 +1,23 @@
+import {Test, TestingModule} from "@nestjs/testing";
+
+import {AppController} from "./app.controller.js";
+import {AppService} from "./app.service.js";
+
+describe("AppController", () => {
+  let appController: AppController;
+
+  beforeEach(async () => {
+    const app: TestingModule = await Test.createTestingModule({
+      controllers: [AppController],
+      providers: [AppService],
+    }).compile();
+
+    appController = app.get<AppController>(AppController);
+  });
+
+  describe("root", () => {
+    it('should return "Hello World!"', () => {
+      expect(appController.getHello()).toBe("Hello World!");
+    });
+  });
+});

package/templates/nestjs/src/app.controller.ts

@@ -0,0 +1,13 @@
+import {Controller, Get} from "@nestjs/common";
+
+import {AppService} from "./app.service.js";
+
+@Controller()
+export class AppController {
+  constructor(private readonly appService: AppService) {}
+
+  @Get()
+  getHello(): string {
+    return this.appService.getHello();
+  }
+}

package/templates/nestjs/src/app.module.ts

@@ -0,0 +1,12 @@
+import {Module} from "@nestjs/common";
+
+import {AppController} from "./app.controller.js";
+import {AppService} from "./app.service.js";
+import {HealthModule} from "./health/health.module.js";
+
+@Module({
+  imports: [HealthModule],
+  controllers: [AppController],
+  providers: [AppService],
+})
+export class AppModule {}

package/templates/nestjs/src/app.service.ts

@@ -0,0 +1,10 @@
+import {Injectable} from "@nestjs/common";
+
+@Injectable()
+export class AppService {
+  private readonly greeting = "Hello World!";
+
+  getHello(): string {
+    return this.greeting;
+  }
+}

package/templates/nestjs/src/health/health.controller.test.ts

@@ -0,0 +1,17 @@
+import {TerminusModule} from "@nestjs/terminus";
+import {Test} from "@nestjs/testing";
+
+import {HealthController} from "./health.controller.js";
+
+describe("HealthController", () => {
+  it("reports ok when every check passes", async () => {
+    const moduleReference = await Test.createTestingModule({
+      imports: [TerminusModule],
+      controllers: [HealthController],
+    }).compile();
+
+    await expect(moduleReference.get(HealthController).check()).resolves.toMatchObject({
+      status: "ok",
+    });
+  });
+});

package/templates/nestjs/src/health/health.controller.ts

@@ -0,0 +1,14 @@
+import {Controller, Get} from "@nestjs/common";
+import {HealthCheck, HealthCheckService} from "@nestjs/terminus";
+import type {HealthCheckResult} from "@nestjs/terminus";
+
+@Controller("health")
+export class HealthController {
+  constructor(private readonly health: HealthCheckService) {}
+
+  @Get()
+  @HealthCheck()
+  check(): Promise<HealthCheckResult> {
+    return this.health.check([]);
+  }
+}