@next-friday/create-app 2.0.0 → 2.1.0

package/README.md

@@ -16,12 +16,13 @@ Without a terminal, as in CI or an agent, the name and `--stack` are required. P
 
 ## Stacks
 
-| `--stack` | Starts with                                                       |
-| :-------- | :---------------------------------------------------------------- |
-| `nodejs`  | A TypeScript HTTP server on `node:http` with a `/health` endpoint |
-| `nestjs`  | A NestJS app with a Terminus `/health` endpoint                   |
-| `nextjs`  | A Next.js App Router app with React and Tailwind CSS              |
-| `payload` | Payload CMS on Next.js with PostgreSQL                            |
+| `--stack`   | Starts with                                                       |
+| :---------- | :---------------------------------------------------------------- |
+| `nodejs`    | A TypeScript HTTP server on `node:http` with a `/health` endpoint |
+| `nestjs`    | A NestJS app with a Terminus `/health` endpoint                   |
+| `nextjs`    | A Next.js App Router app with React and Tailwind CSS              |
+| `payload`   | Payload CMS on Next.js with PostgreSQL                            |
+| `turborepo` | A Turborepo workspace with a Next.js app and a Payload backoffice |
 
 Every stack is built from [`templates/base`](templates/base), which holds the shared company setup, plus its own directory under [`templates/`](templates), which holds the stack-specific files.
 
@@ -43,17 +44,17 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 ## Options
 
 ```text
-pnpm create @next-friday/app [name] [--stack nodejs|nestjs|nextjs|payload]
+pnpm create @next-friday/app [name] [--stack nodejs|nestjs|nextjs|payload|turborepo]
 ```
 
-| Option           | Description                                                      |
-| :--------------- | :--------------------------------------------------------------- |
-| `name`           | Project directory and package name. Asked when left out.         |
-| `--stack`        | `nodejs`, `nestjs`, `nextjs`, or `payload`. Asked when left out. |
-| `--skip-git`     | Do not run `git init`.                                           |
-| `--skip-install` | Do not run `pnpm install`.                                       |
-| `-v, --version`  | Print the version.                                               |
-| `-h, --help`     | Print the usage.                                                 |
+| Option           | Description                                                                   |
+| :--------------- | :---------------------------------------------------------------------------- |
+| `name`           | Project directory and package name. Asked when left out.                      |
+| `--stack`        | `nodejs`, `nestjs`, `nextjs`, `payload`, or `turborepo`. Asked when left out. |
+| `--skip-git`     | Do not run `git init`.                                                        |
+| `--skip-install` | Do not run `pnpm install`.                                                    |
+| `-v, --version`  | Print the version.                                                            |
+| `-h, --help`     | Print the usage.                                                              |
 
 The name must:
 

package/dist/main.mjs

@@ -12,29 +12,40 @@ const stacks = [
 	{
 		id: "nodejs",
 		label: "Node.js",
-		hint: "HTTP service without a framework"
+		hint: "HTTP service without a framework",
+		requiresDatabase: false
 	},
 	{
 		id: "nestjs",
 		label: "NestJS",
-		hint: "HTTP API"
+		hint: "HTTP API",
+		requiresDatabase: false
 	},
 	{
 		id: "nextjs",
 		label: "Next.js",
-		hint: "Web app"
+		hint: "Web app",
+		requiresDatabase: false
 	},
 	{
 		id: "payload",
 		label: "Payload",
-		hint: "Headless CMS on Next.js and PostgreSQL"
+		hint: "Headless CMS on Next.js and PostgreSQL",
+		requiresDatabase: true
+	},
+	{
+		id: "turborepo",
+		label: "Turborepo",
+		hint: "Next.js app and Payload backoffice",
+		requiresDatabase: true
 	}
 ];
 const developmentScripts = {
 	nodejs: "start:dev",
 	nestjs: "start:dev",
 	nextjs: "dev",
-	payload: "dev"
+	payload: "dev",
+	turborepo: "dev"
 };
 /**
 * Check whether a string names a supported stack.
@@ -131,7 +142,7 @@ function ownEntries(directory) {
 	return readdirSync(directory).filter((entry) => entry !== ".git");
 }
 // src/arguments.ts
-const usage = `Usage: pnpm create @next-friday/app [name] [--stack nodejs|nestjs|nextjs|payload]
+const usage = `Usage: pnpm create @next-friday/app [name] [--stack nodejs|nestjs|nextjs|payload|turborepo]
 
   name            Project directory and package name, or . for the current directory. Asked when left out.
   --stack         Template stack. Asked when left out.
@@ -368,7 +379,7 @@ function nextSteps(name, stack, git, isInstalled) {
 		hasGit && isInstalled ? [] : ["pnpm install"],
 		[`pnpm ${developmentScripts[stack]}`]
 	].flat();
-	const database = stack === "payload" ? `Set DATABASE_URL in .env to your PostgreSQL database before pnpm ${developmentScripts[stack]}.\n` : "";
+	const database = stacks.find((item) => item.id === stack)?.requiresDatabase ? `Set DATABASE_URL in .env to your PostgreSQL database before pnpm ${developmentScripts[stack]}.\n` : "";
 	const readme = name === "." ? "README.md" : `${name}/README.md`;
 	return `Next steps:\n${commands.map((command) => `  ${command}`).join("\n")}\n${database}Before the first commit, follow "After creating a project from this template" in ${readme}.`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/pnpm-workspace.yaml

@@ -10,12 +10,34 @@ overrides:
   "esbuild@<0.27.0": ^0.28.2
   "graphql-scalars@<2.0.1": ^2.0.1
   "happy-dom@<21.0.4": ^21.0.4
+  "minimatch@<11.0.1": ^11.0.1
 minimumReleaseAgeExclude:
   - "@next-friday/commitlint-config-friday@4.0.0"
   - "@next-friday/eslint-config-friday@5.0.0"
   - "@next-friday/eslint-config-friday@5.1.0"
   - "@next-friday/prettier-config-friday@4.0.0"
   - "@next-friday/eslint-plugin-friday@1.1.3"
+packageExtensions:
+  payload:
+    peerDependenciesMeta:
+      graphql:
+        optional: true
+  "@payloadcms/next":
+    peerDependenciesMeta:
+      graphql:
+        optional: true
+  "@payloadcms/graphql":
+    peerDependenciesMeta:
+      graphql:
+        optional: true
+  graphql-http:
+    peerDependenciesMeta:
+      graphql:
+        optional: true
+  graphql-scalars:
+    peerDependenciesMeta:
+      graphql:
+        optional: true
 peerDependencyRules:
-  allowedVersions:
-    graphql: 17.0.2
+  ignoreMissing:
+    - graphql

package/templates/payload/README.md

@@ -1,6 +1,6 @@
 # next-friday-template-payload
 
-Next Friday starter for Payload CMS on Next.js and PostgreSQL.
+Next Friday starter for Payload CMS on Next.js and PostgreSQL. The API is REST at `/api`.
 
 ## Getting started
 

package/templates/payload/package.json

@@ -48,7 +48,6 @@
     "@payloadcms/db-postgres": "3.92.1",
     "@payloadcms/next": "3.92.1",
     "@payloadcms/richtext-lexical": "3.92.1",
-    "graphql": "17.0.2",
     "next": "16.4.3",
     "payload": "3.92.1",
     "react": "19.3.1",

package/templates/payload/src/payload.config.test.ts

@@ -0,0 +1,31 @@
+import {afterEach, describe, expect, it, vi} from "vitest";
+import {readFileSync} from "node:fs";
+
+interface PackageManifest {
+  dependencies?: Record<string, string>;
+}
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("payload config", () => {
+  it("keeps the HTTP API on REST", async () => {
+    vi.stubEnv("APP_URL", "http://localhost:3000");
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("./payload.config");
+    const resolved = await config;
+
+    expect(resolved.graphQL.disable).toBe(true);
+  });
+
+  it("does not add an extra peer dependency", () => {
+    const manifest = JSON.parse(
+      readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+    ) as PackageManifest;
+
+    expect(manifest.dependencies?.graphql).toBeUndefined();
+  });
+});

package/templates/turborepo/.agents/rules/typescript-first.md

@@ -0,0 +1,7 @@
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/turborepo/.agents/rules.json

@@ -0,0 +1,41 @@
+{
+  "automation-owned-checks": {
+    "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
+  },
+  "code-comments": {
+    "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
+  },
+  "current-state-authority": {
+    "description": "Current state: implement from user requirements and the working tree"
+  },
+  "demand-driven-configuration": {
+    "description": "Demand-driven configuration: add a setting only for an active requirement"
+  },
+  "dependency-security": {
+    "description": "Dependencies: add a package only when code or a contract uses it",
+    "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
+  },
+  "deterministic-testing": {
+    "description": "Test admission: add a case only when it catches a defect current tests miss",
+    "globs": ["**/*.test.ts", "**/*.test.tsx"]
+  },
+  "diagnostics-and-error-handling": {
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+  },
+  "git-workflow": {
+    "description": "Git workflow: trunk-based branches, commits, and pull requests"
+  },
+  "no-suppression": {
+    "description": "Findings: fix scanner and linter reports without inline suppressions"
+  },
+  "script-driven-changes": {
+    "description": "Scripts: apply a repeated edit across many files with a script"
+  },
+  "single-author-style": {
+    "description": "Sibling style: match layout, naming, and composition in the same project"
+  },
+  "typescript-first": {
+    "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
+  }
+}

package/templates/turborepo/.claude/rules/deterministic-testing.md

@@ -0,0 +1,21 @@
+---
+paths:
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+---
+
+# Test Admission
+
+Keep tests as small, deterministic protections for observable contracts.
+
+Name the contract and the distinct defect a proposed test can detect before writing it. Admit a test for externally observable behavior, a public contract, a demonstrated regression, a non-trivial invariant, a meaningful failure mode, or an explicit repository verification requirement.
+
+Choose the narrowest existing layer that owns that contract. Give each test one defect to detect. Add a case only when it catches a defect remaining cases miss. Treat coverage percentage as a measurement.
+
+Search existing coverage first. Extend the file that already owns the contract. Create a file only when the contract has no owner or needs a different harness. Follow the nearest directory and naming pattern. Keep setup local until multiple tests share live runtime logic, then extract one helper.
+
+Use the framework's standard assertions. Use an inline snippet unless filesystem paths, module resolution, or compiler services are the contract. Keep fixtures declarative and read-only.
+
+When the user asks to run tests, run the narrowest owning file or filter.
+
+_Completion criterion_: Every added or modified case maps to an admitted contract and a defect current cases would miss. Tests stay unchanged when no proposed case survives admission.

package/templates/turborepo/.claude/rules/typescript-first.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/turborepo/.cursor/rules/deterministic-testing.mdc

@@ -0,0 +1,21 @@
+---
+description: "Test admission: add a case only when it catches a defect current tests miss"
+globs: "**/*.test.ts,**/*.test.tsx"
+alwaysApply: false
+---
+
+# Test Admission
+
+Keep tests as small, deterministic protections for observable contracts.
+
+Name the contract and the distinct defect a proposed test can detect before writing it. Admit a test for externally observable behavior, a public contract, a demonstrated regression, a non-trivial invariant, a meaningful failure mode, or an explicit repository verification requirement.
+
+Choose the narrowest existing layer that owns that contract. Give each test one defect to detect. Add a case only when it catches a defect remaining cases miss. Treat coverage percentage as a measurement.
+
+Search existing coverage first. Extend the file that already owns the contract. Create a file only when the contract has no owner or needs a different harness. Follow the nearest directory and naming pattern. Keep setup local until multiple tests share live runtime logic, then extract one helper.
+
+Use the framework's standard assertions. Use an inline snippet unless filesystem paths, module resolution, or compiler services are the contract. Keep fixtures declarative and read-only.
+
+When the user asks to run tests, run the narrowest owning file or filter.
+
+_Completion criterion_: Every added or modified case maps to an admitted contract and a defect current cases would miss. Tests stay unchanged when no proposed case survives admission.

package/templates/turborepo/.cursor/rules/typescript-first.mdc

@@ -0,0 +1,13 @@
+---
+description: "TypeScript-first: write source, tests, and scripts as .ts or .tsx"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/turborepo/.dockerignore

@@ -0,0 +1,12 @@
+node_modules
+**/node_modules
+**/.next
+**/.turbo
+**/coverage
+**/.env
+**/.env.*
+!**/.env.example
+.git
+.github
+**/*.test.ts
+**/*.test.tsx

package/templates/turborepo/.editorconfig-checker.json

@@ -0,0 +1,3 @@
+{
+  "Exclude": ["^apps/backoffice/src/migrations/", "^apps/backoffice/src/payload-types\\.ts$"]
+}

package/templates/turborepo/.env.example

@@ -0,0 +1,4 @@
+# Copy to .env and fill in. List every environment variable the app reads, with a safe example value.
+DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/payload
+PAYLOAD_SECRET=
+APP_URL=http://localhost:3001

package/templates/turborepo/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report crashes, incorrect behavior, or setup problems.
+labels: ["bug", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Reproduce the issue with the supported Node.js version.
+        Remove credentials, secrets, personal or customer data, and proprietary source code before submitting.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you submit
+      description: Confirm these items before submitting the report.
+      options:
+        - label: I searched existing issues and didn't find a matching report.
+          required: true
+        - label: I can reproduce this issue on the latest commit of the default branch.
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: Commit
+      placeholder: 769e0ef
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: List Node.js, operating system, package manager, browser, and device.
+      placeholder: |
+        Node.js: 24.22.1
+        OS: Ubuntu 24.04 / macOS
+        Package manager: pnpm 12.6.0
+        Browser: Chrome on Android
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Link to a minimal public reproduction or provide sanitized code and configuration that reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: Describe the behavior you expected.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Describe what happened, including errors and logs.
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Sensitive information
+      options:
+        - label: I removed credentials, secrets, personal or customer data, and proprietary code from this report.
+          required: true

package/templates/turborepo/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,51 @@
+name: Feature request
+description: Suggest a specific change to next-friday-template-turborepo.
+labels: ["enhancement", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for changes that are ready to evaluate.
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Affected area
+      description: Select the area this request affects.
+      options:
+        - App pages and routes
+        - Backoffice collections and admin panel
+        - Components and styling
+        - Configuration and environment
+        - Tooling / CI
+        - Documentation
+        - Repository governance
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the problem or use case.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      description: Describe the smallest change that solves the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: List existing options you considered.
+    validations:
+      required: false
+  - type: checkboxes
+    id: breaking
+    attributes:
+      label: Breaking change
+      description: Indicate whether this request changes behavior for existing users.
+      options:
+        - label: This request changes an existing page route, collection, API, or public contract.

package/templates/turborepo/.github/dependabot.yml

@@ -0,0 +1,79 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Bangkok
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+      include: scope
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      minor-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directories:
+      - /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: Asia/Bangkok
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /apps/app
+      - /apps/backoffice
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:00"
+      timezone: Asia/Bangkok
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope
+    ignore:
+      - dependency-name: node
+        update-types:
+          - version-update:semver-major
+
+  - package-ecosystem: pip
+    directory: /.github/requirements
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:30"
+      timezone: Asia/Bangkok
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope

package/templates/turborepo/.github/labeler.yml

@@ -0,0 +1,25 @@
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.md"
+
+ci:
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/workflows/**"
+          - ".github/file-filters.yml"
+          - ".github/dependabot.yml"
+          - ".github/labeler.yml"
+          - ".github/zizmor.yml"
+          - ".github/requirements/**"
+          - ".github/CODEOWNERS"
+          - ".husky/**"
+
+dependencies:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/package.json"
+          - "**/pnpm-lock.yaml"
+          - "pnpm-workspace.yaml"
+          - "**/Dockerfile"
+          - ".github/requirements/**"

package/templates/turborepo/.github/pull_request_template.md

@@ -0,0 +1,25 @@
+<!-- Title: `<type>(<scope>): <subject>` with a lowercase scope and a subject of 50 characters or fewer. Repository workflows validate it. The squash merge puts the title on `main`. Delete a section that has nothing to say, except Scope. -->
+
+## Why
+
+<!-- The problem and the approach in 1-3 short sentences. No SHAs or rebase history. Link a related issue with `Closes #123`. -->
+
+## What changed
+
+<!-- 1-3 short bullets. Name a symbol or path only when it carries the change, and both sides of a rename. Name every added, changed, or removed page, collection or field, migration, and environment variable. Document new variables in `.env.example`. -->
+
+## Scope
+
+<!-- 1-3 short items: what this covers and what it deliberately leaves out. -->
+
+## Tradeoffs
+
+<!-- Only rejected alternatives a reviewer would ask about. -->
+
+## Blast Radius
+
+<!-- 1-2 sentences on who or what this touches and why that is safe or risky. If main is red, state the cost of leaving it red. -->
+
+## Verification
+
+<!-- 1-3 bullets, each a check you ran and its outcome. For a perf change, one number as before -> after. After this section, attach videos or screenshots that prove a claim. -->