@nest-arch/tui 0.2.7 → 0.4.0

package/dist/templates/base/src/database/db.service.ts.hbs

@@ -1,3 +1,22 @@
+{{#if isPrisma8}}
+import { Injectable } from "@nestjs/common";
+{{#if isMonorepo}}
+import { db as prismaDb } from "../prisma/db.js";
+{{else}}
+import { db as prismaDb } from "../prisma/db.js";
+{{/if}}
+
+@Injectable()
+export class DbService {
+  get prisma() {
+    return prismaDb;
+  }
+
+  get raw() {
+    return { sql: prismaDb };
+  }
+}
+{{else}}
 import { Injectable, Inject } from '@nestjs/common';
 {{#if (or hasPostgres hasMysql hasSqlite)}}
 import type { ISqlAdapter } from './adapters/interfaces/db-adapter.interface.js';
@@ -16,7 +35,7 @@ import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import type { MySql2Database } from 'drizzle-orm/mysql2';
   {{/if}}
   {{#if hasSqlite}}
-import type { BetterSqlite3Database } from 'drizzle-orm/better-sqlite3';
+import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
   {{/if}}
 import type * as schema from './orm/drizzle/schema.js';
 {{/if}}
@@ -29,8 +48,10 @@ type SqlClient = PrismaClient;
   {{else if useTypeorm}}
 type SqlClient = DataSource;
   {{else if useDrizzle}}
-type DrizzleClient = {{#if hasPostgres}}NodePgDatabase{{/if}}{{#if hasMysql}}MySql2Database{{/if}}{{#if hasSqlite}}BetterSqlite3Database{{/if}}<typeof schema>;
+type DrizzleClient = {{#if hasPostgres}}NodePgDatabase{{/if}}{{#if hasMysql}}MySql2Database{{/if}}{{#if hasSqlite}}BetterSQLite3Database{{/if}}<typeof schema>;
 type SqlClient = DrizzleClient;
+  {{else if hasPostgres}}
+type SqlClient = import('pg').Pool;
   {{else}}
 type SqlClient = unknown;
   {{/if}}
@@ -39,18 +60,26 @@ type SqlClient = unknown;
   {{#if usePrisma}}
 type MongoClient = PrismaClient;
   {{else}}
-type MongoClient = unknown;
+type MongoClient = import('mongodb').Db;
   {{/if}}
 {{/if}}
 
+{{#if isPrisma8}}
+{{#if isMonorepo}}
+import { db as prismaDb } from '../prisma/db.js';
+{{else}}
+import { db as prismaDb } from './prisma/db.js';
+{{/if}}
+{{/if}}
+
 @Injectable()
 export class DbService {
   constructor(
     {{#if (or hasPostgres hasMysql hasSqlite)}}
-    @Inject('SQL_ADAPTER') public readonly sql: ISqlAdapter<SqlClient>{{#if hasMongodb}},{{/if}}
+    @Inject('SQL_ADAPTER') readonly sql: ISqlAdapter<SqlClient>{{#if hasMongodb}},{{/if}}
     {{/if}}
     {{#if hasMongodb}}
-    @Inject('MONGO_ADAPTER') public readonly mongo: IMongoAdapter<MongoClient>
+    @Inject('MONGO_ADAPTER') readonly mongo: IMongoAdapter<MongoClient>
     {{/if}}
   ) {}
 
@@ -64,7 +93,11 @@ export class DbService {
       {{/if}}
     };
   }
-{{#if usePrisma}}
+{{#if isPrisma8}}
+  get prisma() {
+    return prismaDb;
+  }
+{{else if usePrisma}}
   {{#if (or hasPostgres hasMysql hasSqlite)}}
   get prisma(): PrismaClient {
     return this.sql.getClient();
@@ -86,3 +119,4 @@ export class DbService {
   {{/if}}
 {{/if}}
 }
+{{/if}}

package/dist/templates/base/src/database/entities/todo.entity.ts.hbs

@@ -15,18 +15,23 @@ export class Todo {
   @PrimaryGeneratedColumn("uuid")
   id: string;
 
-  @Column({ length: 255 })
-  description: string;
+  @Column({ type: "varchar", length: 255, nullable: true })
+  description?: string;
 
-  @Column({ length: 100, nullable: true })
-  name: string;
+  @Column({ type: "varchar", length: 255 })
+  title: string;
 
   @Column({ default: false, name: "is_completed", type: "boolean" })
-  isCompleted: boolean;
+  completed: boolean;
 
-  @CreateDateColumn({ name: "created_at", type: "timestamptz" })
+{{#if hasAuth}}
+  @Column({ type: "varchar", nullable: true })
+  authorId?: string;
+{{/if}}
+
+  @CreateDateColumn({ name: "created_at" })
   createdAt: Date;
 
-  @UpdateDateColumn({ name: "updated_at", type: "timestamptz" })
+  @UpdateDateColumn({ name: "updated_at" })
   updatedAt: Date;
 }

package/dist/templates/base/src/database/index.ts.hbs

@@ -1,4 +1,5 @@
 // oxlint-disable oxc/no-barrel-file
+// biome-ignore-all lint/performance/noBarrelFile: Public entry point shared with the monorepo database package.
 export * from './db.module.js';
 export * from './db.service.js';
 export * from './adapters/interfaces/db-adapter.interface.js';

package/dist/templates/base/src/database/orm/drizzle/schema.ts.hbs

@@ -1,30 +1,72 @@
+{{#if isBetterAuth}}
+export * from "./auth-schema.js";
+{{/if}}
 // oxlint-disable typescript/no-explicit-any
 {{#if hasPostgres}}
-import { pgTable, serial, text, timestamp } from 'drizzle-orm/pg-core';
+import { boolean, pgTable, serial, text, timestamp } from 'drizzle-orm/pg-core';
 
+{{#unless isBetterAuth}}
 export const users = pgTable('users', {
+  email: text('email').unique(),
   id: serial('id').primaryKey(),
   name: text('name'),
-  email: text('email').unique(),
   createdAt: timestamp('created_at').defaultNow(),
 });
+{{/unless}}
+{{#if hasTodoExample}}
+export const todos = pgTable('todos', {
+  {{#if hasAuth}}
+  authorId: text('author_id'),
+  {{/if}}
+  completed: boolean('completed').notNull().default(false),
+  description: text('description'),
+  id: serial('id').primaryKey(),
+  title: text('title').notNull(),
+});
+{{/if}}
 {{/if}}
 {{#if hasMysql}}
-import { mysqlTable, serial, text, timestamp } from 'drizzle-orm/mysql-core';
+import { boolean, mysqlTable, serial, text, timestamp } from 'drizzle-orm/mysql-core';
 
+{{#unless isBetterAuth}}
 export const users = mysqlTable('users', {
+  email: text('email').unique(),
   id: serial('id').primaryKey(),
   name: text('name'),
-  email: text('email').unique(),
   createdAt: timestamp('created_at').defaultNow(),
 });
+{{/unless}}
+{{#if hasTodoExample}}
+export const todos = mysqlTable('todos', {
+  {{#if hasAuth}}
+  authorId: text('author_id'),
+  {{/if}}
+  completed: boolean('completed').notNull().default(false),
+  description: text('description'),
+  id: serial('id').primaryKey(),
+  title: text('title').notNull(),
+});
+{{/if}}
 {{/if}}
 {{#if hasSqlite}}
 import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
 
+{{#unless isBetterAuth}}
 export const users = sqliteTable('users', {
+  email: text('email').unique(),
   id: integer('id').primaryKey({ autoIncrement: true }),
   name: text('name'),
-  email: text('email').unique(),
 });
+{{/unless}}
+{{#if hasTodoExample}}
+export const todos = sqliteTable('todos', {
+  {{#if hasAuth}}
+  authorId: text('author_id'),
+  {{/if}}
+  completed: integer('completed', { mode: 'boolean' }).notNull().default(false),
+  description: text('description'),
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  title: text('title').notNull(),
+});
+{{/if}}
 {{/if}}

package/dist/templates/base/src/database/orm/typeorm/data-source.ts.hbs

@@ -1,10 +1,17 @@
 // oxlint-disable typescript/no-non-null-assertion
-import { join } from "node:path";
 import "reflect-metadata";
+{{#if isMonorepo}}
+import { env } from "@repo/env/api-gateway";
+{{else}}
+import { env } from "../../../config/env.js";
+{{/if}}
 import { DataSource } from "typeorm";
+{{#if hasTodoExample}}
+import { Todo } from "../../entities/todo.entity.js";
+{{/if}}
 
 const databaseUrl =
-  process.env.{{#if hasPostgres}}POSTGRES_URL{{/if}}{{#if hasMysql}}MYSQL_URL{{/if}}{{#if hasSqlite}}SQLITE_PATH{{/if}}!;
+  env.{{#if hasPostgres}}POSTGRES_URL{{/if}}{{#if hasMysql}}MYSQL_URL{{/if}}{{#if hasSqlite}}SQLITE_PATH{{/if}};
 
 {{#unless hasSqlite}}
 const parsedUrl = new URL(databaseUrl);
@@ -12,9 +19,10 @@ const parsedUrl = new URL(databaseUrl);
 
 
 export const AppDataSource = new DataSource({
-  entities: [join(import.meta.dirname, "..", "..", "entities", "*.entity.js")],
+  // Register entities explicitly for consistent metadata in Node and test runners.
+  entities: [{{#if hasTodoExample}}Todo{{/if}}],
   migrations: [{{#if isMonorepo}}"migrations/*.{ts,js}"{{else}}"migrations/*.{ts,js}"{{/if}}],
-  synchronize: true,
+  synchronize: env.NODE_ENV === "development",
   type: "{{#if hasPostgres}}postgres{{/if}}{{#if hasMysql}}mysql{{/if}}{{#if hasSqlite}}better-sqlite3{{/if}}",
   url: databaseUrl,
   {{#unless hasSqlite}}

package/dist/templates/base/src/libs/trpc/error.handler.ts.hbs

@@ -3,7 +3,7 @@ import { OnErrorOptions, TRPCErrorHandler } from "nestjs-trpc";
 
 @Injectable()
 export class AppErrorHandler implements TRPCErrorHandler {
-  private logger = new Logger("TRPC Router");
+  private readonly logger = new Logger("TRPC Router");
   onError(opts: OnErrorOptions): void {
     this.logger.error(`[${opts.type}] ${opts.path}: ${opts.error.message}`);
   }

package/dist/templates/base/src/main.ts.hbs

@@ -2,10 +2,18 @@ import { NestFactory } from "@nestjs/core";
 {{#if (eq httpProvider "fastify")}}
 import { FastifyAdapter, NestFastifyApplication } from "@nestjs/platform-fastify";
 {{/if}}
+{{#if (includes addons "nestjs-zod")}}
+import { Logger } from "@nestjs/common";
+import { ZodValidationPipe } from "nestjs-zod";
+{{else}}
 import { Logger, StandardSchemaValidationPipe } from "@nestjs/common";
+{{/if}}
 
 import { AppModule } from "./app.module.js";
 import { env } from "./config/env.js";
+{{#if isPrisma8}}
+import { connectDatabase } from "./prisma/db.js";
+{{/if}}
 {{#if swagger}}
 import { createDocs } from "./docs/create-docs.js";
 {{/if}}
@@ -20,6 +28,9 @@ import { auth } from "./auth/auth.js";
 {{/if}}
 
 async function bootstrap() {
+  {{#if isPrisma8}}
+  await connectDatabase();
+  {{/if}}
   const app = await NestFactory.create{{#if (eq httpProvider "fastify")}}<NestFastifyApplication>(AppModule, new FastifyAdapter(){{else}}(AppModule{{/if}}{{#if (or (eq auth "better-auth") (eq auth "better-auth:stateless") hasBetterAuthWithoutRest)}}, { bodyParser: false }{{/if}});
   app.enableCors({
     origin: env.CORS_ORIGIN,
@@ -27,7 +38,11 @@ async function bootstrap() {
   {{#if hasRest}}
   app.setGlobalPrefix("api");
   {{/if}}
+{{#if (includes addons "nestjs-zod")}}
+  app.useGlobalPipes(new ZodValidationPipe());
+{{else}}
   app.useGlobalPipes(new StandardSchemaValidationPipe());
+{{/if}}
   app.enableShutdownHooks();
   {{#if swagger}}
   const docsPath = "/docs";
@@ -86,15 +101,15 @@ async function bootstrap() {
   });
   SwaggerModule.setup(docsPath, app, document);
   {{/if}}
-  Logger.log(`Swagger documentation available at http://localhost:${env.PORT ?? 3000}${docsPath}`, "SwaggerDocs");
+  Logger.log(`Swagger documentation available at http://localhost:${env.PORT}${docsPath}`, "SwaggerDocs");
   {{/if}}
-  await app.listen(env.PORT ?? 3000);
+  await app.listen(env.PORT);
   {{#if hasRest}}
-  Logger.log(`Started backend server on http://localhost:${env.PORT ?? 3000}/api`, "Main");
+  Logger.log(`Started backend server on http://localhost:${env.PORT}/api`, "Main");
   {{else if hasTrpc}}
-  Logger.log(`Started trpc server on http://localhost:${env.PORT ?? 3000}/trpc`, "Main");
+  Logger.log(`Started trpc server on http://localhost:${env.PORT}/trpc`, "Main");
   {{else}}
-  Logger.log(`Started server on http://localhost:${env.PORT ?? 3000}`, "Main");
+  Logger.log(`Started server on http://localhost:${env.PORT}`, "Main");
   {{/if}}
 }
-await bootstrap();
+await bootstrap();

package/dist/templates/base/test/app.e2e-spec.ts.hbs

@@ -1,27 +1,229 @@
-import { INestApplication } from "@nestjs/common";
+import { INestApplication{{#unless (includes addons "nestjs-zod")}}, StandardSchemaValidationPipe{{/unless}} } from "@nestjs/common";
+{{#if (includes addons "nestjs-zod")}}
+import { ZodValidationPipe } from "nestjs-zod";
+{{/if}}
 import { Test, TestingModule } from "@nestjs/testing";
+{{#if (eq httpProvider "fastify")}}
+import { FastifyAdapter } from "@nestjs/platform-fastify";
+{{/if}}
 import request from "supertest";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import type { App } from "supertest/types";
 
+{{#if isPassportAuth}}
+import { JwtService } from "@nestjs/jwt";
+import { DbService } from "../src/database/db.service.js";
+import { env } from "../src/config/env.js";
+{{/if}}
 import { AppModule } from "./../src/app.module.js";
+{{#if (and useDrizzle (eq auth "none"))}}
+import { DbService } from "../src/database/db.service.js";
+import { users } from "../src/database/orm/drizzle/schema.js";
+import { eq } from "drizzle-orm";
+{{/if}}
 
 describe("AppController (e2e)", () => {
   let app: INestApplication<App>;
 
-  beforeEach(async () => {
+  async function startApplication() {
     const moduleFixture: TestingModule = await Test.createTestingModule({
       imports: [AppModule],
     }).compile();
 
-    app = moduleFixture.createNestApplication();
+{{#if (eq httpProvider "fastify")}}
+    app = moduleFixture.createNestApplication(new FastifyAdapter(){{#if isBetterAuth}}, { bodyParser: false }{{/if}});
+{{else}}
+    app = moduleFixture.createNestApplication({{#if isBetterAuth}}{ bodyParser: false }{{/if}});
+{{/if}}
+{{#if (includes addons "nestjs-zod")}}
+    app.useGlobalPipes(new ZodValidationPipe());
+{{else}}
+    app.useGlobalPipes(new StandardSchemaValidationPipe());
+{{/if}}
     await app.init();
+{{#if (eq httpProvider "fastify")}}
+    await app.getHttpAdapter().getInstance().ready();
+{{/if}}
+  }
+  beforeAll(startApplication);
+
+{{#if hasRest}}
+  it("/ (GET)", async () => {
+    const response = await request(app.getHttpServer()).get("/").expect(200);
+    expect(response.text).toBe("Hello World!");
   });
+{{/if}}
 
-  it("/ (GET)", () => {
-    return request(app.getHttpServer()).get("/").expect(200).expect("Hello World!");
+{{#if hasTrpc}}
+  it("executes a tRPC query through HTTP", async () => {
+    const response = await request(app.getHttpServer())
+      .get("/trpc/appRouter.getHello").expect(200);
+    expect(response.body.result.data).toBe("Hello World!");
   });
+{{/if}}
 
-  afterEach(async () => {
+{{#if (eq auth "better-auth")}}
+  it("registers, authenticates and revokes a persisted session", async () => {
+    const email = `scenario-${Date.now()}@example.com`;
+    const password = "Scenario-password-123!";
+    const origin = "http://localhost:3000";
+    let server = app.getHttpServer();
+    const signedUp = await request(server).post("/api/auth/sign-up/email")
+      .set("Origin", origin).send({ email, password, name: "Scenario" }).expect(200);
+    expect(signedUp.body.user.email).toBe(email);
+    expect(signedUp.body.user.password).toBeUndefined();
+    await request(server).post("/api/auth/sign-up/email")
+      .set("Origin", origin).send({ email, password, name: "Duplicate" }).expect(422);
+    await request(server).post("/api/auth/sign-in/email")
+      .set("Origin", origin).send({ email, password: "wrong-password" }).expect(401);
+    const signedIn = await request(server).post("/api/auth/sign-in/email")
+      .set("Origin", origin).send({ email, password }).expect(200);
+    const cookies = signedIn.headers["set-cookie"];
+    expect(cookies).toBeTruthy();
+    const session = await request(server).get("/api/auth/get-session")
+      .set("Cookie", cookies).expect(200);
+    expect(session.body.user.email).toBe(email);
+{{#if (or usePrisma useDrizzle)}}
+    await request(server).get("/auth-profile").expect(401);
+    const protectedProfile = await request(server).get("/auth-profile").set("Cookie", cookies).expect(200);
+    expect(protectedProfile.body.email).toBe(email);
     await app.close();
+    await startApplication();
+    server = app.getHttpServer();
+    const persisted = await request(app.getHttpServer()).get("/api/auth/get-session").set("Cookie", cookies).expect(200);
+    expect(persisted.body.user.email).toBe(email);
+{{/if}}
+{{#if hasTrpc}}
+    await request(server).get("/trpc/appRouter.testAuth").expect(401);
+    const authenticated = await request(server).get("/trpc/appRouter.testAuth")
+      .set("Cookie", cookies).expect(200);
+    expect(authenticated.body.result.data.user.email).toBe(email);
+{{/if}}
+    await request(server).post("/api/auth/sign-out").set("Origin", origin)
+      .set("Cookie", cookies).send({}).expect(200);
+    const revoked = await request(server).get("/api/auth/get-session")
+      .set("Cookie", cookies).expect(200);
+    expect(revoked.body).toBeNull();
+  });
+{{/if}}
+
+{{#if hasGraphql}}
+  it("queries and mutates persisted GraphQL todos with input validation", async () => {
+    const server = app.getHttpServer();
+    const execute = (query: string, variables: Record<string, unknown> = {}) => request(server).post("/graphql").send({ query, variables });
+    const hello = await execute("{ hello }");
+    expect(hello.body.data.hello).toBe("Hello GraphQL!");
+{{#if hasTodoExample}}
+    const created = await execute('mutation($input: CreateTodoInput!) { createTodo(input: $input) { id title completed } }', { input: { title: "GraphQL integration" } });
+    expect(created.body.errors).toBeUndefined();
+    const { id } = created.body.data.createTodo;
+    const listed = await execute("{ todos { id title } }");
+    expect(listed.body.data.todos).toContainEqual({ id, title: "GraphQL integration" });
+    const updated = await execute('mutation($input: UpdateTodoInput!) { updateTodo(input: $input) { completed } }', { input: { id, completed: true } });
+    expect(updated.body.data.updateTodo.completed).toBe(true);
+    const invalid = await execute('mutation { createTodo(input: { title: " " }) { id } }');
+    expect(invalid.body.errors).toBeTruthy();
+    const deleted = await execute('mutation($id: String!) { deleteTodo(id: $id) }', { id });
+    expect(deleted.body.data.deleteTodo).toBe(true);
+    const missing = await execute('mutation($id: String!) { deleteTodo(id: $id) }', { id });
+    expect(missing.body.errors).toBeTruthy();
+{{/if}}
+  });
+{{/if}}
+
+{{#if isPassportAuth}}
+  it("verifies credentials, rotates refresh tokens, detects replay and revokes access", async () => {
+    const server = app.getHttpServer();
+    const email = `passport-${Date.now()}@example.com`;
+    const password = "Scenario-password-123!";
+    const registered = await request(server).post("/auth/register").send({ email, password }).expect(201);
+    expect(registered.body.password).toBeUndefined();
+    expect(registered.body.role).toBe("USER");
+    await request(server).post("/auth/register").send({ email, password }).expect(409);
+    await request(server).post("/auth/login").send({ email, password, role: "ADMIN" }).expect(400);
+    await request(server).post("/auth/login").send({ email, password: "wrong-password-123" }).expect(401);
+    const login = await request(server).post("/auth/login").send({ email, password }).expect(200);
+    const { accessToken, refreshToken } = login.body;
+    await request(server).get("/auth/profile").expect(401);
+    const profile = await request(server).get("/auth/profile").auth(accessToken, { type: "bearer" }).expect(200);
+    expect(profile.body.email).toBe(email);
+    const jwt = new JwtService();
+    const decoded = jwt.decode(accessToken);
+    for (const overrides of [{ iss: "wrong" }, { aud: "wrong" }, { exp: 1 }, { sub: undefined }, { sid: "wrong" }]) {
+      const token = jwt.sign({ ...decoded, ...overrides }, { secret: env.JWT_ACCESS_SECRET, algorithm: "HS256" });
+      await request(server).get("/auth/profile").auth(token, { type: "bearer" }).expect(401);
+    }
+    const wrongSignature = jwt.sign(decoded, { secret: "another-secret-that-is-at-least-32-characters" });
+    await request(server).get("/auth/profile").auth(wrongSignature, { type: "bearer" }).expect(401);
+    const rotated = await request(server).post("/auth/refresh").send({ refreshToken }).expect(200);
+    expect(rotated.body.refreshToken).not.toBe(refreshToken);
+    await request(server).post("/auth/refresh").send({ refreshToken }).expect(401);
+    await request(server).post("/auth/refresh").send({ refreshToken: rotated.body.refreshToken }).expect(401);
+    await request(server).get("/auth/profile").auth(rotated.body.accessToken, { type: "bearer" }).expect(401);
+    const fresh = await request(server).post("/auth/login").send({ email, password }).expect(200);
+    await request(server).post("/auth/logout").send({ refreshToken: fresh.body.refreshToken }).expect(200);
+    await request(server).get("/auth/profile").auth(fresh.body.accessToken, { type: "bearer" }).expect(401);
+    const user = await app.get(DbService).prisma.user.findUniqueOrThrow({ where: { email }, include: { refreshTokens: true } });
+    expect(user.password).not.toBe(password);
+    expect(user.refreshTokens.every((token) => token.tokenHash !== refreshToken)).toBe(true);
+    const concurrentLogin = await request(server).post("/auth/login").send({ email, password }).expect(200);
+    const results = await Promise.all([1, 2].map(() => request(server).post("/auth/refresh").send({ refreshToken: concurrentLogin.body.refreshToken })));
+    expect(results.map(({ status }) => status).sort()).toEqual([200, 401]);
+  });
+{{/if}}
+{{#if hasMongodb}}
+  it("rejects malformed and missing MongoDB identifiers", async () => {
+    await request(app.getHttpServer()).delete("/todos/invalid").expect(400);
+    await request(app.getHttpServer()).delete("/todos/000000000000000000000000").expect(404);
+    await request(app.getHttpServer()).post("/todos").send({ title: "" }).expect(400);
+  });
+{{/if}}
+
+  it("returns 404 for an unknown route", async () => {
+    await request(app.getHttpServer()).get("/__missing_route__").expect(404);
+  });
+
+{{#if (and useDrizzle (eq auth "none"))}}
+  it("writes and reads the migrated Drizzle schema", async () => {
+    const db = app.get(DbService).drizzle;
+    const email = `drizzle-${Date.now()}@example.com`;
+    try {
+      await db.insert(users).values({ email, name: "Database integration" });
+      const rows = await db.select().from(users).where(eq(users.email, email));
+      expect(rows).toHaveLength(1);
+      expect(rows[0].name).toBe("Database integration");
+    } finally {
+      await db.delete(users).where(eq(users.email, email));
+    }
+  });
+{{/if}}
+
+{{#if (and hasTodoExample hasRest (eq auth "none"))}}
+  it("persists, updates and deletes a todo through HTTP", async () => {
+    const created = await request(app.getHttpServer()).post("/todos")
+      .send({ title: "Database integration", completed: false }).expect(201);
+    const { id } = created.body;
+    expect(id).toBeTruthy();
+{{#if hasMongodb}}
+    await app.close();
+    await startApplication();
+{{/if}}
+    const listed = await request(app.getHttpServer()).get("/todos").expect(200);
+    expect(listed.body).toEqual(expect.arrayContaining([expect.objectContaining({ id, title: "Database integration" })]));
+    await request(app.getHttpServer()).put(`/todos/${id}`).send({ completed: true }).expect(200);
+    const updated = await request(app.getHttpServer()).get("/todos").expect(200);
+    expect(updated.body).toEqual(expect.arrayContaining([expect.objectContaining({ id, completed: true })]));
+    await request(app.getHttpServer()).delete(`/todos/${id}`).expect(200);
+    const deleted = await request(app.getHttpServer()).get("/todos").expect(200);
+    expect(deleted.body).not.toEqual(expect.arrayContaining([expect.objectContaining({ id })]));
+  });
+{{/if}}
+
+  it("rejects unsupported methods", async () => {
+    await request(app.getHttpServer()).post("/").send({ unexpected: true }).expect(404);
+  });
+
+  afterAll(async () => {
+    await app?.close();
   });
 });

package/dist/templates/base/test/bootstrap.e2e-spec.ts.hbs

@@ -0,0 +1,74 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { once } from "node:events";
+import { createServer } from "node:net";
+import { spawn, type ChildProcess } from "node:child_process";
+
+import { afterEach, expect, it } from "vitest";
+
+const startedProcesses: ChildProcess[] = [];
+
+async function getFreePort(): Promise<number> {
+  const server = createServer();
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const address = server.address();
+  server.close();
+  if (!address || typeof address === "string") {
+    throw new Error("Could not allocate a loopback port for the bootstrap test.");
+  }
+  return address.port;
+}
+
+async function waitForServer(url: string, application: ChildProcess, deadline = Date.now() + 15000): Promise<Response> {
+  if (application.exitCode !== null) throw new Error(`Generated application exited during startup with code ${application.exitCode}.`);
+  try {
+    return await fetch(url, { signal: AbortSignal.timeout(500) });
+  } catch (error) {
+    if (Date.now() >= deadline) throw new Error("Generated application did not become ready", { cause: error });
+    await delay(100);
+    return waitForServer(url, application, deadline);
+  }
+}
+
+async function stopApplication(application: ChildProcess): Promise<void> {
+  if (application.exitCode !== null) return;
+  const exited = once(application, "exit");
+  application.kill();
+  const timeout = setTimeout(() => { application.kill("SIGKILL"); }, 5000);
+  try { await exited; } finally { clearTimeout(timeout); }
+}
+
+afterEach(async () => {
+  await Promise.all(startedProcesses.splice(0).map(stopApplication));
+});
+
+it("boots the compiled application through main.ts", async () => {
+  const port = await getFreePort();
+  const origin = "https://allowed.example";
+  const application = spawn(process.execPath, ["dist/main.js"], {
+    env: { ...process.env, CORS_ORIGIN: origin, NODE_ENV: "test", PORT: String(port) },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  startedProcesses.push(application);
+  let output = "";
+  application.stdout?.on("data", (chunk) => { output += chunk.toString(); });
+  application.stderr?.on("data", (chunk) => { output += chunk.toString(); });
+
+{{#if hasRest}}
+  const response = await waitForServer(`http://127.0.0.1:${port}/api`, application).catch((error) => { throw new Error(`${error}\n${output}`); });
+  expect(response.status).toBe(200);
+  expect(await response.text()).toBe("Hello World!");
+
+  const corsResponse = await fetch(`http://127.0.0.1:${port}/api`, {
+    headers: { Origin: origin },
+  });
+  expect(corsResponse.headers.get("access-control-allow-origin")).toBe(origin);
+  const rootResponse = await fetch(`http://127.0.0.1:${port}/`, { redirect: "manual" });
+  expect(rootResponse.status).toBe(404);
+{{else}}
+  await waitForServer(`http://127.0.0.1:${port}/graphql?query=%7Bhello%7D`, application).catch((error) => { throw new Error(`${error}\n${output}`); });
+  const response = await fetch(`http://127.0.0.1:${port}/graphql`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ query: "{ hello }" }) });
+  const body = await response.json();
+  expect(body.data.hello).toBe("Hello GraphQL!");
+{{/if}}
+}, 20_000);

package/dist/templates/base/tsconfig.build.json.hbs

@@ -1,5 +1,6 @@
 {
   "extends": "./tsconfig.json",
+  "include": ["src/**/*.ts"],
   "exclude": [
     "node_modules",
     "test",
@@ -7,6 +8,7 @@
     "**/*spec.ts"
   ],
   "compilerOptions": {
+    "rootDir": "./src",
     "strictNullChecks": true
   }
 }

package/dist/templates/base/tsconfig.json.hbs

@@ -24,4 +24,4 @@
     ],
     "strictNullChecks": true
   }
-}
+}

package/dist/templates/base/vitest.config.e2e.ts.hbs

@@ -1,11 +1,12 @@
 import { defineConfig } from "vitest/config";
-import tsconfigPaths from "vite-tsconfig-paths";
 
 export default defineConfig({
-  plugins: [tsconfigPaths()],
+  resolve: {
+    tsconfigPaths: true,
+  },
   test: {
+    include: ["**/*.e2e-spec.ts"],
     globals: true,
     root: "./",
-    include: ["**/*.e2e-spec.ts"],
   },
 });