Refactor/monorepo architecture

.dockerignore

@@ -1,10 +1,14 @@
 Dockerfile
 .dockerignore
 node_modules
+**/node_modules
 npm-debug.log
 README.md
 .next
+**/.next
 .git
 .env
 .env.local
 .env.*.local
+/docs
+scratch

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,70 @@
+name: Bug Report
+description: Report a bug or unintended behavior in FlowCMS
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug in FlowCMS! Please fill out the form below as completely as possible. Do not include passwords, API keys, or database credentials.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is.
+      placeholder: Describe what happened...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected Area
+      description: What part of FlowCMS is affected?
+      options:
+        - "App UI / Dashboard"
+        - "Authentication (Better Auth)"
+        - "API (v1 / Internal)"
+        - "Database / Prisma / Supabase"
+        - "Webhooks / QStash"
+        - "Media Storage"
+        - "Billing (Razorpay)"
+        - "Other"
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to Reproduce
+      description: Explain step-by-step how to reproduce the bug.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '....'
+        3. Scroll down to '....'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or Stack Trace
+      description: Paste relevant browser console logs, server logs, or stack traces (redact secrets!).
+      render: shell
+
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser version, Node.js version, deployment environment (e.g. Vercel, Docker, Local).
+      placeholder: e.g. Windows 11, Chrome 120, Node 22, Vercel

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security Vulnerability Reporting
+    url: https://github.com/kjxcodez/FlowCMS/security/advisories/new
+    about: Report security vulnerabilities privately using GitHub Security Advisories.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,37 @@
+name: Feature Request
+description: Suggest an idea or feature for FlowCMS
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for suggesting a feature for FlowCMS! Please share details about the problem you are solving and your proposed solution.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Is your feature request related to a problem?
+      description: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution or feature you'd like to see implemented.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Describe any alternative solutions or features you've considered.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Add any other context, screenshots, or mockups about the feature request here.

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+
+updates:
+  # Keep npm/pnpm dependencies current (covers pnpm-lock.yaml at the monorepo root)
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    # Group minor + patch updates for common dependency categories to avoid PR spam
+    groups:
+      prisma:
+        patterns:
+          - "prisma"
+          - "@prisma/*"
+      next-ecosystem:
+        patterns:
+          - "next"
+          - "react"
+          - "react-dom"
+          - "@types/react*"
+      radix-ui:
+        patterns:
+          - "radix-ui"
+          - "@radix-ui/*"
+          - "@base-ui/*"
+      tanstack:
+        patterns:
+          - "@tanstack/*"
+      tiptap:
+        patterns:
+          - "@tiptap/*"
+      upstash:
+        patterns:
+          - "@upstash/*"
+      dnd-kit:
+        patterns:
+          - "@dnd-kit/*"
+      dev-tooling:
+        patterns:
+          - "typescript"
+          - "eslint*"
+          - "@eslint/*"
+          - "prettier"
+          - "turbo"
+          - "@types/*"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 10
+
+  # Keep GitHub Actions dependencies current
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,34 @@
+## Description
+
+Briefly describe what this PR changes and why.
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Refactoring / Code quality improvement
+- [ ] Documentation update
+
+## Affected Areas
+
+- [ ] Apps (`apps/app`)
+- [ ] Database / Prisma Schema
+- [ ] API routes (`src/app/api`)
+- [ ] Authentication / Session handling
+- [ ] UI Components / Design System
+- [ ] Scripts / Infrastructure / CI
+
+## Checklist
+
+- [ ] I tested the changes locally (`pnpm dev` / relevant scripts)
+- [ ] I ran type checking (`pnpm check-types`) with zero errors
+- [ ] I ran linting (`pnpm lint`) with zero warnings/errors
+- [ ] I verified production build completes (`pnpm build`)
+- [ ] I did not commit secrets, private keys, or `.env` files
+- [ ] Database/schema migration changes are included (if applicable)
+- [ ] Breaking API changes are documented (if applicable)
+
+## Related Issues
+
+Closes #

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# Cancel in-progress runs for the same PR/branch to avoid wasting runner minutes
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Lint, Typecheck & Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install pnpm
+        run: corepack enable pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm turbo lint
+
+      - name: Typecheck
+        run: pnpm turbo check-types
+
+      - name: Build
+        run: pnpm turbo build
+        env:
+          # Stub env vars so Next.js build-time validation passes.
+          # These are NOT real credentials. The DB is never contacted during build;
+          # prisma.ts only runs at request time (server components / route handlers).
+          DATABASE_URL: "postgresql://ci:ci@localhost:5432/ci_stub"
+          DIRECT_URL: "postgresql://ci:ci@localhost:5432/ci_stub"
+          BETTER_AUTH_SECRET: "ci-stub-secret-not-real"
+          BETTER_AUTH_URL: "http://localhost:3000"
+          NEXT_PUBLIC_APP_URL: "http://localhost:3000"
+          NEXT_PUBLIC_SUPABASE_URL: "https://stub.supabase.co"
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: "stub"

.gitignore

@@ -1,49 +1,38 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
-# dependencies
-/node_modules
-/.pnp
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/versions
-
-# testing
-/coverage
-
-# next.js
-/.next/
-/out/
-
-# production
-/build
-
-# misc
-.DS_Store
-*.pem
+# Dependencies
+node_modules
+.pnp
+.pnp.js
 
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.pnpm-debug.log*
+# Local env files
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# Testing
+coverage
 
-# env files (can opt-in for committing if needed)
-.env*
+# Turbo
+.turbo
 
-# vercel
+# Vercel
 .vercel
 
-# typescript
-*.tsbuildinfo
-next-env.d.ts
+# Build Outputs
+.next/
+out/
+build
+dist
 
-/src/generated/prisma
-DESIGN.md
-/plans
-/internal-guides
-.source
 
-send-founder-email.js
+# Debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Misc
+.DS_Store
+*.pem

.npmrc

@@ -0,0 +1 @@
+auto-install-peers=true