@next-friday/create-app 9.1.1 → 9.2.0

package/templates/turborepo/REVIEW.md

@@ -0,0 +1,21 @@
+# Review instructions
+
+## Passes
+
+Run three passes and tag each finding with its pass:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection risks, authentication gaps, PII in logs
+- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+
+## What Important means here
+
+Reserve Important for findings that would break behavior, leak data or breach a policy. Style and naming are nits.
+
+## Cap the nits
+
+Report at most five nits per review; summarize the rest as a count.
+
+## Do not report
+
+Generated files and anything CI already enforces: `pnpm-lock.yaml`, `apps/backoffice/src/app/(payload)/**`, `apps/backoffice/src/migrations/**`, and `apps/backoffice/src/payload-types.ts`.

package/templates/turborepo/apps/app/.dependency-cruiser.json

@@ -20,8 +20,8 @@
     }
   ],
   "options": {
+    "parser": "swc",
     "skipAnalysisNotInRules": true,
-    "tsPreCompilationDeps": true,
     "enhancedResolveOptions": {
       "conditionNames": ["import", "require", "node", "default", "types"],
       "exportsFields": ["exports"]

package/templates/turborepo/apps/app/AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/templates/turborepo/apps/app/Dockerfile

@@ -1,6 +1,6 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
 FROM \
-  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
   AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
@@ -14,7 +14,7 @@ COPY apps/app/app apps/app/app
 RUN pnpm --filter ./apps/app build
 
 FROM \
-  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+  node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.

package/templates/turborepo/apps/app/app/layout.tsx

@@ -14,8 +14,8 @@ const geistMono = Geist_Mono({
 });
 
 export const metadata: Metadata = {
-  title: "Next Friday Next.js template",
-  description: "Starter application for Next Friday Next.js projects.",
+  title: "Next.js application",
+  description: "A Next.js application.",
 };
 
 export default function RootLayout(props: LayoutProps<"/">) {

package/templates/turborepo/apps/app/app/page.test.ts

@@ -6,6 +6,6 @@ import Page from "./page";
 
 describe("Page", () => {
   it("renders the template heading", () => {
-    expect(renderToStaticMarkup(createElement(Page))).toContain("Next Friday Next.js template");
+    expect(renderToStaticMarkup(createElement(Page))).toContain("Next.js application");
   });
 });

package/templates/turborepo/apps/app/app/page.tsx

@@ -1,7 +1,7 @@
 export default function Page() {
   return (
     <main className="flex flex-1 flex-col items-center justify-center gap-4 p-16 text-center">
-      <h1 className="text-3xl font-semibold tracking-tight">Next Friday Next.js template</h1>
+      <h1 className="text-3xl font-semibold tracking-tight">Next.js application</h1>
       <p className="text-lg text-zinc-600 dark:text-zinc-400">Edit app/page.tsx to get started.</p>
     </main>
   );

package/templates/turborepo/apps/app/package.json

@@ -2,7 +2,7 @@
   "name": "@next-friday-template-turborepo/app",
   "version": "0.1.0",
   "private": true,
-  "description": "Next Friday Next.js app.",
+  "description": "Next.js application.",
   "license": "UNLICENSED",
   "type": "module",
   "scripts": {
@@ -11,7 +11,7 @@
     "dev": "next dev --port 3000",
     "start": "cp -R .next/static .next/standalone/apps/app/.next/ && (test ! -d public || cp -R public .next/standalone/apps/app/) && node .next/standalone/apps/app/server.js",
     "test": "vitest run --passWithNoTests",
-    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- pnpm-lock.yaml pnpm-workspace.yaml \"*package.json\" \"*tsconfig.json\" .husky; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
+    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- \":(top)pnpm-lock.yaml\" \":(top)pnpm-workspace.yaml\" \":(top)*package.json\" \":(top)*tsconfig.json\" \":(top).husky\"; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
     "test:coverage": "vitest run --coverage --passWithNoTests",
     "test:e2e": "playwright test",
     "test:watch": "vitest",
@@ -24,13 +24,13 @@
   },
   "devDependencies": {
     "@playwright/test": "1.64.1",
+    "@swc/core": "1.16.22",
     "@tailwindcss/postcss": "4.3.3",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vitest/coverage-v8": "5.0.5",
     "dependency-cruiser": "18.7.1",
-    "fast-check": "4.10.2",
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
     "vitest": "5.0.5"

package/templates/turborepo/apps/app/test/home.e2e.test.ts

@@ -1,11 +1,7 @@
 import {expect, test} from "@playwright/test";
 
-test("home page shows the template heading", async ({page}) => {
-  await page.goto("/");
+test("serves the home page", async ({page}) => {
+  const response = await page.goto("/");
 
-  await expect(
-    page.getByRole("heading", {
-      level: 1,
-    }),
-  ).toHaveText("Next Friday Next.js template");
+  expect(response?.status()).toBe(200);
 });

package/templates/turborepo/apps/app/tsconfig.json

@@ -17,9 +17,6 @@
         "name": "next"
       }
     ],
-    "paths": {
-      "@/*": ["./*"]
-    },
     "allowJs": true
   },
   "include": [

package/templates/turborepo/apps/backoffice/.dependency-cruiser.json

@@ -20,8 +20,8 @@
     }
   ],
   "options": {
+    "parser": "swc",
     "skipAnalysisNotInRules": true,
-    "tsPreCompilationDeps": true,
     "enhancedResolveOptions": {
       "conditionNames": ["import", "require", "node", "default", "types"],
       "exportsFields": ["exports"]

package/templates/turborepo/apps/backoffice/AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/templates/turborepo/apps/backoffice/Dockerfile

@@ -1,6 +1,6 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
 FROM \
-  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
   AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
@@ -16,7 +16,7 @@ COPY apps/backoffice/src apps/backoffice/src
 RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3001 pnpm --filter ./apps/backoffice build
 
 FROM \
-  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+  node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.

package/templates/turborepo/apps/backoffice/package.json

@@ -2,7 +2,7 @@
   "name": "@next-friday-template-turborepo/backoffice",
   "version": "0.1.0",
   "private": true,
-  "description": "Next Friday Payload backoffice.",
+  "description": "Payload CMS application on Next.js and PostgreSQL.",
   "license": "UNLICENSED",
   "type": "module",
   "scripts": {
@@ -14,9 +14,9 @@
     "migrate": "payload migrate",
     "migrate:create": "payload migrate:create",
     "payload": "payload",
-    "start": "cp -R .next/static .next/standalone/apps/backoffice/.next/ && (test ! -d public || cp -R public .next/standalone/apps/backoffice/) && PORT=3001 node .next/standalone/apps/backoffice/server.js",
+    "start": "cp -R .next/static .next/standalone/apps/backoffice/.next/ && (test ! -d public || cp -R public .next/standalone/apps/backoffice/) && PORT=3001 node --env-file-if-exists=../../.env .next/standalone/apps/backoffice/server.js",
     "test": "vitest run --passWithNoTests",
-    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- pnpm-lock.yaml pnpm-workspace.yaml \"*package.json\" \"*tsconfig.json\" .husky; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
+    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- \":(top)pnpm-lock.yaml\" \":(top)pnpm-workspace.yaml\" \":(top)*package.json\" \":(top)*tsconfig.json\" \":(top).husky\"; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
     "test:coverage": "vitest run --coverage --passWithNoTests",
     "test:e2e": "playwright test",
     "test:watch": "vitest",
@@ -34,6 +34,7 @@
   },
   "devDependencies": {
     "@playwright/test": "1.64.1",
+    "@swc/core": "1.16.22",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",

package/templates/turborepo/apps/backoffice/src/app/(frontend)/layout.tsx

@@ -3,8 +3,8 @@ import type {Metadata} from "next";
 import "./styles.css";
 
 export const metadata: Metadata = {
-  title: "Next Friday Payload template",
-  description: "Starter application for Next Friday Payload projects.",
+  title: "Payload application",
+  description: "A Payload application.",
 };
 
 export default function RootLayout(props: LayoutProps<"/">) {

package/templates/turborepo/apps/backoffice/src/app/(frontend)/page.test.ts

@@ -8,7 +8,7 @@ describe("Page", () => {
   it("renders the template heading and the admin link", () => {
     const html = renderToStaticMarkup(createElement(Page));
 
-    expect(html).toContain("Next Friday Payload template");
+    expect(html).toContain("Payload application");
     expect(html).toContain('href="/admin"');
   });
 });

package/templates/turborepo/apps/backoffice/src/app/(frontend)/page.tsx

@@ -3,7 +3,7 @@ import Link from "next/link";
 export default function Page() {
   return (
     <main>
-      <h1>Next Friday Payload template</h1>
+      <h1>Payload application</h1>
 
       <p>
         Edit <code>src/app/(frontend)/page.tsx</code> to get started, or open the{" "}

package/templates/turborepo/apps/backoffice/src/app/health/route.test.ts

@@ -1,4 +1,5 @@
-import {describe, expect, it, vi} from "vitest";
+import {beforeEach, describe, expect, it, vi} from "vitest";
+import {getPayload} from "payload";
 
 import {GET} from "./route";
 
@@ -6,8 +7,20 @@ vi.mock("next/server", () => ({
   connection: vi.fn(async () => {}),
 }));
 
+vi.mock("../../payload.config", () => ({
+  default: {},
+}));
+
+vi.mock("payload", () => ({
+  getPayload: vi.fn(),
+}));
+
 describe("GET /health", () => {
-  it("reports ok without caching", async () => {
+  beforeEach(() => {
+    vi.mocked(getPayload).mockReset();
+  });
+
+  it("reports ok without caching once Payload is ready", async () => {
     const response = await GET();
 
     expect(response.status).toBe(200);
@@ -17,4 +30,9 @@ describe("GET /health", () => {
       status: "ok",
     });
   });
+
+  it("fails when Payload cannot initialise", async () => {
+    vi.mocked(getPayload).mockRejectedValue(new Error("database unreachable"));
+    await expect(GET()).rejects.toThrow("database unreachable");
+  });
 });

package/templates/turborepo/apps/backoffice/src/app/health/route.ts

@@ -1,13 +1,21 @@
 import {connection} from "next/server";
+import {getPayload} from "payload";
+
+import config from "../../payload.config";
 
 /**
- * Report that the server is up, for platform health checks. Rendered per request and never cached, so a
- * stopped server cannot pass from a cached response.
+ * Report that the server is up and Payload is ready, for platform health checks. Initialising Payload connects to
+ * the database and applies pending migrations, so an unreachable or unmigrated database fails the check. Rendered
+ * per request and never cached, so a stopped server cannot pass from a cached response.
  * @returns A JSON response with `status: "ok"`.
  */
 async function get(): Promise<Response> {
   await connection();
 
+  await getPayload({
+    config,
+  });
+
   return Response.json(
     {
       status: "ok",

package/templates/turborepo/apps/backoffice/src/collections/media.test.ts

@@ -1,8 +1,12 @@
-import {describe, expect, it} from "vitest";
+import {afterEach, describe, expect, it, vi} from "vitest";
 import type {PayloadRequest} from "payload";
 
 import {Media} from "./media";
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 describe("Media", () => {
   it("lets anyone read uploaded files", () => {
     const read = Media.access?.read;
@@ -24,4 +28,35 @@ describe("Media", () => {
       }),
     );
   });
+
+  it.each([
+    ["image/png", true],
+    ["image/svg+xml", false],
+  ])("validates the uploaded file type %s as accepted: %j", async (mimeType, accepted) => {
+    vi.stubEnv("APP_URL", "http://localhost:3001");
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("../payload.config");
+    const resolved = await config;
+    const media = resolved.collections.find(collection => collection.slug === "media");
+
+    const field = media?.fields.find(
+      candidate => "name" in candidate && candidate.name === "mimeType",
+    );
+
+    expect(field).toBeDefined();
+
+    const {validate} = field as {
+      validate?: (value: string, options: object) => unknown;
+    };
+
+    const result = validate?.(mimeType, {
+      siblingData: {
+        filename: "upload",
+      },
+    });
+
+    expect(result === true).toBe(accepted);
+  });
 });

package/templates/turborepo/apps/backoffice/src/collections/media.ts

@@ -10,7 +10,7 @@ export const Media: CollectionConfig = {
     },
   ],
   upload: {
-    mimeTypes: ["image/*"],
+    mimeTypes: ["image/avif", "image/gif", "image/jpeg", "image/png", "image/webp"],
   },
   access: {
     read: () => true,

package/templates/turborepo/apps/backoffice/src/environment.test.ts

@@ -1,10 +1,16 @@
 import {afterEach, describe, expect, it, vi} from "vitest";
 import {assert, property, string} from "fast-check";
+import {existsSync} from "node:fs";
 
 import {requireEnvironment} from "./environment";
 
+vi.mock("node:fs", () => ({
+  existsSync: vi.fn(() => false),
+}));
+
 afterEach(() => {
   vi.unstubAllEnvs();
+  vi.restoreAllMocks();
 });
 
 describe("requireEnvironment", () => {
@@ -29,4 +35,17 @@ describe("requireEnvironment", () => {
       "EXAMPLE_VALUE environment variable is required",
     );
   });
+
+  it.each([
+    [true, 1],
+    [false, 0],
+  ])("loads the workspace .env only when it exists: %j", (exists, loads) => {
+    vi.mocked(existsSync).mockReturnValue(exists);
+
+    const loadEnvironmentFile = vi.spyOn(process, "loadEnvFile").mockImplementation(() => {});
+
+    vi.stubEnv("EXAMPLE_VALUE", "value");
+    requireEnvironment("EXAMPLE_VALUE");
+    expect(loadEnvironmentFile).toHaveBeenCalledTimes(loads);
+  });
 });

package/templates/turborepo/apps/backoffice/src/payload.config.test.ts

@@ -5,8 +5,11 @@ interface PackageManifest {
   dependencies?: Record<string, string>;
 }
 
+const publicURL = "https://app.example.test";
+
 afterEach(() => {
   vi.unstubAllEnvs();
+  vi.resetModules();
 });
 
 describe("payload config", () => {
@@ -21,6 +24,18 @@ describe("payload config", () => {
     expect(resolved.graphQL.disable).toBe(true);
   });
 
+  it("accepts cross-origin requests only from the public URL", async () => {
+    vi.stubEnv("APP_URL", publicURL);
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("./payload.config");
+    const resolved = await config;
+
+    expect(resolved.serverURL).toBe(publicURL);
+    expect(resolved.cors).toEqual([publicURL]);
+  });
+
   it("does not add an extra peer dependency", () => {
     const manifest = JSON.parse(
       readFileSync(new URL("../package.json", import.meta.url), "utf8"),

package/templates/turborepo/apps/backoffice/test/home.e2e.test.ts

@@ -1,13 +1,9 @@
 import {expect, test} from "@playwright/test";
 
-test("home page shows the template heading", async ({page}) => {
-  await page.goto("/");
+test("serves the home page", async ({page}) => {
+  const response = await page.goto("/");
 
-  await expect(
-    page.getByRole("heading", {
-      level: 1,
-    }),
-  ).toHaveText("Next Friday Payload template");
+  expect(response?.status()).toBe(200);
 });
 
 test("admin panel asks for a user to sign in or create the first user", async ({page}) => {

package/templates/turborepo/apps/backoffice/tsconfig.json

@@ -18,7 +18,6 @@
       }
     ],
     "paths": {
-      "@/*": ["./src/*"],
       "@payload-config": ["./src/payload.config.ts"]
     },
     "allowJs": true

package/templates/turborepo/knip.json

@@ -1,9 +1,11 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
-  "ignoreDependencies": ["fast-check"],
   "workspaces": {
     "apps/app": {
-      "ignoreDependencies": ["fast-check"]
+      "ignoreDependencies": ["@swc/core"]
+    },
+    "apps/backoffice": {
+      "ignoreDependencies": ["@swc/core"]
     }
   }
 }

package/templates/turborepo/package.json

@@ -2,7 +2,7 @@
   "name": "next-friday-template-turborepo",
   "version": "0.1.0",
   "private": true,
-  "description": "Next Friday Turborepo template.",
+  "description": "Turborepo workspace with a Next.js application and a Payload CMS backoffice.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/next-friday/next-friday-template-turborepo.git"
@@ -11,39 +11,39 @@
   "author": "Next Friday",
   "type": "module",
   "scripts": {
-    "build": "turbo run build ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "bands:check": "node scripts/check-bands.ts",
+    "build": "turbo run build $TURBO_FILTER",
     "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf apps/app/.next apps/app/coverage apps/backoffice/.next apps/backoffice/coverage .turbo coverage *.tsbuildinfo .eslintcache node_modules/.cache",
-    "depcruise": "turbo run depcruise ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "depcruise": "turbo run depcruise $TURBO_FILTER",
     "dev": "turbo run dev --filter=./apps/*",
+    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
     "generate:importmap": "pnpm --filter ./apps/backoffice generate:importmap",
     "generate:types": "pnpm --filter ./apps/backoffice generate:types",
-    "human-gates:check": "node scripts/check-human-gates.ts",
-    "intent:check": "node scripts/check-intent.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
+    "loop:measure": "node scripts/measure-loop.ts",
     "migrate": "pnpm --filter ./apps/backoffice migrate",
     "migrate:create": "pnpm --filter ./apps/backoffice migrate:create",
-    "peers:check": "pnpm peers check",
+    "plan:check": "node scripts/check-plan.ts",
     "prepare": "husky && pnpm --filter ./apps/app exec next typegen && pnpm --filter ./apps/backoffice exec next typegen",
     "rules:check": "node scripts/sync-agent-rules.ts --check",
     "rules:sync": "node scripts/sync-agent-rules.ts",
     "sort-package-json": "sort-package-json package.json apps/app/package.json apps/backoffice/package.json",
     "sort-package-json:check": "sort-package-json --check package.json apps/app/package.json apps/backoffice/package.json",
     "start": "turbo run start --filter=./apps/*",
-    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
-    "test": "turbo run test ${TURBO_FILTER:-\"--filter=./apps/*\"}",
-    "test:changed": "turbo run test:changed ${TURBO_FILTER:-\"--filter=./apps/*\"}",
-    "test:coverage": "turbo run test:coverage ${TURBO_FILTER:-\"--filter=./apps/*\"}",
-    "test:e2e": "turbo run test:e2e ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "test": "turbo run test $TURBO_FILTER",
+    "test:changed": "turbo run test:changed $TURBO_FILTER",
+    "test:coverage": "turbo run test:coverage $TURBO_FILTER",
+    "test:e2e": "turbo run test:e2e $TURBO_FILTER",
     "test:watch": "turbo run test:watch --filter=./apps/*",
-    "typecheck": "tsc --noEmit -p tsconfig.json && turbo run typecheck ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "typecheck": "tsc --noEmit -p tsconfig.json && turbo run typecheck $TURBO_FILTER",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm intent:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {
     "@commitlint/cli": "21.2.4",
@@ -54,7 +54,6 @@
     "@types/node": "26.6.6",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
-    "fast-check": "4.10.2",
     "husky": "9.1.7",
     "jiti": "2.7.0",
     "knip": "6.44.1",
@@ -63,7 +62,8 @@
     "prettier-plugin-tailwindcss": "0.8.1",
     "sort-package-json": "4.1.0",
     "turbo": "2.11.10",
-    "typescript": "7.0.2"
+    "typescript": "7.0.2",
+    "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",
   "engines": {

package/templates/turborepo/pnpm-workspace.yaml

@@ -4,6 +4,7 @@ packages:
 engineStrict: true
 savePrefix: ""
 allowBuilds:
+  "@swc/core": false
   esbuild: true
   unrs-resolver: true
 overrides:
@@ -16,31 +17,9 @@ overrides:
   "minimatch@<11.0.1": ^11.0.1
 minimumReleaseAgeExclude:
   - "@next-friday/commitlint-config-friday@4.0.0"
-  - "@next-friday/eslint-config-friday@5.0.0"
   - "@next-friday/eslint-config-friday@5.1.0"
   - "@next-friday/prettier-config-friday@4.0.0"
   - "@next-friday/eslint-plugin-friday@1.1.3"
-packageExtensions:
-  payload:
-    peerDependenciesMeta:
-      graphql:
-        optional: true
-  "@payloadcms/next":
-    peerDependenciesMeta:
-      graphql:
-        optional: true
-  "@payloadcms/graphql":
-    peerDependenciesMeta:
-      graphql:
-        optional: true
-  graphql-http:
-    peerDependenciesMeta:
-      graphql:
-        optional: true
-  graphql-scalars:
-    peerDependenciesMeta:
-      graphql:
-        optional: true
 peerDependencyRules:
   ignoreMissing:
     - graphql