@dewtech/dare-cli 2.17.0 → 3.1.0

package/templates/stacks/node-nestjs/.github/workflows/dare-ci.yml

@@ -0,0 +1,54 @@
+name: DARE CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    name: Audit dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm audit --audit-level=high
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm prisma generate
+      - run: pnpm test

package/templates/stacks/node-nestjs/README.md.hbs

@@ -0,0 +1,35 @@
+# {{projectName}}
+
+DARE-shaped NestJS API. Layered Design (Handler → Service → Repository → Model).
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+pnpm install
+pnpm prisma migrate dev --name init
+pnpm prisma db seed
+pnpm start:dev
+```
+
+## Endpoints
+
+- `POST /auth/login` — exchange email/password for JWT
+- `GET /auth/me` — current user (Bearer JWT)
+- `GET /users` — list users (paginated)
+- `POST /users` — create user (admin only)
+- `GET /openapi.json` — OpenAPI 3.1 surface
+- `GET /api` — Swagger UI
+
+## Commands
+
+- `pnpm start:dev` — dev with watch
+- `pnpm test` — run tests
+- `pnpm lint` — ESLint
+- `pnpm audit` — dependency audit (fails on HIGH+)
+
+## DARE Method
+
+This project was scaffolded with the [DARE Method](https://github.com/dewtech-technologies/dare-method).
+See `.dare/skills.yml` for installed skills, `llms.txt` for agent context.

package/templates/stacks/node-nestjs/gitignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+coverage
+.env
+.env.local
+*.log
+.DS_Store

package/templates/stacks/node-nestjs/llms.txt.hbs

@@ -0,0 +1,47 @@
+# {{projectName}}
+
+DARE-shaped NestJS 10 API. Layered Design: Handler → Service → Repository → Model.
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+pnpm install
+pnpm prisma migrate dev --name init
+pnpm prisma db seed
+pnpm start:dev
+```
+
+## Commands
+
+- `pnpm start:dev` — dev server with watch (port 3000)
+- `pnpm test` — vitest run
+- `pnpm lint` — eslint
+- `pnpm audit` — pnpm audit --audit-level=high
+- `pnpm prisma migrate dev` — apply DB migrations
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST | `/auth/login` | none | Exchange email+password for JWT |
+| GET | `/auth/me` | Bearer | Current user info |
+| GET | `/users` | Bearer | List users (query: page, limit) |
+| POST | `/users` | Bearer (admin) | Create user |
+| GET | `/openapi.json` | none | OpenAPI 3.1 document |
+| GET | `/api` | none | Swagger UI |
+
+## Layered Design
+
+- `src/auth/`, `src/users/` — feature modules
+- Each module has: controller (HTTP), service (logic), repository (DB), dto (validation)
+- Prisma is encapsulated behind repositories; controllers and services never see Prisma directly
+
+## Env vars
+
+See `.env.example`. Required: `DATABASE_URL`, `JWT_SECRET`.
+
+## DARE skills
+
+See `.dare/skills.yml`.

package/templates/stacks/node-nestjs/nest-cli.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "plugins": [
+      {
+        "name": "@nestjs/swagger",
+        "options": {
+          "introspectComments": true,
+          "classValidatorShim": true
+        }
+      }
+    ]
+  }
+}

package/templates/stacks/node-nestjs/openapi.json.hbs

@@ -0,0 +1,75 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "{{projectName}}",
+    "version": "0.1.0",
+    "description": "DARE-shaped NestJS API"
+  },
+  "paths": {
+    "/auth/login": {
+      "post": {
+        "summary": "Exchange email+password for JWT",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": ["email", "password"],
+                "properties": {
+                  "email": { "type": "string", "format": "email" },
+                  "password": { "type": "string", "minLength": 8 }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "JWT issued",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "accessToken": { "type": "string" },
+                    "expiresIn": { "type": "integer" }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "description": "Invalid credentials" }
+        }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "summary": "Current user",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "User info" }, "401": { "description": "Unauthorized" } }
+      }
+    },
+    "/users": {
+      "get": {
+        "summary": "List users",
+        "security": [{ "bearer": [] }],
+        "parameters": [
+          { "name": "page", "in": "query", "schema": { "type": "integer", "minimum": 1, "default": 1 } },
+          { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 20 } }
+        ],
+        "responses": { "200": { "description": "Page of users" } }
+      },
+      "post": {
+        "summary": "Create user (admin)",
+        "security": [{ "bearer": [] }],
+        "responses": { "201": { "description": "Created" }, "403": { "description": "Forbidden" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }
+    }
+  }
+}

package/templates/stacks/node-nestjs/package.json.hbs

@@ -0,0 +1,57 @@
+{
+  "name": "{{projectName}}",
+  "version": "0.1.0",
+  "private": true,
+  "description": "DARE-shaped NestJS API",
+  "scripts": {
+    "build": "nest build",
+    "start": "nest start",
+    "start:dev": "nest start --watch",
+    "start:prod": "node dist/main",
+    "test": "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "lint": "eslint src --ext .ts",
+    "audit": "pnpm audit --audit-level=high"
+  },
+  "dependencies": {
+    "@nestjs/common": "^10.3.0",
+    "@nestjs/config": "^3.2.0",
+    "@nestjs/core": "^10.3.0",
+    "@nestjs/jwt": "^10.2.0",
+    "@nestjs/passport": "^10.0.3",
+    "@nestjs/platform-express": "^10.3.0",
+    "@nestjs/swagger": "^7.3.0",
+    "@nestjs/throttler": "^6.0.0",
+    "@prisma/client": "^5.14.0",
+    "bcrypt": "^5.1.1",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.1",
+    "nestjs-pino": "^4.0.0",
+    "passport": "^0.7.0",
+    "passport-jwt": "^4.0.1",
+    "pino-http": "^9.0.0",
+    "pino-pretty": "^11.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0"
+  },
+  "devDependencies": {
+    "@nestjs/cli": "^10.3.2",
+    "@nestjs/schematics": "^10.1.1",
+    "@nestjs/testing": "^10.3.0",
+    "@types/bcrypt": "^5.0.0",
+    "@types/express": "^4.17.0",
+    "@types/node": "^20.11.0",
+    "@types/passport-jwt": "^4.0.1",
+    "@typescript-eslint/eslint-plugin": "^7.0.0",
+    "@typescript-eslint/parser": "^7.0.0",
+    "eslint": "^8.57.0",
+    "prisma": "^5.14.0",
+    "ts-node": "^10.9.2",
+    "tsx": "^4.16.0",
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  },
+  "prisma": {
+    "seed": "tsx prisma/seed.ts"
+  }
+}

package/templates/stacks/node-nestjs/prisma/schema.prisma

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MIT
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model User {
+  id        String   @id @default(uuid())
+  email     String   @unique
+  password  String
+  role      Role     @default(USER)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([email])
+}
+
+enum Role {
+  USER
+  ADMIN
+}

package/templates/stacks/node-nestjs/prisma/seed.ts.hbs

@@ -0,0 +1,25 @@
+import { PrismaClient } from '@prisma/client';
+import * as bcrypt from 'bcrypt';
+
+const prisma = new PrismaClient();
+
+async function main(): Promise<void> {
+  const cost = Number(process.env.BCRYPT_COST ?? 12);
+  await prisma.user.upsert({
+    where: { email: 'admin@{{projectName}}.local' },
+    update: {},
+    create: {
+      email: 'admin@{{projectName}}.local',
+      password: await bcrypt.hash('Admin0Pass', cost),
+      role: 'ADMIN',
+    },
+  });
+  console.log('[seed] admin user ready');
+}
+
+main()
+  .catch((err) => {
+    console.error(err);
+    process.exit(1);
+  })
+  .finally(() => prisma.$disconnect());

package/templates/stacks/node-nestjs/src/app.module.ts

@@ -0,0 +1,39 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
+import { APP_GUARD, APP_INTERCEPTOR } from '@nestjs/core';
+import { LoggerModule } from 'nestjs-pino';
+import { AuthModule } from './auth/auth.module.js';
+import { UsersModule } from './users/users.module.js';
+import { PrismaModule } from './prisma/prisma.module.js';
+import { JsonResponseInterceptor } from './common/interceptors/json-response.interceptor.js';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({ isGlobal: true }),
+    LoggerModule.forRoot({
+      pinoHttp: {
+        level: process.env.LOG_LEVEL ?? 'info',
+        transport:
+          process.env.NODE_ENV !== 'production'
+            ? { target: 'pino-pretty' }
+            : undefined,
+      },
+    }),
+    // Rate limit — knobs in env.
+    ThrottlerModule.forRoot([
+      {
+        ttl: Number(process.env.RATE_LIMIT_TTL ?? 60) * 1000,
+        limit: Number(process.env.RATE_LIMIT_RPM ?? 60),
+      },
+    ]),
+    PrismaModule,
+    AuthModule,
+    UsersModule,
+  ],
+  providers: [
+    { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_INTERCEPTOR, useClass: JsonResponseInterceptor },
+  ],
+})
+export class AppModule {}

package/templates/stacks/node-nestjs/src/auth/auth.controller.ts

@@ -0,0 +1,29 @@
+import { Body, Controller, Get, HttpCode, Post, Req, UseGuards } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
+import type { Request } from 'express';
+import { AuthService } from './auth.service.js';
+import { LoginDto } from './dto/login.dto.js';
+import { LoginResponseDto } from './dto/login-response.dto.js';
+import { UserDto } from '../users/dto/user.dto.js';
+
+@ApiTags('auth')
+@Controller('auth')
+export class AuthController {
+  constructor(private readonly auth: AuthService) {}
+
+  @Post('login')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Exchange email+password for a JWT' })
+  login(@Body() dto: LoginDto): Promise<LoginResponseDto> {
+    return this.auth.login(dto);
+  }
+
+  @Get('me')
+  @UseGuards(AuthGuard('jwt'))
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'Current authenticated user' })
+  me(@Req() req: Request): UserDto {
+    return req.user as UserDto;
+  }
+}

package/templates/stacks/node-nestjs/src/auth/auth.module.ts

@@ -0,0 +1,25 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { PassportModule } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { AuthController } from './auth.controller.js';
+import { AuthService } from './auth.service.js';
+import { JwtStrategy } from './jwt.strategy.js';
+import { UsersModule } from '../users/users.module.js';
+
+@Module({
+  imports: [
+    PassportModule,
+    JwtModule.registerAsync({
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => ({
+        secret: config.get<string>('JWT_SECRET'),
+        signOptions: { expiresIn: config.get<string>('JWT_EXPIRES_IN', '15m') },
+      }),
+    }),
+    UsersModule,
+  ],
+  controllers: [AuthController],
+  providers: [AuthService, JwtStrategy],
+})
+export class AuthModule {}

package/templates/stacks/node-nestjs/src/auth/auth.service.ts

@@ -0,0 +1,36 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import * as bcrypt from 'bcrypt';
+import { UsersRepository } from '../users/users.repository.js';
+import { LoginDto } from './dto/login.dto.js';
+import { LoginResponseDto } from './dto/login-response.dto.js';
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private readonly users: UsersRepository,
+    private readonly jwt: JwtService,
+    private readonly config: ConfigService,
+  ) {}
+
+  async login(dto: LoginDto): Promise<LoginResponseDto> {
+    const user = await this.users.findByEmail(dto.email);
+    if (!user) throw new UnauthorizedException('Invalid credentials');
+    const ok = await bcrypt.compare(dto.password, user.password);
+    if (!ok) throw new UnauthorizedException('Invalid credentials');
+
+    const payload = { sub: user.id, email: user.email, role: user.role };
+    const accessToken = await this.jwt.signAsync(payload);
+    const expiresIn = parseExpires(this.config.get<string>('JWT_EXPIRES_IN', '15m'));
+    return { accessToken, expiresIn };
+  }
+}
+
+function parseExpires(expr: string): number {
+  const m = /^(\d+)([smhd])$/.exec(expr);
+  if (!m) return 900;
+  const n = Number(m[1]);
+  const mult = { s: 1, m: 60, h: 3600, d: 86400 }[m[2] as 's' | 'm' | 'h' | 'd'];
+  return n * mult;
+}

package/templates/stacks/node-nestjs/src/auth/dto/login-response.dto.ts

@@ -0,0 +1,9 @@
+import { ApiProperty } from '@nestjs/swagger';
+
+export class LoginResponseDto {
+  @ApiProperty()
+  accessToken!: string;
+
+  @ApiProperty({ description: 'Seconds until token expiry' })
+  expiresIn!: number;
+}

package/templates/stacks/node-nestjs/src/auth/dto/login.dto.ts

@@ -0,0 +1,17 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsEmail, IsString, Matches, MinLength } from 'class-validator';
+import { Transform } from 'class-transformer';
+
+export class LoginDto {
+  @ApiProperty({ example: 'user@example.com' })
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim().toLowerCase() : value))
+  @IsEmail()
+  email!: string;
+
+  @ApiProperty({ example: 'Str0ngPass!' })
+  @IsString()
+  @MinLength(8)
+  @Matches(/[A-Z]/, { message: 'password must contain an uppercase letter' })
+  @Matches(/[0-9]/, { message: 'password must contain a digit' })
+  password!: string;
+}

package/templates/stacks/node-nestjs/src/auth/jwt.strategy.ts

@@ -0,0 +1,25 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+
+interface JwtPayload {
+  sub: string;
+  email: string;
+  role: string;
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
+  constructor(config: ConfigService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: config.get<string>('JWT_SECRET') ?? 'replace-me',
+    });
+  }
+
+  validate(payload: JwtPayload): { id: string; email: string; role: string } {
+    return { id: payload.sub, email: payload.email, role: payload.role };
+  }
+}

package/templates/stacks/node-nestjs/src/common/filters/problem-details.filter.ts

@@ -0,0 +1,38 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import type { Request, Response } from 'express';
+
+/**
+ * RFC 7807 Problem Details — uniform error shape across the API.
+ */
+@Catch()
+export class ProblemDetailsFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost): void {
+    const ctx = host.switchToHttp();
+    const res = ctx.getResponse<Response>();
+    const req = ctx.getRequest<Request>();
+
+    const status =
+      exception instanceof HttpException
+        ? exception.getStatus()
+        : HttpStatus.INTERNAL_SERVER_ERROR;
+
+    const body =
+      exception instanceof HttpException
+        ? (exception.getResponse() as Record<string, unknown>)
+        : { message: 'Internal server error' };
+
+    res.status(status).json({
+      type: `urn:problem:${status}`,
+      title: typeof body.error === 'string' ? body.error : body.message,
+      status,
+      detail: Array.isArray(body.message) ? body.message.join('; ') : body.message,
+      instance: req.url,
+    });
+  }
+}

package/templates/stacks/node-nestjs/src/common/interceptors/json-response.interceptor.ts

@@ -0,0 +1,13 @@
+import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
+import { Observable } from 'rxjs';
+
+/**
+ * No-op interceptor placeholder. Reserved for cross-cutting JSON envelope work
+ * (correlation ids, timing, etc.) — currently passthrough.
+ */
+@Injectable()
+export class JsonResponseInterceptor implements NestInterceptor {
+  intercept(_ctx: ExecutionContext, next: CallHandler): Observable<unknown> {
+    return next.handle();
+  }
+}

package/templates/stacks/node-nestjs/src/main.ts.hbs

@@ -0,0 +1,44 @@
+import { NestFactory } from '@nestjs/core';
+import { ValidationPipe } from '@nestjs/common';
+import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { Logger } from 'nestjs-pino';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { AppModule } from './app.module.js';
+import { ProblemDetailsFilter } from './common/filters/problem-details.filter.js';
+
+async function bootstrap(): Promise<void> {
+  const app = await NestFactory.create(AppModule, { bufferLogs: true });
+  app.useLogger(app.get(Logger));
+
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  );
+  app.useGlobalFilters(new ProblemDetailsFilter());
+
+  const config = new DocumentBuilder()
+    .setTitle('{{projectName}}')
+    .setDescription('DARE-shaped NestJS API')
+    .setVersion('0.1.0')
+    .addBearerAuth()
+    .build();
+  const doc = SwaggerModule.createDocument(app, config);
+  SwaggerModule.setup('api', app, doc);
+
+  // Persist openapi.json so M-02 (machine-readable surface) is met without
+  // requiring the server to be running.
+  try {
+    writeFileSync(join(process.cwd(), 'openapi.json'), JSON.stringify(doc, null, 2));
+  } catch {
+    /* non-fatal */
+  }
+
+  const port = Number(process.env.PORT ?? 3000);
+  await app.listen(port);
+}
+
+void bootstrap();

package/templates/stacks/node-nestjs/src/prisma/prisma.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service.js';
+
+@Global()
+@Module({
+  providers: [PrismaService],
+  exports: [PrismaService],
+})
+export class PrismaModule {}

package/templates/stacks/node-nestjs/src/prisma/prisma.service.ts

@@ -0,0 +1,9 @@
+import { Injectable, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+
+@Injectable()
+export class PrismaService extends PrismaClient implements OnModuleInit {
+  async onModuleInit(): Promise<void> {
+    await this.$connect();
+  }
+}