gstack is an interactive CLI that turns one command into a Next.js application whose parts already fit together. You choose the stack — Prisma or Drizzle, NextAuth.js or Better Auth, Biome or ESLint — and it installs real, checked-in template files rather than generating code from strings, so what lands in your repository is code you can read, lint and review. Typesafety runs end to end through TypeScript, tRPC and Zod; the security, testing and bundle-budget defaults that usually arrive three months late are configured on the first commit. It is published on npm as `create-gstack`, MIT licensed, and it leaves nothing of itself behind in your dependency tree.
The tools that make gstack work the way you do — no add-ons, no surprises.
`npm create gstack@latest my-app` prompts for the stack you want, installs it, initialises Git, and leaves you with an app that builds, typechecks and passes its tests before you have written a line.
TypeScript, tRPC and Zod are wired together so a change to a router's input schema surfaces in the calling component as a type error, not as a runtime 500.
Prisma or Drizzle. NextAuth.js or Better Auth. Biome or ESLint and Prettier. Postgres, MySQL, SQLite or PlanetScale. The mutually exclusive choices are enforced by the CLI rather than left to you to discover.
Every combination has a checked-in template variant — `installers` pick the right file rather than generating code from strings. The templates are therefore lintable, reviewable and diffable like the rest of the repo.
A nonce-based production CSP with no `unsafe-*` directives, structured logging, rate limiting and pinned overrides for known-vulnerable transitive dependencies — configured at scaffold time, not left as a TODO.
Vitest and Testing Library are set up with real tests, with Playwright available for end-to-end coverage. `npm test` passes on the app you just generated, so a failing suite always means something you did.
The generated landing and auth pages ship with a designed starter UI, and `--theme` applies any theme from the shadcn colorways or the tweakcn community registry.
`--CI` plus feature flags scaffolds with no prompts, so gstack works inside Dockerfiles, scripts and pipelines the same way it works in a terminal.
`size-limit` holds client JS and CSS under a defined ceiling, and `/api/health` ships with a real driver query rather than a hardcoded `{ ok: true }`.
Every library gstack can put in your project, with the reason we reach for it.
Next.js
App Router by default. Server Components keep data fetching on the server, so the client bundle carries UI rather than query logic.
React
React 19, for Server Components and the `use` / Actions APIs the App Router is built on.
TypeScript
Strict mode from the first file. The whole point of the stack is that a wrong shape fails at build time.
Zod
Runtime validation for env vars, tRPC inputs and forms — the boundary where TypeScript's guarantees stop.
Node.js
The CLI targets active LTS. We do not ship a runtime, so your app runs wherever Next.js runs.
Tailwind CSS
v4, configured in CSS rather than a JS config file. Chosen because it keeps styling in the component and out of a parallel stylesheet tree.
shadcn/ui
Components are copied into your repo, not imported from a package, so you can edit them without forking a dependency.
Radix UI
The unstyled primitives under shadcn/ui. Keyboard handling and ARIA semantics are the parts you should not hand-roll.
Lucide
One consistent icon set, tree-shaken per import, so an icon you never use never ships.
tRPC
v11. Chosen over REST or GraphQL when the client and server are the same repo — you get types across the wire without a codegen step.
TanStack Query
Caching, revalidation and mutation state for the tRPC client, so components describe what they need rather than when to refetch.
Prisma
The default. A declarative schema and generated client, chosen when you want migrations handled for you.
Drizzle
Chosen when you want the SQL to stay visible and the query builder to stay thin — no engine between you and the database.
PostgreSQL
The default provider. Chosen for anything with relations, constraints or a plan to grow.
MySQL
Chosen when the target environment already runs MySQL and the migration story has to match it.
SQLite
Via LibSQL. Chosen for local-first apps and for prototypes that should not need a database server.
PlanetScale
Chosen when you want a serverless MySQL driver over HTTP rather than a long-lived connection pool.
NextAuth.js
v5 (Auth.js). The default — the widest provider coverage and the closest fit to the App Router's session model.
Better Auth
Chosen when you want auth tables in your own schema and the configuration in TypeScript rather than in a provider dashboard.
Biome
The recommended default. One Rust binary for lint and format, which removes the ESLint-plus-Prettier config surface entirely.
ESLint
Chosen when you need the plugin ecosystem or have to match an existing organisation-wide config.
Prettier
Installed alongside ESLint, so formatting stays a separate concern from linting in that pairing.
Vitest
Always installed. Shares the Vite transform pipeline, so tests run against the same module resolution as the app.
Testing Library
Component tests written against what a user can see and do, rather than against internal component state.
Playwright
Optional, via `--playwright`. Chosen when a flow crosses pages, auth or a real browser and a unit test cannot reach it.
Sentry
Optional, via `--sentry`. Wired for both server and client so a production error arrives with a stack trace and a release.
npm
The distribution channel — `create-gstack` is published here — and a supported package manager for the generated app.
pnpm
The gstack monorepo's own manager. Chosen for content-addressed storage and strict, non-hoisted dependency resolution.
Yarn
Yarn Classic is supported. Yarn 3's PnP resolution is not currently supported, and we say so rather than letting it fail at install.
Bun
Supported as both the invoking manager and the install runtime, for the fastest cold scaffold.
Turborepo
Runs the gstack monorepo's own task pipeline across the CLI and the docs site — build caching for the tool, not something forced on you.
Astro
Powers the gstack documentation site. Chosen there because docs are content-first and ship almost no JavaScript.
The complete feature matrix, including the trade-offs behind each choice.
| Feature | gstackOpinionated Next.js scaffolder | create-t3-appThe T3 stack CLI | create-next-appOfficial Next.js starter | Manual setupWire it yourself |
|---|---|---|---|---|
| Interactive stack selection | Yes | Yes | Partial | Not applicable |
| End-to-end typesafe API (tRPC) | Yes | Yes | No | manual |
| Choice of Prisma or Drizzle | Yes | Yes | No | manual |
| Choice of NextAuth.js or Better Auth | Yes | Partial | No | manual |
| shadcn/ui pre-installed | Yes | No | No | manual |
| Themeable starter UI (tweakcn registry) | Yes | No | No | manual |
| Biome as a first-class linter option | Yes | Partial | No | manual |
| Test suite scaffolded (Vitest) | Yes | No | No | manual |
| Optional Playwright E2E setup | Yes | No | No | manual |
| Nonce-based production CSP | Yes | No | No | manual |
| Bundle size budget enforced | Yes | No | No | manual |
| Health check endpoint with a real query | Yes | No | No | manual |
| Optional Sentry wiring | Yes | No | No | manual |
| AI agent rules (`.rules/`, `AGENTS.md`, `CLAUDE.md`) | Yes | No | No | manual |
| Headless `--CI` mode | Yes | Yes | Partial | Not applicable |
| npm, pnpm, yarn and bun support | Yes | Yes | Yes | Not applicable |
What teams ask before adopting gstack.
Run `npm create gstack@latest my-app` and answer the prompts. `pnpm create gstack`, `yarn create gstack` and `bun create gstack` all work too, and `npm install -g create-gstack` gives you a global `gstack` command. Add `--default` to skip the prompts and take the recommended stack.
NextAuth.js, Prisma, Tailwind CSS, tRPC, shadcn/ui, Biome, PostgreSQL and the App Router. Every one of those is a prompt you can answer differently — the default is a starting point, not a requirement.
gstack starts from the same idea — an interactive CLI for a typesafe Next.js stack — and adds the parts most teams bolt on afterwards: shadcn/ui and a themeable starter UI, Better Auth and Drizzle as first-class choices, a Vitest suite with optional Playwright, a nonce-based production CSP, a bundle budget, a real health check, and generated AI agent rules describing the exact stack you chose.
Yes. `--default` takes the recommended stack, and `--CI` plus explicit feature flags scaffolds with no interaction at all — for example `npm create gstack@latest my-app -- --CI --trpc --tailwind --nextAuth --prisma --shadcn --biome --pm pnpm`. That path is intended for scripts, Dockerfiles and CI pipelines.
Three choices are mutually exclusive: Prisma or Drizzle, ESLint or Biome, and NextAuth.js or Better Auth. Selecting authentication also forces the App Router, because the bundled `(auth)` route group and `app/api/auth` routes only exist in that form. The CLI enforces these rather than letting you discover them at build time.
No. It is a scaffolder — it runs once, writes files, and leaves. The generated app depends on Next.js and whatever you selected, never on `create-gstack`, so there is nothing to upgrade and nothing to remove.
The CLI pins known-good versions of every library it installs, and those pins move as the templates are tested against new releases. Because gstack is not a runtime dependency, upgrading an existing app is a normal dependency bump in your own repo rather than a migration of ours.
Concretely: a nonce-based Content-Security-Policy in production with no `unsafe-inline` or `unsafe-eval`, rate limiting on the API surface, structured logging, and pinned overrides for transitive dependencies with known advisories. It does not mean your application is secure — that depends on what you build on top.
Yes, MIT licensed, and so is everything it generates. The CLI, the templates and the documentation site live in one Turborepo monorepo, and contributions are welcome.
Have questions or need something tailored to your business? We'd love to help you get started.
