@next-friday/create-app 0.0.0-stage → 1.0.0

package/templates/nextjs/.github/workflows/ci.yml

@@ -0,0 +1,187 @@
+name: Verify
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read # Needed by paths-filter to inspect pull request changes.
+    outputs:
+      heavy: ${{ steps.filter.outputs.heavy }}
+      ci_policy: ${{ steps.filter.outputs.ci_policy }}
+      full_verification: ${{ steps.mode.outputs.full_verification }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Detect relevant changes
+        id: filter
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: some-with-excludes
+          filters: .github/file-filters.yml
+      - name: Select verification mode
+        id: mode
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          HEAVY: ${{ steps.filter.outputs.heavy }}
+          CI_POLICY: ${{ steps.filter.outputs.ci_policy }}
+        run: |
+          full_verification=false
+          if [[ "$EVENT_NAME" == "push" || ( "$EVENT_NAME" == "pull_request" && "$DRAFT" != "true" && ( "$HEAVY" == "true" || "$CI_POLICY" == "true" ) ) ]]; then
+            full_verification=true
+          fi
+
+          echo "full_verification=$full_verification" >> "$GITHUB_OUTPUT"
+
+  checks:
+    name: Static Checks, Tests & Build
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: Reject suppression directives
+        run: pnpm suppressions:check
+      - name: Check Cursor rules match .agents/rules
+        run: pnpm rules:check
+      - name: Check agent gates
+        run: pnpm gates:check
+      - name: Check lint
+        run: pnpm lint:check
+      - name: Check formatting
+        run: pnpm format:check
+        env:
+          GITHUB_TOKEN: ${{ github.token }} # editorconfig-checker downloads its binary from GitHub releases; the token avoids the anonymous rate limit.
+      - name: Check package.json ordering
+        run: pnpm sort-package-json:check
+      - name: Validate peer dependency contracts
+        run: pnpm peers:check
+      - name: Check types
+        run: pnpm typecheck
+      - name: Run Knip
+        run: pnpm knip
+      - name: Check dependency graph
+        run: pnpm depcruise
+      - name: Run tests with coverage
+        run: pnpm test:coverage
+      - name: Build
+        run: pnpm build
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Install Playwright browser
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Run end-to-end tests
+        run: pnpm test:e2e
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Check patch coverage
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          python3 -m venv "$RUNNER_TEMP/diff-cover"
+          "$RUNNER_TEMP/diff-cover/bin/pip" install --quiet --require-hashes --only-binary=:all: -r .github/requirements/diff-cover.txt
+          "$RUNNER_TEMP/diff-cover/bin/diff-cover" coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+
+  image:
+    name: Container Image
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      HADOLINT_VERSION: 2.15.1
+      HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      TRIVY_VERSION: 0.76.1
+      TRIVY_SHA256: c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Lint Dockerfile
+        run: |
+          curl --silent --show-error --fail --location --output hadolint \
+            "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
+          echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
+          chmod +x hadolint
+          ./hadolint Dockerfile
+      - name: Build image
+        run: docker build --tag app:ci .
+      - name: Smoke test image
+        id: smoke
+        run: |
+          docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
+          curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
+      - name: Show container logs
+        if: failure() && steps.smoke.outcome == 'failure'
+        run: docker logs app
+      - name: Scan image for vulnerabilities
+        run: |
+          archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+          echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" trivy
+          ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
+
+  deploy-dev:
+    name: Deploy to dev
+    needs:
+      - checks
+      - image
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_ENABLED == 'true'
+    permissions:
+      contents: read
+      actions: read # Needed by deploy.yml to find the CI run of the deployed commit.
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: dev
+      commit_sha: ${{ github.sha }}
+
+  ci:
+    name: All Checks
+    if: always()
+    timeout-minutes: 5
+    needs:
+      - changes
+      - checks
+      - image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all verification jobs
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

package/templates/nextjs/.github/workflows/sast.yml

@@ -0,0 +1,46 @@
+name: SAST
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - ".agents/**"
+      - ".claude/**"
+      - ".cursor/**"
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  semgrep:
+    name: Semgrep (OWASP)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    container:
+      image: semgrep/semgrep:1.179.0@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Scan source
+        run: >-
+          semgrep scan
+          --config p/owasp-top-ten
+          --config p/typescript
+          --config p/nodejsscan
+          --config p/react
+          --severity ERROR --severity WARNING
+          --error --metrics=off
+          --timeout 60 --timeout-threshold 0
+          .

package/templates/nextjs/.lintstagedrc.json

@@ -0,0 +1,10 @@
+{
+  "*.{ts,tsx,js,jsx,mjs,cjs}": [
+    "pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config",
+    "prettier --write --cache"
+  ],
+  "!(package).json": ["prettier --write --cache"],
+  "*.{css,md,yml,yaml}": ["prettier --write --cache"],
+  "package.json": ["sort-package-json", "prettier --write --cache"],
+  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"]
+}

package/templates/nextjs/.prettierignore

@@ -0,0 +1,2 @@
+.husky/_
+pnpm-lock.yaml

package/templates/nextjs/AGENTS.md

@@ -0,0 +1,18 @@
+# Agent guide
+
+Next.js App Router application on pnpm. Routes live in `app/`.
+
+- Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
+- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
+- Put unit tests next to the code as `*.test.ts`; put Playwright end-to-end tests in `test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
+- Read configuration from environment variables and fail when one is missing; document each variable in `.env.example`.
+
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/templates/nextjs/CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing
+
+Use this guide to prepare changes to this repository.
+
+## Prerequisites
+
+- Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
+- Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
+- Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
+- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
+
+From the repository root:
+
+```sh
+npm install --global pnpm
+pnpm install
+```
+
+## Quality standards
+
+- Fix lint, type, and test failures at their root cause.
+- Put unit tests next to the code as `*.test.ts` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.
+- Treat `coverage/` as generated output.
+- Do not commit `.env` files or credentials.
+
+## Verification
+
+Run the narrowest check that covers the change while you work. Git hooks run these checks:
+
+| Hook               | Checks                                                                                                                                                |
+| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
+| `commit-msg`       | commitlint                                                                                                                                            |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **End-to-end tests:** run `pnpm test:e2e` when you change pages. It starts the development server unless one is already running. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build on every pull request that is ready for review and changes code.
+- **Coverage:** CI requires 95% branch coverage on changed lines in `app/`, except `layout.tsx`.
+
+Run `pnpm verify` for repository changes.
+
+Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. After you change either, run `pnpm rules:sync` to regenerate `.claude/rules/` and `.cursor/rules/`.
+
+## Pull requests
+
+We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
+
+- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
+- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
+- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
+- Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. Pull request titles use `<type>(<scope>): <subject>`, which `.github/workflows/validate-pr-title.yml` checks.
+- Keep each pull request focused on one cohesive change.
+- Describe observable page, route, content, or configuration effects.
+- Report only checks that actually ran and include their results.
+- Add or update tests only when they protect a distinct observable contract.

package/templates/nextjs/Dockerfile

@@ -0,0 +1,23 @@
+# Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+ENV NEXT_TELEMETRY_DISABLED=1
+WORKDIR /app
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN pnpm install --frozen-lockfile --ignore-scripts
+COPY next.config.ts postcss.config.mjs tsconfig.json ./
+COPY app ./app
+RUN pnpm build
+
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
+WORKDIR /app
+# Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
+RUN apk upgrade --no-cache \
+  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+# Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/public ./public` when the app has a public/ folder, and allow it in .dockerignore.
+COPY --from=build --chown=node:node /app/.next/standalone ./
+COPY --from=build --chown=node:node /app/.next/static ./.next/static
+USER 1000
+HEALTHCHECK --interval=30s --timeout=5s CMD ["node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/health').then(response => process.exit(response.ok ? 0 : 1), () => process.exit(1))"]
+CMD ["node", "server.js"]

package/templates/nextjs/README.md

@@ -0,0 +1,74 @@
+# next-friday-template-nextjs
+
+Next Friday starter for Next.js applications.
+
+## Getting started
+
+```sh
+npm install --global pnpm
+pnpm install
+pnpm dev
+```
+
+## After creating a project from this template
+
+1. Install gitleaks and jq (see [CONTRIBUTING.md](CONTRIBUTING.md)). Make the first commit on `main` and push it. The Git hooks allow only this first commit and push on `main`; work on branches after that.
+
+   ```sh
+   git add --all
+   git commit -m "chore(repo): start from template"
+   git push --set-upstream origin main
+   ```
+
+2. Add your team as the owner of every file in `.github/CODEOWNERS`, and replace the owner placeholder in `.github/zizmor.yml`.
+3. Replace the template's description and owner: `package.json#description`, `repository.url`, and `author`, and the `Next Friday Next.js template` text in `app/layout.tsx`, `app/page.tsx`, and their tests. Change `license` from `UNLICENSED` if the project is open source.
+4. In the repository settings:
+   - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
+   - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
+   - **Cursor Bugbot:** enable the repository at [Bugbot](https://cursor.com/automations/from-cursor/bugbot). Bugbot reviews pull requests against the rules linked from `.cursor/BUGBOT.md`.
+   - **Rules → Rulesets:** protect `main` with squash merges only, a linear history, no force pushes or deletion, and the required checks `All Checks` and `Validate pull request title`. Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
+   - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
+
+## Scripts
+
+| Script          | Purpose                                                                                                           |
+| :-------------- | :---------------------------------------------------------------------------------------------------------------- |
+| `pnpm dev`      | Start the development server                                                                                      |
+| `pnpm build`    | Build for production                                                                                              |
+| `pnpm start`    | Serve the standalone production build after `pnpm build`. The build copies `.env`, so rebuild after you change it |
+| `pnpm test`     | Run unit tests                                                                                                    |
+| `pnpm test:e2e` | Run Playwright end-to-end tests (`test/**/*.e2e.test.ts`)                                                         |
+| `pnpm check`    | Run the static checks and the unit tests for changed code (the `pre-push` hook)                                   |
+| `pnpm verify`   | Run the static checks and all unit tests with coverage                                                            |
+
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+
+## Container
+
+The `Dockerfile` builds a standalone production image that runs as the `node` user, for platforms such as Railway. The server listens on `PORT`, or 3000 when it is unset.
+
+```sh
+docker build -t app .
+docker run --publish 3000:3000 app
+```
+
+On Vercel, deploy without the image; the Next.js preset takes precedence over the `Dockerfile`.
+
+## Deploy
+
+`.github/workflows/deploy.yml` deploys the `Dockerfile` to Railway and promotes one commit through `dev`, `uat`, and `prod`. `railway.json` sets the Railway health check to `/health`. The workflow stays off until you configure it:
+
+1. In Railway, create a project with one service for this repository and the environments `dev`, `uat`, and `prod`. The workflow passes these names to `railway up --environment`. Create one project token per environment under **Project Settings → Tokens**.
+2. In GitHub, create the `dev`, `uat`, and `prod` environments under **Settings → Environments**, and add to each:
+   - the `RAILWAY_TOKEN` secret: that environment's project token;
+   - the `RAILWAY_SERVICE` variable: the service name;
+   - the `APP_URL` variable: the public `https://` URL.
+
+   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+
+3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
+4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
+
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.

package/templates/nextjs/_gitignore

@@ -0,0 +1,51 @@
+node_modules
+.pnpm-store
+
+coverage
+playwright-report
+test-results
+*.tsbuildinfo
+
+.cache
+
+*.pem
+
+npm-debug.log*
+pnpm-debug.log*
+*.log
+
+**/.env*
+!.env.example
+
+.eslintcache
+
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
+/.idea
+
+logs
+.temp
+.tmp
+
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+**/.DS_Store
+
+*.key
+*.p12
+*.pfx
+id_rsa*
+id_ed25519*
+
+/.claude/settings.local.json
+/.claude/worktrees/
+
+/.next
+/out
+next-env.d.ts

package/templates/nextjs/app/globals.css

@@ -0,0 +1,26 @@
+@import "tailwindcss";
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: #0a0a0a;
+    --foreground: #ededed;
+  }
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: var(--font-sans), sans-serif;
+}

package/templates/nextjs/app/health/route.test.ts

@@ -0,0 +1,20 @@
+import {describe, expect, it, vi} from "vitest";
+
+import {GET} from "./route";
+
+vi.mock("next/server", () => ({
+  connection: vi.fn(async () => {}),
+}));
+
+describe("GET /health", () => {
+  it("reports ok without caching", async () => {
+    const response = await GET();
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+
+    await expect(response.json()).resolves.toEqual({
+      status: "ok",
+    });
+  });
+});

package/templates/nextjs/app/health/route.ts

@@ -0,0 +1,23 @@
+import {connection} from "next/server";
+
+/**
+ * Report that the server is up, for platform health checks. Rendered per request and never cached, so a
+ * stopped server cannot pass from a cached response.
+ * @returns A JSON response with `status: "ok"`.
+ */
+async function get(): Promise<Response> {
+  await connection();
+
+  return Response.json(
+    {
+      status: "ok",
+    },
+    {
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
+}
+
+export {get as GET};

package/templates/nextjs/app/layout.tsx

@@ -0,0 +1,29 @@
+import {Geist, Geist_Mono} from "next/font/google";
+import type {Metadata} from "next";
+
+import "./globals.css";
+
+const geistSans = Geist({
+  variable: "--font-geist-sans",
+  subsets: ["latin"],
+});
+
+const geistMono = Geist_Mono({
+  variable: "--font-geist-mono",
+  subsets: ["latin"],
+});
+
+export const metadata: Metadata = {
+  title: "Next Friday Next.js template",
+  description: "Starter application for Next Friday Next.js projects.",
+};
+
+export default function RootLayout(props: LayoutProps<"/">) {
+  const {children} = props;
+
+  return (
+    <html className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`} lang="en">
+      <body className="flex min-h-full flex-col">{children}</body>
+    </html>
+  );
+}

package/templates/nextjs/app/page.test.ts

@@ -0,0 +1,11 @@
+import {createElement} from "react";
+import {describe, expect, it} from "vitest";
+import {renderToStaticMarkup} from "react-dom/server";
+
+import Page from "./page";
+
+describe("Page", () => {
+  it("renders the template heading", () => {
+    expect(renderToStaticMarkup(createElement(Page))).toContain("Next Friday Next.js template");
+  });
+});

package/templates/nextjs/app/page.tsx

@@ -0,0 +1,8 @@
+export default function Page() {
+  return (
+    <main className="flex flex-1 flex-col items-center justify-center gap-4 p-16 text-center">
+      <h1 className="text-3xl font-semibold tracking-tight">Next Friday Next.js template</h1>
+      <p className="text-lg text-zinc-600 dark:text-zinc-400">Edit app/page.tsx to get started.</p>
+    </main>
+  );
+}

package/templates/nextjs/eslint.config.ts

@@ -0,0 +1,32 @@
+import {defineConfig, globalIgnores} from "eslint/config";
+import friday from "@next-friday/eslint-config-friday";
+import nextPlugin, {configs as nextConfigs} from "@next/eslint-plugin-next";
+
+export default defineConfig(
+  globalIgnores([
+    ".agents/**",
+    ".claude/**",
+    ".cursor/**",
+    ".next/**",
+    "out/**",
+    "next-env.d.ts",
+    "coverage/**",
+    "playwright-report/**",
+    "test-results/**",
+  ]),
+  friday({
+    react: true,
+  }),
+  {
+    plugins: {
+      "@next/next": nextPlugin,
+    },
+    rules: nextConfigs["core-web-vitals"].rules,
+  },
+  {
+    rules: {
+      "friday/component-module": "off",
+    },
+    files: ["app/**/{page,layout}.tsx"],
+  },
+);

package/templates/nextjs/knip.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "ignoreDependencies": ["fast-check"]
+}