@next-friday/create-app 9.1.1 → 9.2.1

package/templates/payload/package.json

@@ -2,7 +2,7 @@
   "name": "next-friday-template-payload",
   "version": "0.1.0",
   "private": true,
-  "description": "Next Friday Payload CMS template.",
+  "description": "Payload CMS application on Next.js and PostgreSQL.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/next-friday/next-friday-template-payload.git"
@@ -11,32 +11,32 @@
   "author": "Next Friday",
   "type": "module",
   "scripts": {
+    "bands:check": "node scripts/check-bands.ts",
     "build": "next build",
     "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts next.config.ts playwright.config.ts vitest.config.ts",
     "dev": "next dev",
+    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
     "generate:importmap": "payload generate:importmap",
     "generate:types": "payload generate:types",
-    "human-gates:check": "node scripts/check-human-gates.ts",
-    "intent:check": "node scripts/check-intent.ts",
     "knip": "node --env-file-if-exists=.env node_modules/knip/bin/knip.js",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
+    "loop:measure": "node scripts/measure-loop.ts",
     "migrate": "payload migrate",
     "migrate:create": "payload migrate:create",
     "payload": "payload",
-    "peers:check": "pnpm peers check",
+    "plan:check": "node scripts/check-plan.ts",
     "prepare": "husky && next typegen",
     "rules:check": "node scripts/sync-agent-rules.ts --check",
     "rules:sync": "node scripts/sync-agent-rules.ts",
     "sort-package-json": "sort-package-json package.json",
     "sort-package-json:check": "sort-package-json --check package.json",
     "start": "cp -R .next/static .next/standalone/.next/ && (test ! -d public || cp -R public .next/standalone/) && node .next/standalone/server.js",
-    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
     "test": "vitest run --passWithNoTests",
     "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- pnpm-lock.yaml pnpm-workspace.yaml \"*package.json\" \"*tsconfig.json\" .husky; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
     "test:coverage": "vitest run --coverage --passWithNoTests",
@@ -44,14 +44,14 @@
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm intent:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
-    "@payloadcms/db-postgres": "3.92.1",
-    "@payloadcms/next": "3.92.1",
-    "@payloadcms/richtext-lexical": "3.92.1",
-    "next": "16.4.3",
-    "payload": "3.92.1",
+    "@payloadcms/db-postgres": "3.93.0",
+    "@payloadcms/next": "3.93.0",
+    "@payloadcms/richtext-lexical": "3.93.0",
+    "next": "16.4.5",
+    "payload": "3.93.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "sharp": "0.35.5"
@@ -61,13 +61,14 @@
     "@next-friday/commitlint-config-friday": "4.0.0",
     "@next-friday/eslint-config-friday": "5.1.0",
     "@next-friday/prettier-config-friday": "4.0.0",
-    "@next/eslint-plugin-next": "16.4.3",
+    "@next/eslint-plugin-next": "16.4.5",
     "@playwright/test": "1.64.1",
+    "@swc/core": "1.16.22",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
     "fast-check": "4.10.2",
@@ -78,7 +79,8 @@
     "prettier": "3.9.10",
     "sort-package-json": "4.1.0",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.1.0",
+    "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",
   "engines": {

package/templates/payload/src/app/(frontend)/layout.tsx

@@ -3,8 +3,8 @@ import type {Metadata} from "next";
 import "./styles.css";
 
 export const metadata: Metadata = {
-  title: "Next Friday Payload template",
-  description: "Starter application for Next Friday Payload projects.",
+  title: "Payload application",
+  description: "A Payload application.",
 };
 
 export default function RootLayout(props: LayoutProps<"/">) {

package/templates/payload/src/app/(frontend)/page.test.ts

@@ -8,7 +8,7 @@ describe("Page", () => {
   it("renders the template heading and the admin link", () => {
     const html = renderToStaticMarkup(createElement(Page));
 
-    expect(html).toContain("Next Friday Payload template");
+    expect(html).toContain("Payload application");
     expect(html).toContain('href="/admin"');
   });
 });

package/templates/payload/src/app/(frontend)/page.tsx

@@ -3,7 +3,7 @@ import Link from "next/link";
 export default function Page() {
   return (
     <main>
-      <h1>Next Friday Payload template</h1>
+      <h1>Payload application</h1>
 
       <p>
         Edit <code>src/app/(frontend)/page.tsx</code> to get started, or open the{" "}

package/templates/payload/src/app/health/route.test.ts

@@ -1,4 +1,5 @@
-import {describe, expect, it, vi} from "vitest";
+import {beforeEach, describe, expect, it, vi} from "vitest";
+import {getPayload} from "payload";
 
 import {GET} from "./route";
 
@@ -6,8 +7,20 @@ vi.mock("next/server", () => ({
   connection: vi.fn(async () => {}),
 }));
 
+vi.mock("@payload-config", () => ({
+  default: {},
+}));
+
+vi.mock("payload", () => ({
+  getPayload: vi.fn(),
+}));
+
 describe("GET /health", () => {
-  it("reports ok without caching", async () => {
+  beforeEach(() => {
+    vi.mocked(getPayload).mockReset();
+  });
+
+  it("reports ok without caching once Payload is ready", async () => {
     const response = await GET();
 
     expect(response.status).toBe(200);
@@ -17,4 +30,9 @@ describe("GET /health", () => {
       status: "ok",
     });
   });
+
+  it("fails when Payload cannot initialise", async () => {
+    vi.mocked(getPayload).mockRejectedValue(new Error("database unreachable"));
+    await expect(GET()).rejects.toThrow("database unreachable");
+  });
 });

package/templates/payload/src/app/health/route.ts

@@ -1,13 +1,20 @@
+import config from "@payload-config";
 import {connection} from "next/server";
+import {getPayload} from "payload";
 
 /**
- * Report that the server is up, for platform health checks. Rendered per request and never cached, so a
- * stopped server cannot pass from a cached response.
+ * Report that the server is up and Payload is ready, for platform health checks. Initialising Payload connects to
+ * the database and applies pending migrations, so an unreachable or unmigrated database fails the check. Rendered
+ * per request and never cached, so a stopped server cannot pass from a cached response.
  * @returns A JSON response with `status: "ok"`.
  */
 async function get(): Promise<Response> {
   await connection();
 
+  await getPayload({
+    config,
+  });
+
   return Response.json(
     {
       status: "ok",

package/templates/payload/src/collections/media.test.ts

@@ -1,8 +1,12 @@
-import {describe, expect, it} from "vitest";
+import {afterEach, describe, expect, it, vi} from "vitest";
 import type {PayloadRequest} from "payload";
 
 import {Media} from "./media";
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 describe("Media", () => {
   it("lets anyone read uploaded files", () => {
     const read = Media.access?.read;
@@ -24,4 +28,35 @@ describe("Media", () => {
       }),
     );
   });
+
+  it.each([
+    ["image/png", true],
+    ["image/svg+xml", false],
+  ])("validates the uploaded file type %s as accepted: %j", async (mimeType, accepted) => {
+    vi.stubEnv("APP_URL", "http://localhost:3000");
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("../payload.config");
+    const resolved = await config;
+    const media = resolved.collections.find(collection => collection.slug === "media");
+
+    const field = media?.fields.find(
+      candidate => "name" in candidate && candidate.name === "mimeType",
+    );
+
+    expect(field).toBeDefined();
+
+    const {validate} = field as {
+      validate?: (value: string, options: object) => unknown;
+    };
+
+    const result = validate?.(mimeType, {
+      siblingData: {
+        filename: "upload",
+      },
+    });
+
+    expect(result === true).toBe(accepted);
+  });
 });

package/templates/payload/src/collections/media.ts

@@ -10,7 +10,7 @@ export const Media: CollectionConfig = {
     },
   ],
   upload: {
-    mimeTypes: ["image/*"],
+    mimeTypes: ["image/avif", "image/gif", "image/jpeg", "image/png", "image/webp"],
   },
   access: {
     read: () => true,

package/templates/payload/src/payload.config.test.ts

@@ -5,8 +5,11 @@ interface PackageManifest {
   dependencies?: Record<string, string>;
 }
 
+const publicURL = "https://app.example.test";
+
 afterEach(() => {
   vi.unstubAllEnvs();
+  vi.resetModules();
 });
 
 describe("payload config", () => {
@@ -21,6 +24,18 @@ describe("payload config", () => {
     expect(resolved.graphQL.disable).toBe(true);
   });
 
+  it("accepts cross-origin requests only from the public URL", async () => {
+    vi.stubEnv("APP_URL", publicURL);
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("./payload.config");
+    const resolved = await config;
+
+    expect(resolved.serverURL).toBe(publicURL);
+    expect(resolved.cors).toEqual([publicURL]);
+  });
+
   it("does not add an extra peer dependency", () => {
     const manifest = JSON.parse(
       readFileSync(new URL("../package.json", import.meta.url), "utf8"),

package/templates/payload/test/home.e2e.test.ts

@@ -1,13 +1,9 @@
 import {expect, test} from "@playwright/test";
 
-test("home page shows the template heading", async ({page}) => {
-  await page.goto("/");
+test("serves the home page", async ({page}) => {
+  const response = await page.goto("/");
 
-  await expect(
-    page.getByRole("heading", {
-      level: 1,
-    }),
-  ).toHaveText("Next Friday Payload template");
+  expect(response?.status()).toBe(200);
 });
 
 test("admin panel asks for a user to sign in or create the first user", async ({page}) => {

package/templates/payload/tsconfig.json

@@ -18,7 +18,6 @@
       }
     ],
     "paths": {
-      "@/*": ["./src/*"],
       "@payload-config": ["./src/payload.config.ts"]
     },
     "allowJs": true

package/templates/turborepo/.agents/agents/verifier.md

@@ -1 +1 @@
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.agents/review.md

@@ -0,0 +1,21 @@
+# Review instructions
+
+## Passes
+
+Run three passes and tag each finding with its pass:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection risks, authentication gaps, PII in logs
+- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+
+## What Important means here
+
+Reserve Important for findings that would break behavior, leak data or breach a policy. Style and naming are nits.
+
+## Cap the nits
+
+Report at most five nits per review; summarize the rest as a count.
+
+## Do not report
+
+Generated files and anything CI already enforces: `pnpm-lock.yaml`, `apps/backoffice/src/app/(payload)/**`, `apps/backoffice/src/migrations/**`, and `apps/backoffice/src/payload-types.ts`.

package/templates/turborepo/.claude/agents/verifier.md

@@ -4,4 +4,4 @@ description: Runs the app and checks the change works before the session reports
 tools: Bash, Read
 ---
 
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.cursor/agents/verifier.md

@@ -4,4 +4,4 @@ description: Runs the app and checks the change works before the session reports
 readonly: true
 ---
 
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.dockerignore

@@ -1,12 +1,17 @@
-node_modules
+*
+!package.json
+!pnpm-lock.yaml
+!pnpm-workspace.yaml
+!apps/
+!packages/
 **/node_modules
 **/.next
 **/.turbo
 **/coverage
+**/test-results
+**/playwright-report
+apps/backoffice/media
 **/.env
 **/.env.*
-!**/.env.example
-.git
-.github
 **/*.test.ts
 **/*.test.tsx

package/templates/turborepo/.github/ISSUE_TEMPLATE/bug.yml

@@ -21,7 +21,22 @@ body:
     id: version
     attributes:
       label: Commit
-      placeholder: 769e0ef
+      placeholder: Output of `git rev-parse --short HEAD`
+    validations:
+      required: true
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Affected area
+      description: Select the area where the problem appears.
+      options:
+        - App pages and routes
+        - Backoffice collections and admin panel
+        - Components and styling
+        - Configuration and environment
+        - Tooling / CI
+        - Documentation
+        - Repository governance
     validations:
       required: true
   - type: textarea

package/templates/turborepo/.github/dependabot.yml

@@ -7,7 +7,6 @@ updates:
       interval: weekly
       day: monday
       time: "09:00"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     open-pull-requests-limit: 10
@@ -15,10 +14,6 @@ updates:
       prefix: chore
       prefix-development: chore
       include: scope
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - version-update:semver-major
     groups:
       minor-patch:
         applies-to: version-updates
@@ -29,13 +24,11 @@ updates:
           - patch
 
   - package-ecosystem: github-actions
-    directories:
-      - /
+    directory: /
     schedule:
       interval: weekly
       day: monday
       time: "09:30"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:
@@ -54,7 +47,6 @@ updates:
       interval: weekly
       day: monday
       time: "10:00"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:
@@ -71,7 +63,6 @@ updates:
       interval: weekly
       day: monday
       time: "10:30"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:

package/templates/turborepo/.github/scripts/affected-apps.sh

@@ -5,27 +5,9 @@ base="${1-}"
 head="${2:-HEAD}"
 
 if [[ -z "$base" ]]; then
-  printf '%s\n' app backoffice
-  exit 0
-fi
-
-query="$(pnpm exec turbo query affected --packages --base "$base" --head "$head")"
-paths="$(printf '%s' "$query" | jq -r '.data.affectedPackages.items[].path // empty')"
-
-app=false
-backoffice=false
-
-while IFS= read -r path; do
-  case "$path" in
-    apps/app) app=true ;;
-    apps/backoffice) backoffice=true ;;
-  esac
-done <<< "$paths"
-
-if [[ "$app" == true ]]; then
-  printf '%s\n' app
-fi
-
-if [[ "$backoffice" == true ]]; then
-  printf '%s\n' backoffice
+  query="$(pnpm exec turbo query 'query { packages { items { path } } }')"
+  printf '%s' "$query" | jq --compact-output '[.data.packages.items[].path | select(startswith("apps/")) | ltrimstr("apps/")]'
+else
+  query="$(pnpm exec turbo query affected --packages --base "$base" --head "$head")"
+  printf '%s' "$query" | jq --compact-output '[.data.affectedPackages.items[].path | select(startswith("apps/")) | ltrimstr("apps/")]'
 fi