@donotdev/cli 0.0.14 → 0.0.16

package/templates/functions-supabase/supabase/functions/get-user-auth-status/index.ts.example

@@ -0,0 +1,7 @@
+// supabase/functions/get-user-auth-status/index.ts
+// Supabase Edge Function — Get User Auth Status
+// Deploy: supabase functions deploy get-user-auth-status
+
+import { createGetUserAuthStatus } from '@donotdev/functions/supabase';
+
+Deno.serve(createGetUserAuthStatus());

package/templates/functions-supabase/supabase/functions/refresh-subscription-status/index.ts.example

@@ -0,0 +1,7 @@
+// supabase/functions/refresh-subscription-status/index.ts
+// Supabase Edge Function — Refresh Subscription Status
+// Deploy: supabase functions deploy refresh-subscription-status
+
+import { createRefreshSubscriptionStatus } from '@donotdev/functions/supabase';
+
+Deno.serve(createRefreshSubscriptionStatus());

package/templates/functions-supabase/supabase/functions/remove-custom-claims/index.ts.example

@@ -0,0 +1,7 @@
+// supabase/functions/remove-custom-claims/index.ts
+// Supabase Edge Function — Remove Custom Claims from app_metadata
+// Deploy: supabase functions deploy remove-custom-claims
+
+import { createRemoveCustomClaims } from '@donotdev/functions/supabase';
+
+Deno.serve(createRemoveCustomClaims());

package/templates/functions-supabase/supabase/functions/set-custom-claims/index.ts.example

@@ -0,0 +1,7 @@
+// supabase/functions/set-custom-claims/index.ts
+// Supabase Edge Function — Set Custom Claims (app_metadata)
+// Deploy: supabase functions deploy set-custom-claims
+
+import { createSetCustomClaims } from '@donotdev/functions/supabase';
+
+Deno.serve(createSetCustomClaims());

package/templates/functions-supabase/supabase/migrations/20250101000000_idempotency.sql

@@ -0,0 +1,24 @@
+-- Migration: Create idempotency table for Supabase CRUD operations
+-- Generated: 2026-02-19
+-- Purpose: Store operation results to prevent duplicate processing
+-- TTL: 24 hours default, configurable per operation
+
+CREATE TABLE IF NOT EXISTS idempotency (
+  id TEXT PRIMARY KEY,                    -- Format: "{operation}_{idempotencyKey}"
+  operation TEXT NOT NULL,                 -- 'create', 'update', 'delete', etc.
+  idempotency_key TEXT NOT NULL UNIQUE,   -- Client-provided key
+  result JSONB NOT NULL,                  -- Cached operation result
+  processed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  processed_by TEXT NOT NULL,             -- User ID
+  expires_at TIMESTAMPTZ NOT NULL         -- TTL for cleanup (default: 24h)
+);
+
+-- Indexes for efficient lookups
+CREATE INDEX IF NOT EXISTS idx_idempotency_expires ON idempotency(expires_at);
+CREATE INDEX IF NOT EXISTS idx_idempotency_key ON idempotency(idempotency_key);
+CREATE INDEX IF NOT EXISTS idx_idempotency_operation ON idempotency(operation, expires_at);
+
+-- Comments
+COMMENT ON TABLE idempotency IS 'Stores idempotency keys and cached operation results to prevent duplicate processing';
+COMMENT ON COLUMN idempotency.id IS 'Composite key: {operation}_{idempotencyKey}';
+COMMENT ON COLUMN idempotency.expires_at IS 'TTL for automatic cleanup - defaults to 24 hours from processed_at';

package/templates/functions-supabase/supabase/migrations/20250101000001_rate_limits.sql

@@ -0,0 +1,22 @@
+-- Migration: Create rate_limits table for Supabase Edge Functions
+-- Generated: 2026-02-19
+-- Purpose: Track API call rates per user/IP to prevent abuse
+-- Pattern: Same as Firebase Firestore rateLimits collection
+
+CREATE TABLE IF NOT EXISTS rate_limits (
+  key TEXT PRIMARY KEY,                    -- Format: "{operation}_{identifier}" (e.g., "create_apartment_uid_123")
+  attempts INTEGER NOT NULL DEFAULT 1,
+  window_start TIMESTAMPTZ NOT NULL DEFAULT now(),
+  block_until TIMESTAMPTZ,                 -- NULL if not blocked
+  last_updated TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Indexes for efficient lookups and cleanup
+CREATE INDEX IF NOT EXISTS idx_rate_limits_window ON rate_limits(window_start);
+CREATE INDEX IF NOT EXISTS idx_rate_limits_block ON rate_limits(block_until) WHERE block_until IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_rate_limits_updated ON rate_limits(last_updated);
+
+-- Comments
+COMMENT ON TABLE rate_limits IS 'Tracks API call rates per operation and identifier (user ID or IP)';
+COMMENT ON COLUMN rate_limits.key IS 'Composite key: {operation}_{identifier_type}_{identifier_value}';
+COMMENT ON COLUMN rate_limits.block_until IS 'Timestamp when rate limit block expires (NULL if not blocked)';

package/templates/functions-supabase/supabase/migrations/20250101000002_cleanup_jobs.sql

@@ -0,0 +1,28 @@
+-- Migration: Create cleanup cron jobs for idempotency and rate_limits tables
+-- Generated: 2026-02-19
+-- Purpose: Automatically clean up expired records to prevent table bloat
+-- Schedule: Daily at 2 AM UTC (idempotency), 3 AM UTC (rate_limits), 4 AM UTC (metrics)
+
+-- Enable pg_cron extension (if not already enabled)
+CREATE EXTENSION IF NOT EXISTS pg_cron;
+
+-- Cleanup expired idempotency records (daily at 2 AM UTC)
+SELECT cron.schedule(
+  'cleanup-idempotency',
+  '0 2 * * *',
+  $$DELETE FROM idempotency WHERE expires_at < now()$$
+);
+
+-- Cleanup old rate limit records (daily at 3 AM UTC)
+SELECT cron.schedule(
+  'cleanup-rate-limits',
+  '0 3 * * *',
+  $$DELETE FROM rate_limits WHERE window_start + interval '7 days' < now()$$
+);
+
+-- Cleanup old operation metrics (daily at 4 AM UTC)
+SELECT cron.schedule(
+  'cleanup-operation-metrics',
+  '0 4 * * *',
+  $$DELETE FROM operation_metrics WHERE timestamp < now() - interval '90 days'$$
+);

package/templates/functions-supabase/supabase/migrations/20250101000003_operation_metrics.sql

@@ -0,0 +1,28 @@
+-- Migration: Create operation_metrics table for Supabase Edge Functions monitoring
+-- Generated: 2026-02-19
+-- Purpose: Track operation success/failure rates, duration, and user activity
+-- Retention: 90 days (configurable via cleanup job)
+
+CREATE TABLE IF NOT EXISTS operation_metrics (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  operation TEXT NOT NULL,                  -- e.g., 'create_apartment', 'get_user'
+  user_id TEXT,                             -- NULL for guest operations
+  status TEXT NOT NULL,                     -- 'success', 'failed', 'pending'
+  duration_ms INTEGER,                      -- Operation duration in milliseconds
+  timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
+  metadata JSONB,                           -- Additional context (request ID, etc.)
+  error_code TEXT,                          -- If status = 'failed'
+  error_message TEXT                        -- If status = 'failed'
+);
+
+-- Indexes for efficient queries
+CREATE INDEX IF NOT EXISTS idx_metrics_operation ON operation_metrics(operation, timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_metrics_user ON operation_metrics(user_id, timestamp DESC) WHERE user_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_metrics_status ON operation_metrics(status, timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_metrics_timestamp ON operation_metrics(timestamp DESC);
+
+-- Comments
+COMMENT ON TABLE operation_metrics IS 'Tracks operation metrics for monitoring and analytics';
+COMMENT ON COLUMN operation_metrics.operation IS 'Operation name (e.g., create_apartment, get_user)';
+COMMENT ON COLUMN operation_metrics.duration_ms IS 'Operation duration in milliseconds';
+COMMENT ON COLUMN operation_metrics.metadata IS 'Additional context as JSON (request ID, etc.)';

package/templates/functions-vercel/functions-vercel/tsconfig.json.example

@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.base.json",
+  "extends": "../../../tsconfig.functions.json",
   "compilerOptions": {
     "outDir": "./lib",
     "rootDir": "./src",

package/templates/functions-vercel/functions-vercel/vercel.json.example

@@ -1,7 +1,7 @@
 {
   "functions": {
     "src/api/**/*.ts": {
-      "runtime": "nodejs20.x"
+      "runtime": "nodejs22.x"
     }
   },
   "env": {

package/templates/functions-vercel/vercel.json.example

@@ -1,7 +1,7 @@
 {
   "functions": {
     "src/api/**/*.ts": {
-      "runtime": "nodejs20.x"
+      "runtime": "nodejs22.x"
     }
   },
   "env": {

package/templates/github/github/workflows/firebase-deploy.yml.example

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20' # Using Node 20
+          node-version: '22' # Using Node 22 LTS
           
       # Step 5: Setup Bun
       - name: Install Bun

package/templates/github/workflows/firebase-deploy.yml.example

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20' # Using Node 20
+          node-version: '22' # Using Node 22 LTS
           
       # Step 5: Setup Bun
       - name: Install Bun

package/templates/overlay-firebase/env.fragment.example

@@ -0,0 +1,34 @@
+
+# =============================================================================
+# Firebase Configuration
+# =============================================================================
+# Get these values from your Firebase project settings
+# Run `dndev setup firebase` to auto-populate, or copy from Firebase Console
+VITE_FIREBASE_API_KEY=
+VITE_FIREBASE_PROJECT_ID=
+# Copy from Firebase Console. Framework uses APP_URL hostname in production automatically.
+VITE_FIREBASE_AUTH_DOMAIN=
+VITE_FIREBASE_STORAGE_BUCKET=
+VITE_FIREBASE_MESSAGING_SENDER_ID=
+VITE_FIREBASE_APP_ID=
+VITE_FIREBASE_MEASUREMENT_ID=
+VITE_FIREBASE_FUNCTIONS_REGION=
+
+# =============================================================================
+# Firebase Emulator (Development only)
+# =============================================================================
+# Set to true to use Firebase emulators instead of production services
+VITE_USE_FIREBASE_EMULATOR=false
+VITE_FIREBASE_EMULATOR_HOST=localhost
+VITE_FIREBASE_EMULATOR_PORT=9099
+VITE_FIREBASE_AUTH_EMULATOR_HOST=http://localhost:9099
+VITE_FIREBASE_FIRESTORE_EMULATOR_HOST=localhost:8080
+VITE_FIREBASE_FUNCTIONS_EMULATOR_PORT=5001
+
+# =============================================================================
+# Firebase App Check (Abuse Protection)
+# =============================================================================
+# reCAPTCHA v3 site key for App Check
+# VITE_RECAPTCHA_SITE_KEY=6LcXXXX...
+# Optional: Debug token for localhost testing
+# VITE_APPCHECK_DEBUG_TOKEN=XXXX-XXXX-XXXX

package/templates/overlay-firebase/env.fragment.expo.example

@@ -0,0 +1,34 @@
+
+# =============================================================================
+# Firebase Configuration
+# =============================================================================
+# Get these values from your Firebase project settings
+# Run `dndev setup firebase` to auto-populate, or copy from Firebase Console
+EXPO_PUBLIC_FIREBASE_API_KEY=
+EXPO_PUBLIC_FIREBASE_PROJECT_ID=
+# Copy from Firebase Console. Framework uses APP_URL hostname in production automatically.
+EXPO_PUBLIC_FIREBASE_AUTH_DOMAIN=
+EXPO_PUBLIC_FIREBASE_STORAGE_BUCKET=
+EXPO_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
+EXPO_PUBLIC_FIREBASE_APP_ID=
+EXPO_PUBLIC_FIREBASE_MEASUREMENT_ID=
+EXPO_PUBLIC_FIREBASE_FUNCTIONS_REGION=
+
+# =============================================================================
+# Firebase Emulator (Development only)
+# =============================================================================
+# Set to true to use Firebase emulators instead of production services
+EXPO_PUBLIC_USE_FIREBASE_EMULATOR=false
+EXPO_PUBLIC_FIREBASE_EMULATOR_HOST=localhost
+EXPO_PUBLIC_FIREBASE_EMULATOR_PORT=9099
+EXPO_PUBLIC_FIREBASE_AUTH_EMULATOR_HOST=http://localhost:9099
+EXPO_PUBLIC_FIREBASE_FIRESTORE_EMULATOR_HOST=localhost:8080
+EXPO_PUBLIC_FIREBASE_FUNCTIONS_EMULATOR_PORT=5001
+
+# =============================================================================
+# Firebase App Check (Abuse Protection)
+# =============================================================================
+# reCAPTCHA v3 site key for App Check
+# EXPO_PUBLIC_RECAPTCHA_SITE_KEY=6LcXXXX...
+# Optional: Debug token for localhost testing
+# EXPO_PUBLIC_APPCHECK_DEBUG_TOKEN=XXXX-XXXX-XXXX

package/templates/overlay-firebase/env.fragment.nextjs.example

@@ -0,0 +1,34 @@
+
+# =============================================================================
+# Firebase Configuration
+# =============================================================================
+# Get these values from your Firebase project settings
+# Run `dndev setup firebase` to auto-populate, or copy from Firebase Console
+NEXT_PUBLIC_FIREBASE_API_KEY=
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=
+# Copy from Firebase Console. Framework uses APP_URL hostname in production automatically.
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
+NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
+NEXT_PUBLIC_FIREBASE_APP_ID=
+NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID=
+NEXT_PUBLIC_FIREBASE_FUNCTIONS_REGION=
+
+# =============================================================================
+# Firebase Emulator (Development only)
+# =============================================================================
+# Set to true to use Firebase emulators instead of production services
+NEXT_PUBLIC_USE_FIREBASE_EMULATOR=false
+NEXT_PUBLIC_FIREBASE_EMULATOR_HOST=localhost
+NEXT_PUBLIC_FIREBASE_EMULATOR_PORT=9099
+NEXT_PUBLIC_FIREBASE_AUTH_EMULATOR_HOST=http://localhost:9099
+NEXT_PUBLIC_FIREBASE_FIRESTORE_EMULATOR_HOST=localhost:8080
+NEXT_PUBLIC_FIREBASE_FUNCTIONS_EMULATOR_PORT=5001
+
+# =============================================================================
+# Firebase App Check (Abuse Protection)
+# =============================================================================
+# reCAPTCHA v3 site key for App Check
+# NEXT_PUBLIC_RECAPTCHA_SITE_KEY=6LcXXXX...
+# Optional: Debug token for localhost testing
+# NEXT_PUBLIC_APPCHECK_DEBUG_TOKEN=XXXX-XXXX-XXXX

package/templates/overlay-firebase/src/config/providers.expo.ts.example

@@ -0,0 +1,49 @@
+// src/config/providers.ts — Firebase provider bootstrap (Expo)
+// Auto-generated by DoNotDev scaffolding. Edit freely.
+// Import from root layout (app/_layout.tsx): import '../src/config/providers';
+
+import { initializeApp } from 'firebase/app';
+
+import { configureProviders } from '@donotdev/core';
+import {
+  FirestoreAdapter,
+  FirebaseAuth,
+  FirebaseStorageAdapter,
+} from '@donotdev/firebase';
+import { initializeExpoAuth } from '@donotdev/expo';
+
+const apiKey = process.env.EXPO_PUBLIC_FIREBASE_API_KEY;
+const projectId = process.env.EXPO_PUBLIC_FIREBASE_PROJECT_ID;
+
+if (!apiKey || !projectId) {
+  throw new Error(
+    '[dndev] Missing Firebase env vars (EXPO_PUBLIC_FIREBASE_API_KEY, EXPO_PUBLIC_FIREBASE_PROJECT_ID). ' +
+    'Copy .env.example to .env and fill in your Firebase config.'
+  );
+}
+
+const firebaseConfig = {
+  apiKey,
+  projectId,
+  authDomain: process.env.EXPO_PUBLIC_FIREBASE_AUTH_DOMAIN,
+  storageBucket: process.env.EXPO_PUBLIC_FIREBASE_STORAGE_BUCKET,
+  messagingSenderId: process.env.EXPO_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
+  appId: process.env.EXPO_PUBLIC_FIREBASE_APP_ID,
+};
+
+initializeApp(firebaseConfig);
+// Must run before FirebaseAuth — sets up AsyncStorage persistence
+initializeExpoAuth();
+
+/**
+ * Register Firebase as the backend provider.
+ * Must run before any CRUD/auth/storage operations.
+ *
+ * Uses EXPO_PUBLIC_FIREBASE_* env vars (not VITE_*).
+ * initializeExpoAuth() sets up AsyncStorage persistence before FirebaseAuth.
+ */
+configureProviders({
+  crud: new FirestoreAdapter(),
+  auth: new FirebaseAuth(),
+  storage: new FirebaseStorageAdapter(),
+});

package/templates/overlay-firebase/src/config/providers.ts.example

@@ -0,0 +1,23 @@
+// src/config/providers.ts — Firebase provider bootstrap
+// Auto-generated by DoNotDev scaffolding. Edit freely.
+// Import from root component (App.tsx): import './config/providers';
+
+import { configureProviders } from '@donotdev/core';
+import {
+  FirestoreAdapter,
+  FirebaseAuth,
+  FirebaseStorageAdapter,
+} from '@donotdev/firebase';
+
+/**
+ * Register Firebase as the backend provider.
+ * Must run before any CRUD/auth/storage operations.
+ *
+ * Firebase SDK is auto-initialized by the framework's Vite plugin
+ * from VITE_FIREBASE_* env vars — no `initializeApp()` needed here.
+ */
+configureProviders({
+  crud: new FirestoreAdapter(),
+  auth: new FirebaseAuth(),
+  storage: new FirebaseStorageAdapter(),
+});

package/templates/overlay-supabase/env.fragment.example

@@ -0,0 +1,12 @@
+
+# =============================================================================
+# Supabase Configuration (PUBLIC — safe to commit)
+# =============================================================================
+# Get these from: https://supabase.com/dashboard > your project > Settings > API
+#   - Project URL: the https://xxx.supabase.co URL
+#   - Public key:  "Publishable key" (sb_publishable_...) or legacy "anon key" (eyJ...)
+#
+# Then run: dndev setup supabase
+# =============================================================================
+VITE_SUPABASE_URL=
+VITE_SUPABASE_PUBLIC_KEY=

package/templates/overlay-supabase/env.fragment.expo.example

@@ -0,0 +1,12 @@
+
+# =============================================================================
+# Supabase Configuration (PUBLIC — safe to commit)
+# =============================================================================
+# Get these from: https://supabase.com/dashboard > your project > Settings > API
+#   - Project URL: the https://xxx.supabase.co URL
+#   - Public key:  "Publishable key" (sb_publishable_...) or legacy "anon key" (eyJ...)
+#
+# Then run: dndev setup supabase
+# =============================================================================
+EXPO_PUBLIC_SUPABASE_URL=
+EXPO_PUBLIC_SUPABASE_PUBLIC_KEY=

package/templates/overlay-supabase/env.fragment.nextjs.example

@@ -0,0 +1,12 @@
+
+# =============================================================================
+# Supabase Configuration (PUBLIC — safe to commit)
+# =============================================================================
+# Get these from: https://supabase.com/dashboard > your project > Settings > API
+#   - Project URL: the https://xxx.supabase.co URL
+#   - Public key:  "Publishable key" (sb_publishable_...) or legacy "anon key" (eyJ...)
+#
+# Then run: dndev setup supabase
+# =============================================================================
+NEXT_PUBLIC_SUPABASE_URL=
+NEXT_PUBLIC_SUPABASE_PUBLIC_KEY=

package/templates/overlay-supabase/src/config/providers.expo.ts.example

@@ -0,0 +1,35 @@
+// src/config/providers.ts — Supabase provider bootstrap (Expo)
+// Auto-generated by DoNotDev scaffolding. Edit freely.
+// Import from root layout (app/_layout.tsx): import '../src/config/providers';
+
+import { createClient } from '@supabase/supabase-js';
+
+import { configureProviders } from '@donotdev/core';
+import {
+  SupabaseAuth,
+  SupabaseCrudAdapter,
+  SupabaseStorageAdapter,
+} from '@donotdev/supabase';
+
+const url = process.env.EXPO_PUBLIC_SUPABASE_URL;
+const publicKey = process.env.EXPO_PUBLIC_SUPABASE_PUBLIC_KEY || process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY; // New: sb_publishable_..., Legacy: anon key
+
+if (!url || !publicKey) {
+  console.warn(
+    '[dndev] Supabase not configured. Set EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_ANON_KEY in .env'
+  );
+} else {
+  const supabase = createClient(url, publicKey);
+
+  /**
+   * Register Supabase as the backend provider.
+   * Must run before any CRUD/auth/storage operations.
+   *
+   * Uses EXPO_PUBLIC_SUPABASE_* env vars (not VITE_*).
+   */
+  configureProviders({
+    crud: new SupabaseCrudAdapter(supabase),
+    auth: new SupabaseAuth(supabase),
+    storage: new SupabaseStorageAdapter(supabase),
+  });
+}

package/templates/overlay-supabase/src/config/providers.ts.example

@@ -0,0 +1,33 @@
+// src/config/providers.ts — Supabase provider bootstrap
+// Auto-generated by DoNotDev scaffolding. Edit freely.
+// Import from root component (App.tsx): import './config/providers';
+
+import { createClient } from '@supabase/supabase-js';
+
+import { configureProviders } from '@donotdev/core';
+import {
+  SupabaseAuth,
+  SupabaseCrudAdapter,
+  SupabaseStorageAdapter,
+} from '@donotdev/supabase';
+
+const url = import.meta.env.VITE_SUPABASE_URL;
+const publicKey = import.meta.env.VITE_SUPABASE_PUBLIC_KEY || import.meta.env.VITE_SUPABASE_ANON_KEY; // New: sb_publishable_..., Legacy: anon key
+
+if (!url || !publicKey) {
+  console.warn(
+    '[dndev] Supabase not configured. Set VITE_SUPABASE_URL and VITE_SUPABASE_PUBLIC_KEY (or VITE_SUPABASE_ANON_KEY) in .env'
+  );
+} else {
+  const supabase = createClient(url, publicKey);
+
+  /**
+   * Register Supabase as the backend provider.
+   * Must run before any CRUD/auth/storage operations.
+   */
+  configureProviders({
+    crud: new SupabaseCrudAdapter(supabase),
+    auth: new SupabaseAuth(supabase),
+    storage: new SupabaseStorageAdapter(supabase),
+  });
+}

package/templates/overlay-supabase/vercel.headers.example

@@ -0,0 +1,23 @@
+[
+  {
+    "source": "/(.*)",
+    "headers": [
+      {
+        "key": "Content-Security-Policy",
+        "value": "default-src 'self'; script-src 'self' https://js.stripe.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com; frame-src 'none' https://js.stripe.com https://hooks.stripe.com; object-src 'none'; base-uri 'self'; form-action 'self'"
+      },
+      {
+        "key": "X-Content-Type-Options",
+        "value": "nosniff"
+      },
+      {
+        "key": "X-Frame-Options",
+        "value": "DENY"
+      },
+      {
+        "key": "Referrer-Policy",
+        "value": "strict-origin-when-cross-origin"
+      }
+    ]
+  }
+]

package/templates/overlay-supabase/vercel.json.example

@@ -0,0 +1,22 @@
+{
+  "buildCommand": "bun run build",
+  "outputDirectory": "dist",
+  "installCommand": "bun install",
+  "rewrites": [
+    { "source": "/(.*)", "destination": "/index.html" }
+  ],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; script-src 'self' https://js.stripe.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.stripe.com; frame-src 'none' https://js.stripe.com https://hooks.stripe.com; object-src 'none'; base-uri 'self'; form-action 'self'"
+        },
+        { "key": "X-Content-Type-Options", "value": "nosniff" },
+        { "key": "X-Frame-Options", "value": "DENY" },
+        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
+      ]
+    }
+  ]
+}

package/templates/overlay-vercel/env.fragment.example

@@ -0,0 +1,34 @@
+
+# =============================================================================
+# Firebase Configuration (data layer for Vercel-hosted app)
+# =============================================================================
+# Get these values from your Firebase project settings
+# Run `dndev setup firebase` to auto-populate, or copy from Firebase Console
+VITE_FIREBASE_API_KEY=
+VITE_FIREBASE_PROJECT_ID=
+# Copy from Firebase Console. Framework uses APP_URL hostname in production automatically.
+VITE_FIREBASE_AUTH_DOMAIN=
+VITE_FIREBASE_STORAGE_BUCKET=
+VITE_FIREBASE_MESSAGING_SENDER_ID=
+VITE_FIREBASE_APP_ID=
+VITE_FIREBASE_MEASUREMENT_ID=
+VITE_FIREBASE_FUNCTIONS_REGION=
+
+# =============================================================================
+# Firebase Emulator (Development only)
+# =============================================================================
+# Set to true to use Firebase emulators instead of production services
+VITE_USE_FIREBASE_EMULATOR=false
+VITE_FIREBASE_EMULATOR_HOST=localhost
+VITE_FIREBASE_EMULATOR_PORT=9099
+VITE_FIREBASE_AUTH_EMULATOR_HOST=http://localhost:9099
+VITE_FIREBASE_FIRESTORE_EMULATOR_HOST=localhost:8080
+VITE_FIREBASE_FUNCTIONS_EMULATOR_PORT=5001
+
+# =============================================================================
+# Firebase App Check (Abuse Protection)
+# =============================================================================
+# reCAPTCHA v3 site key for App Check
+# VITE_RECAPTCHA_SITE_KEY=6LcXXXX...
+# Optional: Debug token for localhost testing
+# VITE_APPCHECK_DEBUG_TOKEN=XXXX-XXXX-XXXX

package/templates/overlay-vercel/env.fragment.nextjs.example

@@ -0,0 +1,34 @@
+
+# =============================================================================
+# Firebase Configuration (data layer for Vercel-hosted app)
+# =============================================================================
+# Get these values from your Firebase project settings
+# Run `dndev setup firebase` to auto-populate, or copy from Firebase Console
+NEXT_PUBLIC_FIREBASE_API_KEY=
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=
+# Copy from Firebase Console. Framework uses APP_URL hostname in production automatically.
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
+NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
+NEXT_PUBLIC_FIREBASE_APP_ID=
+NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID=
+NEXT_PUBLIC_FIREBASE_FUNCTIONS_REGION=
+
+# =============================================================================
+# Firebase Emulator (Development only)
+# =============================================================================
+# Set to true to use Firebase emulators instead of production services
+NEXT_PUBLIC_USE_FIREBASE_EMULATOR=false
+NEXT_PUBLIC_FIREBASE_EMULATOR_HOST=localhost
+NEXT_PUBLIC_FIREBASE_EMULATOR_PORT=9099
+NEXT_PUBLIC_FIREBASE_AUTH_EMULATOR_HOST=http://localhost:9099
+NEXT_PUBLIC_FIREBASE_FIRESTORE_EMULATOR_HOST=localhost:8080
+NEXT_PUBLIC_FIREBASE_FUNCTIONS_EMULATOR_PORT=5001
+
+# =============================================================================
+# Firebase App Check (Abuse Protection)
+# =============================================================================
+# reCAPTCHA v3 site key for App Check
+# NEXT_PUBLIC_RECAPTCHA_SITE_KEY=6LcXXXX...
+# Optional: Debug token for localhost testing
+# NEXT_PUBLIC_APPCHECK_DEBUG_TOKEN=XXXX-XXXX-XXXX

package/templates/overlay-vercel/src/config/providers.ts.example

@@ -0,0 +1,24 @@
+// src/config/providers.ts — Vercel + Firebase provider bootstrap
+// Auto-generated by DoNotDev scaffolding. Edit freely.
+// Import from root component (App.tsx): import './config/providers';
+
+import { configureProviders } from '@donotdev/core';
+import {
+  FirestoreAdapter,
+  FirebaseAuth,
+  FirebaseStorageAdapter,
+} from '@donotdev/firebase';
+
+/**
+ * Register Firebase as the data provider for a Vercel-hosted app.
+ * Vercel handles hosting + API routes; Firebase provides CRUD/auth/storage.
+ * Must run before any CRUD/auth/storage operations.
+ *
+ * Firebase SDK is auto-initialized by the framework's Vite plugin
+ * from VITE_FIREBASE_* env vars — no `initializeApp()` needed here.
+ */
+configureProviders({
+  crud: new FirestoreAdapter(),
+  auth: new FirebaseAuth(),
+  storage: new FirebaseStorageAdapter(),
+});