@codeyam/codeyam-cli 0.1.0-staging.483fdc2 → 0.1.0-staging.57cd50f

package/codeyam-cli/templates/nextjs-prisma-sqlite/AUTH_UPGRADE.md

@@ -0,0 +1,304 @@
+# Upgrading Auth for Production
+
+The dev auth pattern in `app/lib/auth.ts` is designed for easy replacement.
+All consumer code imports from `@/app/lib/auth` — only the internals of that file change.
+
+## What Stays the Same
+
+Every file that imports from `@/app/lib/auth` continues to work unchanged:
+
+- Server components calling `getSession()` and `requireAuth()`
+- Client components fetching `/api/auth/session`
+- API routes using `signIn()` and `signOut()`
+- Login/logout forms
+
+## What Changes
+
+Only `app/lib/auth.ts` internals. Replace the cookie+DB implementation with your chosen provider.
+
+---
+
+## NextAuth v5
+
+### Install
+
+```bash
+npm install next-auth @auth/prisma-adapter
+```
+
+### Replace `app/lib/auth.ts`
+
+```typescript
+import NextAuth from 'next-auth';
+import { PrismaAdapter } from '@auth/prisma-adapter';
+import { prisma } from '@/app/lib/prisma';
+import Credentials from 'next-auth/providers/credentials';
+// Add other providers: Google, GitHub, etc.
+
+export interface AuthUser {
+  id: string;
+  name: string;
+  email: string;
+  image?: string | null;
+}
+
+export interface Session {
+  user: AuthUser;
+}
+
+const {
+  auth,
+  signIn: nextAuthSignIn,
+  signOut: nextAuthSignOut,
+} = NextAuth({
+  adapter: PrismaAdapter(prisma),
+  providers: [
+    Credentials({
+      credentials: { email: {}, password: {} },
+      authorize: async (credentials) => {
+        const user = await prisma.user.findUnique({
+          where: { email: credentials.email as string },
+        });
+        if (!user) return null;
+        // In production, use bcrypt: await bcrypt.compare(password, user.password)
+        return user;
+      },
+    }),
+    // Add: Google({ clientId: ..., clientSecret: ... })
+    // Add: GitHub({ clientId: ..., clientSecret: ... })
+  ],
+  session: { strategy: 'jwt' },
+});
+
+export async function getSession(): Promise<Session | null> {
+  const session = await auth();
+  if (!session?.user) return null;
+  return {
+    user: {
+      id: session.user.id!,
+      name: session.user.name!,
+      email: session.user.email!,
+      image: session.user.image,
+    },
+  };
+}
+
+export async function requireAuth(): Promise<Session> {
+  const session = await getSession();
+  if (!session) {
+    const { redirect } = await import('next/navigation');
+    redirect('/login');
+  }
+  return session;
+}
+
+export async function signIn(
+  email: string,
+  password: string,
+): Promise<Session | null> {
+  try {
+    await nextAuthSignIn('credentials', { email, password, redirect: false });
+    return getSession();
+  } catch {
+    return null;
+  }
+}
+
+export async function signOut(): Promise<void> {
+  await nextAuthSignOut({ redirect: false });
+}
+```
+
+### Add route handler
+
+Create `app/api/auth/[...nextauth]/route.ts`:
+
+```typescript
+import { handlers } from '@/app/lib/auth';
+export const { GET, POST } = handlers;
+```
+
+---
+
+## better-auth
+
+### Install
+
+```bash
+npm install better-auth
+```
+
+### Replace `app/lib/auth.ts`
+
+```typescript
+import { betterAuth } from 'better-auth';
+import { prismaAdapter } from 'better-auth/adapters/prisma';
+import { prisma } from '@/app/lib/prisma';
+import { cookies } from 'next/headers';
+
+export interface AuthUser {
+  id: string;
+  name: string;
+  email: string;
+  image?: string | null;
+}
+
+export interface Session {
+  user: AuthUser;
+}
+
+const auth = betterAuth({
+  database: prismaAdapter(prisma, { provider: 'sqlite' }),
+  emailAndPassword: { enabled: true },
+});
+
+export async function getSession(): Promise<Session | null> {
+  const cookieStore = await cookies();
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: cookieStore.toString() }),
+  });
+  if (!session?.user) return null;
+  return {
+    user: {
+      id: session.user.id,
+      name: session.user.name,
+      email: session.user.email,
+      image: session.user.image ?? null,
+    },
+  };
+}
+
+export async function requireAuth(): Promise<Session> {
+  const session = await getSession();
+  if (!session) {
+    const { redirect } = await import('next/navigation');
+    redirect('/login');
+  }
+  return session;
+}
+
+export async function signIn(
+  email: string,
+  password: string,
+): Promise<Session | null> {
+  try {
+    await auth.api.signInEmail({ body: { email, password } });
+    return getSession();
+  } catch {
+    return null;
+  }
+}
+
+export async function signOut(): Promise<void> {
+  const cookieStore = await cookies();
+  await auth.api.signOut({
+    headers: new Headers({ cookie: cookieStore.toString() }),
+  });
+}
+```
+
+---
+
+## Supabase Auth
+
+### Install
+
+```bash
+npm install @supabase/supabase-js @supabase/ssr
+```
+
+### Replace `app/lib/auth.ts`
+
+```typescript
+import { createServerClient } from '@supabase/ssr';
+import { cookies } from 'next/headers';
+
+export interface AuthUser {
+  id: string;
+  name: string;
+  email: string;
+  image?: string | null;
+}
+
+export interface Session {
+  user: AuthUser;
+}
+
+function createClient() {
+  const cookieStore = cookies();
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll: () => cookieStore.then((c) => c.getAll()),
+        setAll: (cookies) =>
+          cookieStore.then((c) => {
+            cookies.forEach(({ name, value, options }) =>
+              c.set(name, value, options),
+            );
+          }),
+      },
+    },
+  );
+}
+
+export async function getSession(): Promise<Session | null> {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return null;
+  return {
+    user: {
+      id: user.id,
+      name: user.user_metadata.name || user.email?.split('@')[0] || '',
+      email: user.email!,
+      image: user.user_metadata.avatar_url ?? null,
+    },
+  };
+}
+
+export async function requireAuth(): Promise<Session> {
+  const session = await getSession();
+  if (!session) {
+    const { redirect } = await import('next/navigation');
+    redirect('/login');
+  }
+  return session;
+}
+
+export async function signIn(
+  email: string,
+  password: string,
+): Promise<Session | null> {
+  const supabase = createClient();
+  const { error } = await supabase.auth.signInWithPassword({ email, password });
+  if (error) return null;
+  return getSession();
+}
+
+export async function signOut(): Promise<void> {
+  const supabase = createClient();
+  await supabase.auth.signOut();
+}
+```
+
+### Environment variables
+
+Add to `.env.local`:
+
+```
+NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
+```
+
+---
+
+## After Upgrading
+
+1. Remove the `Session` model from `prisma/schema.prisma` (the provider manages sessions)
+2. Keep the `User` model if your provider uses it, or migrate to the provider's user table
+3. Run `npm run db:push` to apply schema changes
+4. Test sign-in and sign-out flows
+5. Update scenario seed data if the session table structure changed

package/codeyam-cli/templates/nextjs-prisma-sqlite/DATABASE.md

@@ -0,0 +1,126 @@
+# Database
+
+This project uses **Prisma 7 with SQLite** for local development. No external services needed.
+
+All application code imports from `@/app/lib/prisma` — this is the only file that changes when you upgrade to a hosted database.
+
+## Quick Reference
+
+```bash
+# Edit your schema
+vim prisma/schema.prisma
+
+# Push schema changes (also regenerates Prisma client)
+npm run db:push
+
+# Seed demo data
+npm run db:seed
+
+# Reset database (delete + recreate + seed)
+npm run db:reset
+
+# Browse data visually
+npx prisma studio
+```
+
+## Adding Columns to Existing Tables
+
+When adding a new **required** column to a table that already has data, `db push` will fail because existing rows have no value for the new column. To avoid this:
+
+- **Add a `@default(...)` value** so Prisma can fill existing rows automatically:
+  ```prisma
+  model Rating {
+    userId String @default("anonymous")  // existing rows get "anonymous"
+  }
+  ```
+- Once all rows have real values, you can remove the default if desired.
+- **Never use `--force-reset`** — it drops ALL tables and deletes all data.
+- Optional columns (`String?`) don't need a default — existing rows get `null`.
+
+## Using the Database
+
+```typescript
+import { prisma } from '@/app/lib/prisma';
+
+// In API routes or server components:
+const items = await prisma.todo.findMany();
+const item = await prisma.todo.create({ data: { title: 'New item' } });
+```
+
+## Important: Do NOT Change These Settings
+
+- **Generator must be `prisma-client-js`** (not `prisma-client`). The `prisma-client` generator requires a custom output path that breaks Turbopack.
+- **Do NOT add an `output` field** to the generator.
+- **Do NOT add `url` to the datasource block** in `schema.prisma`. Prisma 7 moved the URL to `prisma.config.ts`.
+- **Keep `serverExternalPackages: ["better-sqlite3"]`** in `next.config.ts`.
+- **Keep `turbopack: { root: "." }`** in `next.config.ts`.
+- **Always run `npx prisma generate`** after `npx prisma db push` (or use `npm run db:push` which does both).
+- **Database file is at project root** (`./dev.db`), not in `prisma/`.
+
+## Upgrading to a Hosted Database
+
+When you're ready for production, you'll want a hosted database. SQLite is great for prototyping, but doesn't support concurrent connections or run in serverless environments (Vercel, etc.).
+
+### Option 1: Supabase (PostgreSQL)
+
+Free tier available. Gives you PostgreSQL + auth + realtime + storage.
+
+1. Create a project at https://supabase.com/dashboard
+2. Get your credentials from Project Settings > Database > Connection string (URI)
+3. Replace packages:
+   ```bash
+   npm uninstall better-sqlite3 @prisma/adapter-better-sqlite3 @types/better-sqlite3
+   npm install @prisma/adapter-pg pg @supabase/supabase-js
+   npm install -D @types/pg
+   ```
+4. Update `prisma/schema.prisma`:
+   ```prisma
+   datasource db {
+     provider = "postgresql"
+   }
+   ```
+5. Update `app/lib/prisma.ts`:
+
+   ```typescript
+   import { PrismaClient } from '@prisma/client';
+   import { PrismaPg } from '@prisma/adapter-pg';
+
+   const globalForPrisma = globalThis as unknown as { prisma: PrismaClient };
+   const connectionString = process.env.DATABASE_URL!;
+   const adapter = new PrismaPg({ connectionString });
+   export const prisma =
+     globalForPrisma.prisma ?? new PrismaClient({ adapter });
+   if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;
+   export default prisma;
+   ```
+
+6. Create `.env`:
+   ```
+   DATABASE_URL=postgresql://postgres.YOUR_PROJECT_ID:YOUR_PASSWORD@aws-0-us-east-1.pooler.supabase.com:6543/postgres
+   ```
+7. Remove `serverExternalPackages` from `next.config.ts`
+8. Run `npm run db:push` to create tables in Supabase
+9. Update `prisma/seed.ts` to use the new adapter (same pattern as `prisma.ts`)
+
+### Option 2: Other PostgreSQL Hosts (Neon, Railway, etc.)
+
+Same steps as Supabase above (steps 3-9), just use your provider's connection string.
+
+### Option 3: PlanetScale / MySQL
+
+1. Replace packages:
+   ```bash
+   npm uninstall better-sqlite3 @prisma/adapter-better-sqlite3 @types/better-sqlite3
+   npm install @prisma/adapter-planetscale @planetscale/database
+   ```
+2. Update `schema.prisma` datasource to `provider = "mysql"`
+3. Update `app/lib/prisma.ts` to use `PrismaPlanetScale` adapter
+4. Follow PlanetScale setup docs for connection string
+
+### What Stays the Same
+
+Your application code doesn't change at all. Every file that uses the database already imports from `@/app/lib/prisma`, which is the only file that gets updated. Your Prisma schema models, API routes, and server components all work identically regardless of which database backs them.
+
+## Writing Seed Scripts
+
+Seed scripts run outside of Next.js, so they must create their own PrismaClient with the adapter (they cannot import from `@/app/lib/prisma`). See `prisma/seed.ts` for the correct pattern.

package/codeyam-cli/templates/nextjs-prisma-sqlite/FEATURE_PATTERNS.md

@@ -0,0 +1,37 @@
+# Feature Patterns
+
+When the feature you're building involves any of the patterns below, **read the linked doc before writing code**. These patterns are designed for the local SQLite dev environment and upgrade cleanly to production services later.
+
+## Authentication (login, sign-up, user sessions)
+
+**Read:** `AUTH_PATTERNS.md`
+
+Use the cookie + DB auth abstraction in `app/lib/auth.ts`. All consumer code imports from this single file. DO NOT use NextAuth, Clerk, better-auth, Supabase Auth, or any external auth provider during prototyping — they require infrastructure unavailable locally.
+
+**For scenarios:** Include User and Session seed rows. Add `"session": {"cookieValue": "<token>"}` at the scenario top level to auto-log the user in. Omit `session` for a logged-out scenario.
+
+**Upgrade path:** See `AUTH_UPGRADE.md` — only `app/lib/auth.ts` internals change; consumer code stays the same.
+
+## External Services (payments, email, maps, weather APIs, etc.)
+
+If the user has dev/test credentials (e.g., Stripe test keys):
+
+- Store them in `.codeyam/config.json` under `environmentVariables`
+- Restart the dev server — credentials are injected into `process.env`
+
+If no credentials are available:
+
+- Build with real API calls in the code
+- Mock responses per scenario using `externalApis` in scenario registration (Step 8)
+
+## File Storage / Uploads
+
+For local prototyping, store files in the `public/uploads/` directory and serve them as static assets. Use `fs.writeFile` in API routes. For production, swap to S3/Cloudflare R2/Supabase Storage.
+
+## Email / Notifications
+
+For prototyping, log emails to the console or write them to a `/api/dev/sent-emails` endpoint that stores in the database. For production, swap to Resend/SendGrid/Postmark.
+
+---
+
+_This list will grow as new patterns are added. Each pattern follows the same principle: build with a simple local implementation, upgrade to a production service later by swapping one file._

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/api/todos/route.ts

@@ -0,0 +1,17 @@
+// Example API route using Prisma.
+// Import prisma from the singleton — do NOT create a new PrismaClient here.
+
+import { prisma } from '@/app/lib/prisma';
+
+export async function GET() {
+  const todos = await prisma.todo.findMany({
+    orderBy: { createdAt: 'desc' },
+  });
+  return Response.json(todos);
+}
+
+export async function POST(request: Request) {
+  const { title } = await request.json();
+  const todo = await prisma.todo.create({ data: { title } });
+  return Response.json(todo);
+}

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/codeyam-isolate/layout.tsx

@@ -0,0 +1,12 @@
+import { notFound } from 'next/navigation';
+
+export default function CodeYamIsolateLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  if (process.env.NODE_ENV === 'production') {
+    notFound();
+  }
+  return <>{children}</>;
+}

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/globals.css

@@ -0,0 +1,26 @@
+@import "tailwindcss";
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: #0a0a0a;
+    --foreground: #ededed;
+  }
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: Arial, Helvetica, sans-serif;
+}

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/layout.tsx

@@ -0,0 +1,34 @@
+import type { Metadata } from 'next';
+import { Geist, Geist_Mono } from 'next/font/google';
+import './globals.css';
+
+const geistSans = Geist({
+  variable: '--font-geist-sans',
+  subsets: ['latin'],
+});
+
+const geistMono = Geist_Mono({
+  variable: '--font-geist-mono',
+  subsets: ['latin'],
+});
+
+export const metadata: Metadata = {
+  title: 'CodeYam App',
+  description: 'Built with CodeYam Editor',
+};
+
+export default function RootLayout({
+  children,
+}: Readonly<{
+  children: React.ReactNode;
+}>) {
+  return (
+    <html lang="en">
+      <body
+        className={`${geistSans.variable} ${geistMono.variable} antialiased`}
+      >
+        {children}
+      </body>
+    </html>
+  );
+}

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/lib/prisma.ts

@@ -0,0 +1,24 @@
+// Database connection singleton.
+// This is the ONLY file that changes when upgrading to a hosted database.
+// All application code imports from here — API routes, server components, etc.
+//
+// Usage:
+//   import { prisma } from "@/app/lib/prisma";
+//   const items = await prisma.todo.findMany();
+//
+// To upgrade to a hosted database (e.g., Supabase PostgreSQL), see DATABASE.md.
+
+import { PrismaClient } from '@prisma/client';
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3';
+
+const globalForPrisma = globalThis as unknown as { prisma: PrismaClient };
+
+const adapter = new PrismaBetterSqlite3({
+  url: process.env.DATABASE_URL || 'file:./dev.db',
+});
+
+export const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter });
+
+if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;
+
+export default prisma;

package/codeyam-cli/templates/nextjs-prisma-sqlite/app/page.tsx

@@ -0,0 +1,10 @@
+export default function Home() {
+  return (
+    <main className="min-h-screen flex items-center justify-center">
+      <div className="text-center">
+        <h1 className="text-4xl font-bold mb-4">Welcome</h1>
+        <p className="text-gray-600">Your app is ready. Start building!</p>
+      </div>
+    </main>
+  );
+}

package/codeyam-cli/templates/nextjs-prisma-sqlite/env

@@ -0,0 +1,4 @@
+# Local SQLite database (no external services needed)
+# This is used by Prisma CLI commands (db push, migrate, etc.)
+# The app code in app/lib/prisma.ts also uses this path.
+DATABASE_URL=file:./dev.db

package/codeyam-cli/templates/nextjs-prisma-sqlite/eslint.config.mjs

@@ -0,0 +1,11 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
+
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  ...nextTs,
+  globalIgnores([".next/**", "out/**", "build/**", "next-env.d.ts"]),
+]);
+
+export default eslintConfig;

package/codeyam-cli/templates/nextjs-prisma-sqlite/gitignore

@@ -0,0 +1,64 @@
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files
+.env*.local
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+# database
+dev.db
+dev.db-journal
+
+# CodeYam - local only (not shared)
+.codeyam/db.sqlite3
+.codeyam/db.sqlite3-wal
+.codeyam/db.sqlite3-shm
+.codeyam/secrets.json
+.codeyam/server.json
+.codeyam/server-state.json
+.codeyam/queue.json
+.codeyam/active-scenario.json
+.codeyam/editor-step.json
+.codeyam/editor-user-prompt.txt
+.codeyam/editor-mode-context.md
+.codeyam/dev-mode-context.md
+.codeyam/logs/
+.codeyam/llm-calls/
+.codeyam/captures/
+.codeyam/results/
+.codeyam/tmp/
+.codeyam/rules/
+.codeyam/bin/

package/codeyam-cli/templates/nextjs-prisma-sqlite/next.config.ts

@@ -0,0 +1,14 @@
+import type { NextConfig } from 'next';
+
+const nextConfig: NextConfig = {
+  // Required: better-sqlite3 is a native module that can't be bundled
+  serverExternalPackages: ['better-sqlite3'],
+
+  turbopack: {
+    // Required: prevents Turbopack from inferring a parent directory as root
+    // when .codeyam/ exists above the project (which breaks import resolution)
+    root: '.',
+  },
+};
+
+export default nextConfig;