@alfredmouelle/create-stack 0.1.0

package/README.md

@@ -0,0 +1,56 @@
+# create-stack
+
+Interactive, **deterministic** installer for the reference stack — the non-LLM
+counterpart of the `bootstrap` skill's CREATE mode. It forks a base app
+(`apps/tanstack-base` or `apps/next-base`) and strips it down to your selection.
+
+## Usage
+
+```bash
+# from anywhere
+node /path/to/stack/cli/index.mjs my-app
+
+# from the stack repo
+pnpm create-stack my-app
+```
+
+The wizard asks for:
+
+- **Framework** — TanStack Start or Next.js (App Router)
+- **Foundations** — Drizzle, tRPC, better-auth, data-table (hard deps resolved:
+  tRPC/better-auth ⇒ Drizzle; better-auth ⇒ mailer)
+- **Mailer provider** — Resend, Brevo, Amazon SES (or none, if no better-auth)
+- **Extra capabilities** — storage, jobs, cache, … (added afterwards via the
+  `add-capability` skill; not baked into the base)
+
+Then it forks, strips unselected foundations, swaps the mailer adapter, stamps
+identity, generates `.env(.example)`, and optionally installs + verifies
+(typecheck + Biome).
+
+## How it works
+
+- **Single source of truth**: the base apps (`apps/*-base`) hold the real code;
+  the `patterns/*/pattern.json` manifests drive deps/scripts/env/file lists.
+- **Deterministic strip**: whole-directory deletes + dep/env/script diffs from the
+  manifests, plus a few hardcoded code *seams* (tRPC↔auth context, root provider
+  wiring) handled via shipped reduced variants in `templates/`.
+- If you edit a seam file in a base app (`server/api/trpc.ts`, the root
+  `router.tsx` / `__root.tsx` / `layout.tsx`, the schema barrel), update the
+  matching transform in `lib/strip.mjs` or the `templates/` variant.
+
+## Layout
+
+```
+cli/
+  index.mjs          wizard (prompts) + install/verify + report
+  lib/
+    build.mjs        pure build phase (fork → strip → mailer → env → identity)
+    manifests.mjs    load patterns + capabilities; logical→manifest mapping
+    scaffold.mjs     fork base app, make it standalone
+    strip.mjs        reverse-strip unselected foundations + code seams
+    mailer.mjs       mailer provider swap
+    env.mjs          rebuild src/env.ts blocks + generate .env files
+    identity.mjs     title/meta + README with the # Author footer
+    util.mjs         fs / exec / package.json helpers
+  templates/         reduced "no-trpc" root-wiring variants
+```

package/_stack/apps/next-base/.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.next
+.git
+.env
+.env.*
+!.env.example
+npm-debug.log*
+Dockerfile
+.dockerignore
+README.md

package/_stack/apps/next-base/Dockerfile

@@ -0,0 +1,34 @@
+# syntax=docker/dockerfile:1
+# Optimized multi-stage build for VPS deployment (Next.js standalone output).
+# Build context = this app (fork it out of the monorepo, or build with this dir
+# as context). Final image runs the standalone server with no dev deps.
+
+FROM node:22-alpine AS base
+RUN corepack enable
+WORKDIR /app
+
+# ---- deps: install with a cached store ----
+FROM base AS deps
+COPY package.json pnpm-lock.yaml* ./
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
+
+# ---- build ----
+FROM base AS build
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+# Env is validated at runtime, not build — skip it so the build needs no secrets.
+ENV NEXT_TELEMETRY_DISABLED=1 SKIP_ENV_VALIDATION=1
+RUN pnpm build
+
+# ---- runner: minimal standalone image ----
+FROM base AS runner
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1
+RUN addgroup -g 1001 nodejs && adduser -u 1001 -G nodejs -S nextjs
+COPY --from=build /app/public ./public
+COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000 HOSTNAME=0.0.0.0
+CMD ["node", "server.js"]

package/_stack/apps/next-base/README.md

@@ -0,0 +1,32 @@
+# next-base
+
+Reference Next.js (App Router) app — fork it to start a new project. Comes wired
+with the full personal foundation:
+
+- **baseline** — `~/*` alias, typed `env.ts`, strict Biome, Tailwind v4 + shadcn
+  (Geist, dark mode)
+- **data** — Drizzle (Postgres) + drizzle-kit, faker seed harness
+- **auth** — better-auth (email/password + verification, optional Google) + a full
+  auth UI (sign-in/up, forgot/reset, verify) with shadcn `Form` (react-hook-form +
+  valibot)
+- **email** — mailer (Resend) + email-kit templates (`email:dev` studio)
+- **API** — tRPC with the `api.x.useQuery` hooks + RSC hydration
+- **UI utilities** — theme toggle (light/dark/system), DataTable, DatePicker
+- **deploy** — multi-stage `Dockerfile` (standalone output) for a VPS
+
+```bash
+pnpm --filter @alfredmouelle/next-base dev    # http://localhost:3000
+```
+
+Add more swappable tools with **add-capability**.
+
+# Author
+
+Alfred MOUELLE | FullStack Developer
+
+[![ComeUp](https://img.shields.io/static/v1?style=for-the-badge&label=&message=ComeUp&color=yellow)](https://comeup.com/@alfredmouelle)
+[![GitHub](https://img.shields.io/badge/GitHub-100000?style=for-the-badge&logo=github&logoColor=white)](https://github.com/alfredmouelle)
+[![LinkedIn](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/alfredmouelle)
+[![Twitter](https://img.shields.io/badge/Twitter-1DA1F2?style=for-the-badge&logo=twitter&logoColor=white)](https://twitter.com/kali47_)
+[![Gmail](https://img.shields.io/badge/Gmail-D14836?style=for-the-badge&logo=gmail&logoColor=white)](mailto:alfredmouelle@gmail.com)
+[![Portfolio](https://img.shields.io/static/v1?style=for-the-badge&label=&message=Portfolio&color=blue)](https://alfredmouelle.com)

package/_stack/apps/next-base/components.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "radix-luma",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/app/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "~/components",
+    "utils": "~/lib/utils",
+    "ui": "~/components/ui",
+    "lib": "~/lib",
+    "hooks": "~/hooks"
+  },
+  "iconLibrary": "lucide",
+  "rtl": false,
+  "menuColor": "default-translucent",
+  "menuAccent": "subtle",
+  "registries": {}
+}

package/_stack/apps/next-base/drizzle.config.ts

@@ -0,0 +1,16 @@
+import { config } from 'dotenv'
+import { defineConfig } from 'drizzle-kit'
+
+config({ path: ['.env.local', '.env'] })
+
+const url = process.env.DATABASE_URL
+if (!url) {
+  throw new Error('DATABASE_URL is not set')
+}
+
+export default defineConfig({
+  out: './drizzle',
+  schema: './src/server/db/schemas/*.schema.ts',
+  dialect: 'postgresql',
+  dbCredentials: { url },
+})

package/_stack/apps/next-base/next.config.ts

@@ -0,0 +1,8 @@
+import type { NextConfig } from 'next'
+
+const nextConfig: NextConfig = {
+  // Self-contained server bundle for small Docker images (VPS deployment).
+  output: 'standalone',
+}
+
+export default nextConfig

package/_stack/apps/next-base/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@alfredmouelle/next-base",
+  "version": "0.1.0",
+  "private": true,
+  "author": {
+    "name": "Alfred MOUELLE",
+    "email": "alfredmouelle@gmail.com",
+    "url": "https://alfredmouelle.com"
+  },
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "typecheck": "tsc --noEmit",
+    "check": "biome check .",
+    "check:unsafe": "biome check --write --unsafe .",
+    "check:write": "biome check --write .",
+    "email:dev": "email dev --dir src/emails --port 3001",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio",
+    "db:seed": "tsx src/server/db/seed.ts"
+  },
+  "dependencies": {
+    "@fontsource-variable/geist": "^5.2.9",
+    "@hookform/resolvers": "^5.2.2",
+    "@t3-oss/env-core": "^0.13.11",
+    "@tanstack/react-query": "^5.101.0",
+    "@tanstack/react-table": "^8.21.3",
+    "@trpc/client": "^11.17.0",
+    "@trpc/react-query": "^11.17.0",
+    "@trpc/server": "^11.17.0",
+    "better-auth": "^1.6.19",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "date-fns": "^4.4.0",
+    "drizzle-orm": "^0.45.2",
+    "lucide-react": "^0.545.0",
+    "next": "16.2.9",
+    "next-themes": "^0.4.6",
+    "pg": "^8.21.0",
+    "radix-ui": "^1.6.0",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "react-day-picker": "^10.0.1",
+    "react-email": "^6.6.3",
+    "react-hook-form": "^7.54.2",
+    "resend": "^6.14.0",
+    "server-only": "^0.0.1",
+    "superjson": "^2.2.2",
+    "tailwind-merge": "^3.6.0",
+    "valibot": "^1.4.1"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.0",
+    "@faker-js/faker": "^10.5.0",
+    "@tailwindcss/postcss": "^4.3.1",
+    "@types/node": "^22.10.2",
+    "@types/pg": "^8.15.6",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "drizzle-kit": "^0.31.10",
+    "dotenv": "^17.2.4",
+    "tailwindcss": "^4.3.1",
+    "tsx": "^4.22.4",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "^5.9.3"
+  }
+}

package/_stack/apps/next-base/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    '@tailwindcss/postcss': {},
+  },
+}
+
+export default config

package/_stack/apps/next-base/src/app/api/auth/[...all]/route.ts

@@ -0,0 +1,4 @@
+import { toNextJsHandler } from 'better-auth/next-js'
+import { auth } from '~/server/better-auth'
+
+export const { GET, POST } = toNextJsHandler(auth.handler)

package/_stack/apps/next-base/src/app/api/trpc/[trpc]/route.ts

@@ -0,0 +1,23 @@
+import { fetchRequestHandler } from '@trpc/server/adapters/fetch'
+import type { NextRequest } from 'next/server'
+import { env } from '~/env'
+import { appRouter } from '~/server/api/root'
+import { createTRPCContext } from '~/server/api/trpc'
+
+const createContext = async (req: NextRequest) => createTRPCContext({ headers: req.headers })
+
+const handler = (req: NextRequest) =>
+  fetchRequestHandler({
+    endpoint: '/api/trpc',
+    req,
+    router: appRouter,
+    createContext: () => createContext(req),
+    onError:
+      env.NODE_ENV === 'development'
+        ? ({ path, error }) => {
+            console.error(`❌ tRPC failed on ${path ?? '<no-path>'}: ${error.message}`)
+          }
+        : undefined,
+  })
+
+export { handler as GET, handler as POST }

package/_stack/apps/next-base/src/app/auth/_components/forgot-password-form.tsx

@@ -0,0 +1,92 @@
+'use client'
+
+import { valibotResolver } from '@hookform/resolvers/valibot'
+import { Mail } from 'lucide-react'
+import { useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { Button } from '~/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '~/components/ui/form'
+import { InputGroup, InputGroupAddon, InputGroupInput } from '~/components/ui/input-group'
+import { Spinner } from '~/components/ui/spinner'
+import { FormAlert } from '~/features/auth/form-alert'
+import { type ForgotPasswordInput, ForgotPasswordSchema } from '~/features/auth/schemas'
+import { authClient } from '~/server/better-auth/client'
+
+export function ForgotPasswordForm() {
+  const [formError, setFormError] = useState<string | null>(null)
+  const [sent, setSent] = useState(false)
+  const form = useForm<ForgotPasswordInput>({
+    resolver: valibotResolver(ForgotPasswordSchema),
+    defaultValues: { email: '' },
+  })
+
+  const onSubmit = form.handleSubmit(async (values) => {
+    setFormError(null)
+    const { error } = await authClient.requestPasswordReset({
+      email: values.email,
+      redirectTo: '/auth/reset-password',
+    })
+    if (error) {
+      setFormError(error.message ?? 'Could not send. Try again.')
+      return
+    }
+    setSent(true)
+  })
+
+  if (sent) {
+    return (
+      <FormAlert variant="success">
+        If an account exists for this address, a reset email has just been sent. Check your spam
+        folder.
+      </FormAlert>
+    )
+  }
+
+  return (
+    <Form {...form}>
+      <form className="grid gap-4" onSubmit={onSubmit}>
+        {formError ? <FormAlert>{formError}</FormAlert> : null}
+
+        <FormField
+          control={form.control}
+          name="email"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Email</FormLabel>
+              <InputGroup className="h-10">
+                <InputGroupAddon align="inline-start">
+                  <Mail />
+                </InputGroupAddon>
+                <FormControl>
+                  <InputGroupInput
+                    autoComplete="email"
+                    placeholder="you@example.com"
+                    type="email"
+                    {...field}
+                  />
+                </FormControl>
+              </InputGroup>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <Button
+          className="w-full cursor-pointer"
+          disabled={form.formState.isSubmitting}
+          type="submit"
+        >
+          {form.formState.isSubmitting ? <Spinner /> : null}
+          {form.formState.isSubmitting ? 'Sending…' : 'Send link'}
+        </Button>
+      </form>
+    </Form>
+  )
+}

package/_stack/apps/next-base/src/app/auth/_components/reset-password-form.tsx

@@ -0,0 +1,105 @@
+'use client'
+
+import { valibotResolver } from '@hookform/resolvers/valibot'
+import { Lock } from 'lucide-react'
+import { useRouter } from 'next/navigation'
+import { useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { Button } from '~/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '~/components/ui/form'
+import { InputGroup, InputGroupAddon, InputGroupInput } from '~/components/ui/input-group'
+import { Spinner } from '~/components/ui/spinner'
+import { FormAlert } from '~/features/auth/form-alert'
+import { type ResetPasswordInput, ResetPasswordSchema } from '~/features/auth/schemas'
+import { authClient } from '~/server/better-auth/client'
+
+export function ResetPasswordForm({ token }: { token?: string }) {
+  const router = useRouter()
+  const [formError, setFormError] = useState<string | null>(null)
+  const form = useForm<ResetPasswordInput>({
+    resolver: valibotResolver(ResetPasswordSchema),
+    defaultValues: { password: '', confirmPassword: '' },
+  })
+
+  const onSubmit = form.handleSubmit(async (values) => {
+    if (!token) return
+    setFormError(null)
+    const { error } = await authClient.resetPassword({ newPassword: values.password, token })
+    if (error) {
+      setFormError(error.message ?? 'Could not reset password.')
+      return
+    }
+    router.push('/auth/sign-in')
+  })
+
+  if (!token) {
+    return <FormAlert>This reset link is invalid or expired. Please request a new one.</FormAlert>
+  }
+
+  return (
+    <Form {...form}>
+      <form className="grid gap-4" onSubmit={onSubmit}>
+        {formError ? <FormAlert>{formError}</FormAlert> : null}
+
+        <FormField
+          control={form.control}
+          name="password"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>New password</FormLabel>
+              <InputGroup className="h-10">
+                <InputGroupAddon align="inline-start">
+                  <Lock />
+                </InputGroupAddon>
+                <FormControl>
+                  <InputGroupInput
+                    autoComplete="new-password"
+                    placeholder="At least 8 characters"
+                    type="password"
+                    {...field}
+                  />
+                </FormControl>
+              </InputGroup>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="confirmPassword"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Confirm password</FormLabel>
+              <InputGroup className="h-10">
+                <InputGroupAddon align="inline-start">
+                  <Lock />
+                </InputGroupAddon>
+                <FormControl>
+                  <InputGroupInput autoComplete="new-password" type="password" {...field} />
+                </FormControl>
+              </InputGroup>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <Button
+          className="w-full cursor-pointer"
+          disabled={form.formState.isSubmitting}
+          type="submit"
+        >
+          {form.formState.isSubmitting ? <Spinner /> : null}
+          {form.formState.isSubmitting ? 'Saving…' : 'Reset password'}
+        </Button>
+      </form>
+    </Form>
+  )
+}

package/_stack/apps/next-base/src/app/auth/_components/sign-in-form.tsx

@@ -0,0 +1,126 @@
+'use client'
+
+import { valibotResolver } from '@hookform/resolvers/valibot'
+import { Lock, Mail } from 'lucide-react'
+import Link from 'next/link'
+import { useRouter } from 'next/navigation'
+import { useState } from 'react'
+import { useForm } from 'react-hook-form'
+import { Button } from '~/components/ui/button'
+import {
+  Form,
+  FormControl,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '~/components/ui/form'
+import { InputGroup, InputGroupAddon, InputGroupInput } from '~/components/ui/input-group'
+import { Spinner } from '~/components/ui/spinner'
+import { FormAlert } from '~/features/auth/form-alert'
+import { AuthDivider, GoogleButton } from '~/features/auth/google-button'
+import { type SignInInput, SignInSchema } from '~/features/auth/schemas'
+import { authClient } from '~/server/better-auth/client'
+
+export function SignInForm() {
+  const router = useRouter()
+  const [formError, setFormError] = useState<string | null>(null)
+  const form = useForm<SignInInput>({
+    resolver: valibotResolver(SignInSchema),
+    defaultValues: { email: '', password: '' },
+  })
+
+  const onSubmit = form.handleSubmit(async (values) => {
+    setFormError(null)
+    const { error } = await authClient.signIn.email({
+      email: values.email,
+      password: values.password,
+    })
+
+    if (!error) {
+      router.push('/')
+      router.refresh()
+      return
+    }
+
+    if (error.code === 'EMAIL_NOT_VERIFIED') {
+      router.push(`/auth/verify-email?email=${encodeURIComponent(values.email)}`)
+      return
+    }
+
+    setFormError(
+      error.code === 'INVALID_EMAIL_OR_PASSWORD'
+        ? 'Incorrect email or password.'
+        : (error.message ?? 'Could not sign in. Try again.'),
+    )
+  })
+
+  return (
+    <Form {...form}>
+      <form className="grid gap-4" onSubmit={onSubmit}>
+        <GoogleButton label="Continue with Google" />
+        <AuthDivider />
+
+        {formError ? <FormAlert>{formError}</FormAlert> : null}
+
+        <FormField
+          control={form.control}
+          name="email"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Email</FormLabel>
+              <InputGroup className="h-10">
+                <InputGroupAddon align="inline-start">
+                  <Mail />
+                </InputGroupAddon>
+                <FormControl>
+                  <InputGroupInput
+                    autoComplete="email"
+                    placeholder="you@example.com"
+                    type="email"
+                    {...field}
+                  />
+                </FormControl>
+              </InputGroup>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="password"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Password</FormLabel>
+              <InputGroup className="h-10">
+                <InputGroupAddon align="inline-start">
+                  <Lock />
+                </InputGroupAddon>
+                <FormControl>
+                  <InputGroupInput autoComplete="current-password" type="password" {...field} />
+                </FormControl>
+              </InputGroup>
+              <Link
+                className="justify-self-end text-muted-foreground text-xs hover:underline"
+                href="/auth/forgot-password"
+              >
+                Forgot password?
+              </Link>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <Button
+          className="w-full cursor-pointer"
+          disabled={form.formState.isSubmitting}
+          type="submit"
+        >
+          {form.formState.isSubmitting ? <Spinner /> : null}
+          {form.formState.isSubmitting ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </form>
+    </Form>
+  )
+}