create-nexst-monorepo 0.1.0

package/template/apps/api/src/utils/prisma-graphql-exception.filter.spec.ts

@@ -0,0 +1,216 @@
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
+import { GraphQLError } from "graphql";
+import { vi } from "vitest";
+import type { MockInstance } from "vitest";
+import { ErrorCode } from "#src/errors/error-code.enum.js";
+import { Prisma } from "#src/generated/prisma/client.js";
+import { ContextLogger } from "#src/logging/context-logger.js";
+import { PrismaGraphQLExceptionFilter } from "#src/utils/prisma-graphql-exception.filter.js";
+
+describe("prismaGraphQLExceptionFilter", () => {
+  let filter: PrismaGraphQLExceptionFilter;
+  let loggerErrorSpy: MockInstance;
+
+  beforeEach(async () => {
+    const mockLogger = { debug: vi.fn(), error: vi.fn(), setContext: vi.fn() };
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [PrismaGraphQLExceptionFilter, { provide: ContextLogger, useValue: mockLogger }],
+    }).compile();
+
+    filter = module.get<PrismaGraphQLExceptionFilter>(PrismaGraphQLExceptionFilter);
+    loggerErrorSpy = mockLogger.error;
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("catch", () => {
+    it("should handle PrismaClientKnownRequestError and return GraphQLError", () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError(
+        "Unique constraint failed on the fields: (`email`)",
+        {
+          clientVersion: "5.0.0",
+          code: "P2002",
+        },
+      );
+
+      const result = filter.catch(prismaError);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(result.extensions?.code).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: prismaError.message, stack: prismaError.stack },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should handle PrismaClientUnknownRequestError and return GraphQLError", () => {
+      const prismaError = new Prisma.PrismaClientUnknownRequestError("Unknown database error", {
+        clientVersion: "5.0.0",
+      });
+
+      const result = filter.catch(prismaError);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(result.extensions?.code).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: prismaError.message, stack: prismaError.stack },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should handle PrismaClientValidationError and return GraphQLError", () => {
+      const prismaError = new Prisma.PrismaClientValidationError(
+        "Invalid query: missing required field",
+        { clientVersion: "5.0.0" },
+      );
+
+      const result = filter.catch(prismaError);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(result.extensions?.code).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: prismaError.message, stack: prismaError.stack },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should log error message and stack for Error instances", () => {
+      const error = new Error("Test error message");
+
+      filter.catch(error);
+
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "Test error message", stack: error.stack },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should log string representation for non-Error exceptions", () => {
+      const exception = { someProperty: "some value" };
+
+      filter.catch(exception);
+
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "[object Object]", stack: undefined },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should log for null exceptions", () => {
+      filter.catch(null);
+
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "null", stack: undefined },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should log for undefined exceptions", () => {
+      filter.catch(undefined);
+
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "undefined", stack: undefined },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should always return same GraphQLError structure", () => {
+      const error1 = new Prisma.PrismaClientKnownRequestError("Error 1", {
+        clientVersion: "5.0.0",
+        code: "P2002",
+      });
+      const error2 = new Prisma.PrismaClientValidationError("Error 2", {
+        clientVersion: "5.0.0",
+      });
+
+      const result1 = filter.catch(error1);
+      const result2 = filter.catch(error2);
+
+      expect(result1.message).toBe(result2.message);
+      expect(result1.extensions?.code).toBe(result2.extensions?.code);
+    });
+
+    it("should handle PrismaClientKnownRequestError with P2025 code", () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError(
+        "Record to delete does not exist",
+        {
+          clientVersion: "5.0.0",
+          code: "P2025",
+        },
+      );
+
+      const result = filter.catch(prismaError);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(loggerErrorSpy).toHaveBeenCalled();
+    });
+
+    it("should handle PrismaClientKnownRequestError with P2003 code", () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError(
+        "Foreign key constraint failed",
+        {
+          clientVersion: "5.0.0",
+          code: "P2003",
+        },
+      );
+
+      const result = filter.catch(prismaError);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: prismaError.message, stack: prismaError.stack },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should not expose internal error details in GraphQL response", () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError(
+        "Sensitive database information: user_id=123, password=secret",
+        {
+          clientVersion: "5.0.0",
+          code: "P2002",
+        },
+      );
+
+      const result = filter.catch(prismaError);
+
+      expect(result.message).toBe(ErrorCode.INTERNAL_SERVER_ERROR);
+      expect(result.message).not.toContain("Sensitive");
+      expect(result.message).not.toContain("password");
+      expect(result.message).not.toContain("user_id");
+    });
+
+    it("should handle string exceptions", () => {
+      const stringException = "Simple string error";
+
+      const result = filter.catch(stringException);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "Simple string error", stack: undefined },
+        "Prisma error in GraphQL context",
+      );
+    });
+
+    it("should handle number exceptions", () => {
+      const numberException = 404;
+
+      const result = filter.catch(numberException);
+
+      expect(result).toBeInstanceOf(GraphQLError);
+      expect(loggerErrorSpy).toHaveBeenCalledWith(
+        { error: "404", stack: undefined },
+        "Prisma error in GraphQL context",
+      );
+    });
+  });
+});

package/template/apps/api/src/utils/prisma-graphql-exception.filter.ts

@@ -0,0 +1,43 @@
+import { Catch } from "@nestjs/common";
+import type { GqlExceptionFilter } from "@nestjs/graphql";
+import { GraphQLError } from "graphql";
+import { ErrorCode } from "#src/errors/error-code.enum.js";
+import { Prisma } from "#src/generated/prisma/client.js";
+import { ContextLogger } from "#src/logging/context-logger.js";
+import { handleError } from "#src/utils/error-handler.util.js";
+
+/**
+ * GraphQL exception filter for handling Prisma database errors in GraphQL contexts.
+ *
+ * This filter intercepts Prisma client errors that occur during GraphQL query/mutation
+ * execution and transforms them into standardized GraphQL errors. It prevents sensitive
+ * database information from being exposed to clients by returning generic error messages.
+ */
+@Catch(
+  Prisma.PrismaClientKnownRequestError,
+  Prisma.PrismaClientUnknownRequestError,
+  Prisma.PrismaClientValidationError,
+)
+export class PrismaGraphQLExceptionFilter implements GqlExceptionFilter {
+  constructor(readonly logger: ContextLogger) {}
+
+  /**
+   * Catches and processes Prisma errors in GraphQL context.
+   *
+   * @param exception - The Prisma error that was thrown
+   * @returns A GraphQL error with sanitized error information
+   */
+  catch(exception: unknown) {
+    this.logger.error(
+      {
+        error: handleError(exception),
+        stack: exception instanceof Error ? exception.stack : undefined,
+      },
+      "Prisma error in GraphQL context",
+    );
+
+    return new GraphQLError(ErrorCode.INTERNAL_SERVER_ERROR, {
+      extensions: { code: ErrorCode.INTERNAL_SERVER_ERROR },
+    });
+  }
+}

package/template/apps/api/tests/app.e2e-spec.ts

@@ -0,0 +1,35 @@
+import { API_URL, graphql } from "#tests/helpers/api.js";
+
+describe("app (e2e)", () => {
+  describe("health", () => {
+    it("is ready", async () => {
+      const response = await fetch(`${API_URL}/health`);
+
+      expect(response.status).toBe(200);
+    });
+
+    it("is live", async () => {
+      const response = await fetch(`${API_URL}/health/live`);
+
+      expect(response.status).toBe(200);
+      await expect(response.json()).resolves.toMatchObject({ status: "ok" });
+    });
+  });
+
+  describe("graphql", () => {
+    it("answers the public appInfo query", async () => {
+      const { data, errors } = await graphql<{ appInfo: { title: string } }>(
+        "query { appInfo { title version } }",
+      );
+
+      expect(errors).toBeUndefined();
+      expect(data?.appInfo.title).toBeTruthy();
+    });
+
+    it("rejects malformed input with a machine-readable code", async () => {
+      const { errors } = await graphql("query { doesNotExist }");
+
+      expect(errors?.[0]?.extensions?.code).toBeTruthy();
+    });
+  });
+});

package/template/apps/api/tests/auth.e2e-spec.ts

@@ -0,0 +1,38 @@
+import { randomUUID } from "node:crypto";
+import { API_URL, graphql } from "#tests/helpers/api.js";
+
+/**
+ * Needs the API running with NODE_ENV=test so sign-up skips the verification
+ * mail (see `buildBaseAuthOptions`).
+ */
+describe("auth (e2e)", () => {
+  const email = `e2e-${randomUUID()}@example.com`;
+  const password = "correct-horse-battery-staple";
+
+  async function signUp(): Promise<string> {
+    const response = await fetch(`${API_URL}/api/auth/sign-up/email`, {
+      body: JSON.stringify({ email, name: "E2E", password }),
+      headers: { "Content-Type": "application/json", Origin: "http://localhost:3000" },
+      method: "POST",
+    });
+    expect(response.status).toBe(200);
+    return response.headers.getSetCookie().join("; ");
+  }
+
+  it("rejects `me` without a session", async () => {
+    const { errors } = await graphql("query { me { id } }");
+
+    expect(errors?.[0]?.extensions?.code).toBe("UNAUTHORIZED");
+  });
+
+  it("signs up and resolves `me` from the session cookie", async () => {
+    const cookie = await signUp();
+
+    const { data, errors } = await graphql<{ me: { email: string } }>("query { me { email } }", {
+      cookie,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.me.email).toBe(email);
+  });
+});

package/template/apps/api/tests/helpers/api.ts

@@ -0,0 +1,27 @@
+export const API_URL = process.env.API_URL ?? "http://localhost:3001";
+
+type GraphQLResponse<TData> = {
+  data?: TData;
+  errors?: { extensions?: { code?: string; params?: unknown }; message: string }[];
+};
+
+/**
+ * Sends one GraphQL operation to the running API.
+ *
+ * @param query - The operation document
+ * @param options - Variables and an optional `Cookie` header value (the session)
+ */
+export async function graphql<TData>(
+  query: string,
+  { cookie, variables }: { cookie?: string; variables?: Record<string, unknown> } = {},
+): Promise<GraphQLResponse<TData>> {
+  const response = await fetch(`${API_URL}/graphql`, {
+    body: JSON.stringify({ query, variables }),
+    headers: {
+      "Content-Type": "application/json",
+      ...(cookie ? { Cookie: cookie } : {}),
+    },
+    method: "POST",
+  });
+  return (await response.json()) as GraphQLResponse<TData>;
+}

package/template/apps/api/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "@nexst/tsconfig/node.json",
+  "compilerOptions": {
+    "allowImportingTsExtensions": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "strictPropertyInitialization": false,
+    "types": ["vitest/globals", "node"]
+  },
+  "include": ["**/*.ts"]
+}

package/template/apps/api/vitest.config.e2e.ts

@@ -0,0 +1,16 @@
+import { existsSync } from "node:fs";
+import { defineConfig } from "vitest/config";
+
+if (existsSync(".env.development")) process.loadEnvFile(".env.development");
+
+/**
+ * E2E specs talk to a running API (`bun dev` locally, the rolled-out image in
+ * CI) at `API_URL`, default http://localhost:3001.
+ */
+export default defineConfig({
+  test: {
+    globals: true,
+    include: ["tests/**/*.e2e-spec.ts"],
+    root: "./",
+  },
+});

package/template/apps/api/vitest.config.ts

@@ -0,0 +1,40 @@
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  resolve: {
+    // graphql ships a "development" export condition; without pinning one entry,
+    // @nestjs/graphql and the app load two graphql instances ("Cannot use
+    // GraphQLSchema from another module or realm").
+    alias: [{ find: /^graphql$/, replacement: fileURLToPath(import.meta.resolve("graphql")) }],
+  },
+  test: {
+    coverage: {
+      exclude: ["src/generated/**", "**/*.spec.ts"],
+      include: ["src/**/*.ts"],
+      provider: "v8",
+      reporter: ["text", "lcov"],
+    },
+    // Unit tests never reach real services; these only satisfy config validation.
+    env: {
+      // @if auth
+      BETTER_AUTH_SECRET: "unit-test-secret-unit-test-secret-1234",
+      BETTER_AUTH_URL: "http://localhost:3001",
+      // @endif
+      DATABASE_URL: "postgresql://user:pass@localhost:5432/db",
+      // @if r2
+      R2_ACCESS_KEY_ID: "unit-test",
+      R2_BUCKET: "unit-test",
+      R2_ENDPOINT: "https://unit-test.r2.cloudflarestorage.com",
+      R2_SECRET_ACCESS_KEY: "unit-test",
+      // @endif
+    },
+    globals: true,
+    include: ["src/**/*.spec.ts"],
+    isolate: false,
+    root: "./",
+    // @if worker
+    server: { deps: { inline: ["@nestjs/bullmq"] } },
+    // @endif
+  },
+});

package/template/apps/web/.env.example

@@ -0,0 +1,7 @@
+# Copy to .env (bun/next load it automatically) and adjust.
+NEXT_PUBLIC_API_URL=http://localhost:3001
+NEXT_PUBLIC_HOST_URL=http://localhost:3000
+# @if auth
+# Google sign-in (button + One Tap); same client ID as GOOGLE_CLIENT_ID in apps/api. Hidden while unset.
+# NEXT_PUBLIC_GOOGLE_CLIENT_ID=<id>.apps.googleusercontent.com
+# @endif

package/template/apps/web/.storybook/decorators.tsx

@@ -0,0 +1,38 @@
+/**
+ * Shared Storybook decorators. Stories import their providers from here so every
+ * story renders inside the same shell as the app.
+ */
+import type { Decorator } from "@storybook/nextjs-vite";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { NextIntlClientProvider } from "next-intl";
+import type { ComponentProps } from "react";
+import enMessages from "../messages/en.json";
+
+type IntlMessages = ComponentProps<typeof NextIntlClientProvider>["messages"];
+
+/** Centers the story and constrains its width — handy for form/card components. */
+export function withContainer(className = "w-96"): Decorator {
+  return (Story) => (
+    <div className={className}>
+      <Story />
+    </div>
+  );
+}
+
+function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      mutations: { retry: false },
+      queries: { retry: false, staleTime: Number.POSITIVE_INFINITY },
+    },
+  });
+}
+
+/** Intl (English catalog) + a fresh React Query client. Registered globally in preview.ts. */
+export const withProviders: Decorator = (Story) => (
+  <QueryClientProvider client={makeQueryClient()}>
+    <NextIntlClientProvider locale="en" messages={enMessages as IntlMessages}>
+      <Story />
+    </NextIntlClientProvider>
+  </QueryClientProvider>
+);

package/template/apps/web/.storybook/main.ts

@@ -0,0 +1,17 @@
+import type { StorybookConfig } from "@storybook/nextjs-vite";
+
+const config: StorybookConfig = {
+  addons: [
+    "@storybook/addon-docs",
+    "@storybook/addon-a11y",
+    "@storybook/addon-vitest",
+    "@storybook/addon-themes",
+  ],
+  framework: {
+    name: "@storybook/nextjs-vite",
+    options: {},
+  },
+  staticDirs: ["../public"],
+  stories: ["../src/**/*.stories.@(ts|tsx)"],
+};
+export default config;

package/template/apps/web/.storybook/preview.ts

@@ -0,0 +1,38 @@
+import { withThemeByClassName } from "@storybook/addon-themes";
+import type { Preview } from "@storybook/nextjs-vite";
+import { withProviders } from "./decorators";
+import "../src/app/globals.css";
+
+const preview: Preview = {
+  decorators: [
+    withProviders,
+    // Globals are "Light"/"Dark" (capitalised) — the addon crashes on other values.
+    withThemeByClassName({
+      defaultTheme: "Light",
+      themes: {
+        Dark: "dark",
+        Light: "",
+      },
+    }),
+  ],
+  parameters: {
+    a11y: {
+      // Every story is an axe check in `bun run test:unit`; violations fail the run.
+      test: "error",
+    },
+    controls: {
+      matchers: {
+        color: /(background|color)$/i,
+        date: /Date$/i,
+      },
+    },
+    nextjs: {
+      appDirectory: true,
+      navigation: {
+        pathname: "/",
+      },
+    },
+  },
+};
+
+export default preview;

package/template/apps/web/.storybook/vitest.setup.ts

@@ -0,0 +1,5 @@
+import * as a11yAddonAnnotations from "@storybook/addon-a11y/preview";
+import { setProjectAnnotations } from "@storybook/nextjs-vite";
+import * as projectAnnotations from "./preview";
+
+setProjectAnnotations([a11yAddonAnnotations, projectAnnotations]);

package/template/apps/web/AGENTS.md

@@ -0,0 +1,29 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->
+
+# web (Next.js)
+
+- i18n via next-intl: every user-facing string goes through `messages/*.json`, in every
+  locale file. Routes live under `src/app/[locale]`; use `Link`/`useRouter` from
+  `@/i18n/navigation`.
+- Styling: Tailwind 4 with the semantic tokens in `src/app/globals.css`
+  (`bg-background`, `text-muted-foreground`, …) — no raw hex or ramp steps in
+  components. Reuse `src/components/*`.
+- CSP lives in `src/config/csp.ts` and is applied by `src/proxy.ts`. New external
+  origins (API, CDN, images) must be added there. `tests/csp-theme-script.spec.ts`
+  guards the inline-script hashes.
+- API calls: `@/lib/graphql-client` (browser, cookies included) or
+  `@/lib/graphql-server` (server components, forward the cookie). Type documents with
+  `graphql()` from `@/generated/gql` after `bun run codegen` (API must be running);
+  never hand-type `TypedDocumentNode`s.
+- Server-only env in `src/env.ts` (`@t3-oss/env-nextjs`); `NEXT_PUBLIC_*` are baked in
+  at build time (Docker build args).
+- Tests: `bun run test:unit` (Vitest unit + Storybook stories incl. axe a11y),
+  `bun run test` (Playwright against `next start`).

package/template/apps/web/Dockerfile

@@ -0,0 +1,49 @@
+ARG BUN_VERSION
+
+# ---------------------------------------------------
+# Stage 1: Pruner
+# ---------------------------------------------------
+FROM toolchain AS pruner
+RUN turbo prune @nexst/web --docker
+
+# ---------------------------------------------------
+# Stage 2: Builder
+# ---------------------------------------------------
+FROM dhi.io/bun:${BUN_VERSION}-alpine-dev AS builder
+WORKDIR /app
+COPY --from=pruner /app/out/json/ .
+RUN --mount=type=cache,id=bun-install,sharing=locked,target=/root/.bun/install/cache \
+    bun install --frozen-lockfile
+COPY --from=pruner /app/out/full/ .
+
+ARG NEXT_PUBLIC_HOST_URL
+ARG NEXT_PUBLIC_API_URL
+# @if auth
+ARG NEXT_PUBLIC_GOOGLE_CLIENT_ID
+# @endif
+
+RUN cd apps/web && \
+    bun run build && \
+    cd .next/standalone/node_modules/.bun && \
+    rm -rf sharp@* @img+sharp-* node_modules/sharp node_modules/@img/sharp-* next@*/node_modules/sharp
+
+# ---------------------------------------------------
+# Stage 3: Runtime
+# ---------------------------------------------------
+FROM dhi.io/bun:${BUN_VERSION}-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    HOSTNAME=0.0.0.0 \
+    PORT=3000
+
+COPY --from=builder --chown=nonroot:nonroot /app/apps/web/.next/standalone ./
+COPY --from=builder --chown=nonroot:nonroot /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=builder --chown=nonroot:nonroot /app/apps/web/public ./apps/web/public
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=15s --retries=3 \
+  CMD ["bun", "-e", "require('http').get('http://localhost:3000/api/health', (res) => { process.exit(res.statusCode === 200 ? 0 : 1) }).on('error', () => process.exit(1))"]
+
+EXPOSE 3000
+STOPSIGNAL SIGTERM
+CMD ["bun", "apps/web/server.js"]

package/template/apps/web/_gitignore

@@ -0,0 +1,16 @@
+# next.js
+/.next/
+/out/
+next-env.d.ts
+
+# graphql codegen output (bun run codegen)
+/src/generated/
+
+# playwright
+/playwright-report/
+/playwright/.cache/
+/test-results/
+
+# storybook
+*storybook.log
+storybook-static

package/template/apps/web/knip.config.ts

@@ -0,0 +1,15 @@
+import { createKnipConfig } from "@nexst/lint/knip";
+import type { KnipConfig } from "knip";
+
+const config: KnipConfig = createKnipConfig({
+  entry: [
+    // API clients are template infrastructure: keep them until the first query uses them.
+    "src/lib/graphql-client.ts",
+    "src/lib/graphql-server.ts",
+    // The UI kit is a library: components stay exported until the app uses them.
+    "src/components/**/*.tsx", // @if ui
+  ],
+  project: ["src/**/*.{css,mdx}"],
+});
+
+export default config;

package/template/apps/web/kustomize/base/application.properties

@@ -0,0 +1,5 @@
+HOSTNAME=0.0.0.0
+NODE_ENV=production
+LOG_LEVEL=info
+NEXT_PUBLIC_API_URL=https://api.example.com
+NEXT_PUBLIC_HOST_URL=https://example.com