We Scaffolded a Full Next.js App With Auth, DB, and Tests in 22 Minutes

22 minutes and 14 seconds. That's the wall-clock time from empty repository to a running Next.js application with NextAuth session handling, a Prisma-managed PostgreSQL schema, and a Vitest suite covering 31 endpoints. A developer was present throughout. They wrote approximately 40 lines of the resulting 1,847 lines of code.

This post is a walkthrough of exactly how it happened — the SKILL.md configuration that drove it, the agent setup that consumed it, and the decisions we made along the way. If you've heard about the AI Code Factory but haven't seen the inside of it, this is that post.

What the SKILL.md File Actually Is

A SKILL.md is a structured Markdown file that gives a Copilot agent domain expertise. Think of it as the agent's briefing document — it defines the patterns it should follow, the libraries it should use, the structure it should produce, and the guardrails it must respect. Skills are composable, version-controlled, and project-specific.

Most teams running GitHub Copilot are using it as an autocomplete engine. SKILL.md files are what turn autocomplete into an engineering system. The agent doesn't just suggest the next line — it understands the architecture of your application and generates components that fit it.

For this build, we used three stacked SKILL.md files: a backend.skill.md, a frontend.skill.md, and a testing.skill.md. Here's the core of the backend skill that drove most of the scaffold:

# backend.skill.md — Indpro AI Code Factory
# Version: 1.3 | Stack: Next.js 14, Prisma, PostgreSQL, NextAuth

## Tech Stack
- Framework: Next.js 14 App Router
- ORM: Prisma with PostgreSQL
- Auth: NextAuth.js v5 (credentials + OAuth)
- API: REST via Next.js Route Handlers
- Validation: Zod schemas on all inputs
- Error handling: Centralized ApiError class

## Route Handler Pattern
export async function GET(req: Request) {
  try {
    const session = await getServerSession(authOptions)
    if (!session) return unauthorized()
    const data = await prisma.[entity].findMany({ where: { userId: session.user.id } })
    return NextResponse.json({ data })
  } catch (e) {
    return handleApiError(e)
  }
}

## Prisma Schema Pattern
# All models must include: id (cuid), createdAt, updatedAt
# Soft delete pattern: deletedAt nullable timestamp
# Relations: explicit foreignKey notation

## Guardrails
- No raw SQL queries — Prisma only
- All inputs validated with Zod before DB operations
- No environment variables hardcoded — process.env only
- Session check on every authenticated route
- 80% coverage minimum enforced by hook

The Build: Minute by Minute

The scaffold follows a deterministic sequence. The agent doesn't freelance — it executes in the order the SKILL.md defines, with each phase building on the last. Here's what happened in those 22 minutes.

Minutes 0–4: Repository initialization, Next.js 14 App Router setup, Tailwind CSS configuration, ESLint and TypeScript config. The agent follows the SKILL.md directory structure exactly — no improvisation.

Minutes 4–9: NextAuth v5 setup including the credentials provider, session strategy (JWT), type augmentation for the session object, and the protected route middleware. The developer reviewed the generated auth.config.ts and made one change: adjusting the session expiry from 24 hours to 7 days to match the product requirement.

Minutes 9–14: Prisma schema generation. The agent produced the User, Session, and Account models following NextAuth's Prisma adapter pattern, plus the application-specific models (we were building a project management tool — Task, Project, Label, Comment). The developer wrote zero schema lines.

Minutes 14–19: Eight REST route handlers — CRUD for Projects and Tasks, plus user session endpoint and a health check. Each route followed the pattern defined in backend.skill.md exactly: session guard, Zod validation, Prisma operation, centralized error handling.

Minutes 19–22: Vitest test suite. The testing.skill.md drove this — it specified the pattern for mocking Prisma, the session mock factory, and the assertion style. 31 tests, all green on first run.

What the Guardrails Enforced

The 22-minute scaffold only works reliably because of the guardrail layer. Without it, agent output is fast but inconsistent — you trade review cycles for a different kind of debt. The AI Code Factory's guardrails made the output production-ready, not just fast.

Three guardrails fired during this build:

Guardrail	Trigger	Action	Result
ESLint (pre-commit hook)	3 unused imports in generated route	Auto-fixed	0 lint errors
TypeScript tsc (pre-commit)	Implicit `any` in error handler	Blocked — fixed manually	0 type errors
Coverage gate (on-push)	Coverage at 79% after first push	Blocked — 2 tests added	84% coverage

The TypeScript error is worth noting. The agent generated catch (e) without explicit typing in one route handler. The tsc hook caught it, the build blocked, and the developer added catch (e: unknown) in under 60 seconds. Without the hook, that would have lived in the codebase until a reviewer found it — or didn't.

What the Agent Didn't Handle

Honesty matters here. The SKILL.md scaffold covered the structural layer with high reliability. It did not handle three things that required developer judgment: the specific data model relationships unique to this product, the custom business logic in one endpoint, and the environment-specific deployment configuration.

Those 40 developer-written lines were not wasted minutes. They were the appropriate intervention points — where human judgment adds value that no skill file should encode. The goal isn't zero human contribution. It's routing human contribution to where it actually matters.

"The AI Code Factory doesn't replace engineering judgment. It eliminates the work that doesn't require judgment — which turns out to be most of the scaffolding layer. When you measure what developers actually spend time on, roughly 60% of it is structural setup that a well-written skill file can handle deterministically." — Tom Bergström, COO & Co-Founder, Indpro AB

How to Replicate This

The implementation follows a four-step sequence. The first SKILL.md file takes the most time to write — typically 2–3 hours for a senior developer who knows the stack well. Every subsequent project reuses and refines it, which is why the value compounds over time.

Start with your backend skill. Define the framework version, the route pattern, the ORM pattern, the error handling pattern, and the guardrail minimums. Be specific. Vague skill files produce vague output. Then add a testing skill that references the backend patterns — this ensures test structure mirrors implementation structure. Frontend skill last.

Wire the pre-commit hooks before you write the first skill. The hooks are what make the output trustworthy. Skills without guardrails are fast but unpredictable. Skills with guardrails are fast and deterministic — which is the AI Code Factory's core premise.

We've documented the full setup sequence, including the hook configuration and the agent YAML, in our AI Code Factory Implementation Guide.

Frequently Asked Questions

Q: Does this approach work for existing codebases, or only greenfield projects?

SKILL.md files work on both, but require different configurations. For existing codebases, the skill file needs to document the current patterns accurately — it reads the codebase and encodes what it finds. Greenfield projects are faster to set up because you're defining the patterns from scratch. We've used both successfully, including with Mathem's existing platform.

Q: What's the minimum team size for the AI Code Factory to be worth implementing?

We've seen value with teams as small as two developers. The setup investment (writing the initial skill files, configuring hooks) is roughly 8–16 hours. That pays back within the first sprint for any team shipping features regularly. The compounding effect increases with team size — shared skills across 8 developers generate more leverage than across 2.

Q: How long does it take to write the first SKILL.md file?

2–4 hours for a developer who knows the stack well. The first draft is the hardest — you're encoding implicit knowledge into explicit instructions. By the third or fourth skill file on the same project, experienced developers do it in under an hour. We also provide a starting template as part of the AI Code Factory Implementation Guide.