@raiyyan/brisk 0.0.0-stage → 0.1.0

package/dist/src/cli/system.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+/** An error the CLI reports as a message and exit code 1, without a stack trace. */
+export declare class CliError extends Error {
+}
+/** Where the CLI prints, and how it asks; tests pass their own. */
+export interface CliIo {
+    log(message: string): void;
+    error(message: string): void;
+    /** Asks a question and resolves with the answer; absent when the CLI must not prompt. */
+    ask?: (question: string) => Promise<string>;
+}
+export type PackageManager = "pnpm" | "npm" | "yarn";
+/** The package manager that ran the CLI, else the one whose lockfile is present, else npm. */
+export declare function detectPackageManager(root: string): PackageManager;
+/** The command that adds packages, such as `pnpm add -D vitest`. */
+export declare function addCommand(pm: PackageManager, packages: readonly string[], dev: boolean): string[];
+/** Runs a command in `root` with its output shown, as a person would type it. */
+export declare function run(command: readonly string[], root: string): void;
+/** Writes a file, creating its folder. */
+export declare function write(path: string, content: string): string;
+/**
+ * Runs the project's own formatter on the written files, so generated code matches the codebase, and returns
+ * the line to print. A failing formatter is reported, never fatal: the files are already written and valid.
+ */
+export declare function format(root: string, files: readonly string[]): string | undefined;
+export declare const PackageJson: z.ZodObject<{
+    type: z.ZodOptional<z.ZodString>;
+    scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    devDependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$loose>;
+export type PackageJson = z.infer<typeof PackageJson>;
+/** Reads `package.json`, or an empty one when it does not exist. */
+export declare function readPackageJson(root: string): PackageJson;
+//# sourceMappingURL=system.d.ts.map

package/dist/src/cli/system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../src/cli/system.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,qBAAa,QAAS,SAAQ,KAAK;CAAG;AAEtC,mEAAmE;AACnE,MAAM,WAAW,KAAK;IACpB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,yFAAyF;IACzF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAErD,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAOjE;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAGlG;AAED,iFAAiF;AACjF,wBAAgB,GAAG,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAIlE;AAED,0CAA0C;AAC1C,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAI3D;AAOD;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAejF;AAED,eAAO,MAAM,WAAW;;;;;iBAKtB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAQzD"}

package/dist/src/cli/system.js

@@ -0,0 +1,83 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+/** An error the CLI reports as a message and exit code 1, without a stack trace. */
+export class CliError extends Error {
+}
+/** The package manager that ran the CLI, else the one whose lockfile is present, else npm. */
+export function detectPackageManager(root) {
+    const agent = process.env["npm_config_user_agent"] ?? "";
+    if (agent.startsWith("pnpm"))
+        return "pnpm";
+    if (agent.startsWith("yarn"))
+        return "yarn";
+    if (existsSync(join(root, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(root, "yarn.lock")))
+        return "yarn";
+    return "npm";
+}
+/** The command that adds packages, such as `pnpm add -D vitest`. */
+export function addCommand(pm, packages, dev) {
+    const verb = pm === "npm" ? "install" : "add";
+    return [pm, verb, ...(dev ? ["-D"] : []), ...packages];
+}
+/** Runs a command in `root` with its output shown, as a person would type it. */
+export function run(command, root) {
+    const [bin, ...args] = command;
+    if (!bin)
+        return;
+    execFileSync(bin, args, { cwd: root, stdio: "inherit" });
+}
+/** Writes a file, creating its folder. */
+export function write(path, content) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content);
+    return path;
+}
+const FORMATTERS = [
+    { bin: "oxfmt", args: [] },
+    { bin: "prettier", args: ["--write", "--log-level", "silent"] },
+];
+/**
+ * Runs the project's own formatter on the written files, so generated code matches the codebase, and returns
+ * the line to print. A failing formatter is reported, never fatal: the files are already written and valid.
+ */
+export function format(root, files) {
+    for (let dir = root;; dir = dirname(dir)) {
+        for (const { bin, args } of FORMATTERS) {
+            const path = join(dir, "node_modules/.bin", bin);
+            if (existsSync(path)) {
+                try {
+                    execFileSync(path, [...args, ...files], { cwd: root, stdio: "ignore" });
+                    return `formatted with ${bin}`;
+                }
+                catch {
+                    return `${bin} failed on the generated files; run it yourself`;
+                }
+            }
+        }
+        if (dirname(dir) === dir)
+            return undefined;
+    }
+}
+export const PackageJson = z.looseObject({
+    type: z.string().optional(),
+    scripts: z.record(z.string(), z.string()).optional(),
+    dependencies: z.record(z.string(), z.string()).optional(),
+    devDependencies: z.record(z.string(), z.string()).optional(),
+});
+/** Reads `package.json`, or an empty one when it does not exist. */
+export function readPackageJson(root) {
+    const path = join(root, "package.json");
+    if (!existsSync(path))
+        return {};
+    try {
+        return PackageJson.parse(JSON.parse(readFileSync(path, "utf8")));
+    }
+    catch {
+        throw new CliError("package.json is not valid JSON; fix it and run the command again.");
+    }
+}
+//# sourceMappingURL=system.js.map

package/dist/src/cli/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/cli/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oFAAoF;AACpF,MAAM,OAAO,QAAS,SAAQ,KAAK;CAAG;AAYtC,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,EAAkB,EAAE,QAA2B,EAAE,GAAY;IACtF,MAAM,IAAI,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,IAAY;IAC1D,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,OAAe;IACjD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAwD;IACtE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC1B,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;CAChE,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,KAAK,IAAI,GAAG,GAAG,IAAI,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACxE,OAAO,kBAAkB,GAAG,EAAE,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,GAAG,iDAAiD,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAIH,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/src/cli/templates/auth.d.ts

@@ -0,0 +1,4 @@
+import type { Plan } from "./project.ts";
+/** Bearer-token auth with HS256 tokens from `node:crypto`: no dependency, constant-time checks, expiry. */
+export declare function authFiles(): Partial<Plan>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/cli/templates/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/cli/templates/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,2GAA2G;AAC3G,wBAAgB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAuFzC"}

package/dist/src/cli/templates/auth.js

@@ -0,0 +1,90 @@
+/** Bearer-token auth with HS256 tokens from `node:crypto`: no dependency, constant-time checks, expiry. */
+export function authFiles() {
+    return {
+        files: {
+            "src/auth/tokens.ts": `import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "@raiyyan/brisk";
+import { env } from "../env.ts";
+
+export const Role = z.enum(["user", "admin"]);
+export type Role = z.infer<typeof Role>;
+
+const Claims = z.object({ sub: z.string(), role: Role, exp: z.number() });
+export type Claims = z.infer<typeof Claims>;
+
+const HEADER = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+
+/** Signs and verifies HS256 JSON Web Tokens with \`AUTH_SECRET\`. */
+export class Tokens {
+  readonly #key = Buffer.from(env.AUTH_SECRET);
+
+  sign(subject: string, role: Role, ttlSeconds = env.AUTH_TOKEN_TTL_SECONDS): string {
+    const claims: Claims = { sub: subject, role, exp: Math.floor(Date.now() / 1000) + ttlSeconds };
+    const body = \`\${HEADER}.\${Buffer.from(JSON.stringify(claims)).toString("base64url")}\`;
+    return \`\${body}.\${this.#signature(body)}\`;
+  }
+
+  /** The token's claims, or \`undefined\` when it is malformed, forged or expired. */
+  verify(token: string): Claims | undefined {
+    const [header, payload, signature, ...rest] = token.split(".");
+    if (!header || !payload || !signature || rest.length > 0 || header !== HEADER) return undefined;
+    const expected = Buffer.from(this.#signature(\`\${header}.\${payload}\`));
+    const actual = Buffer.from(signature);
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return undefined;
+    try {
+      const claims = Claims.parse(JSON.parse(Buffer.from(payload, "base64url").toString("utf8")));
+      return claims.exp > Date.now() / 1000 ? claims : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
+  #signature(body: string): string {
+    return createHmac("sha256", this.#key).update(body).digest("base64url");
+  }
+}
+`,
+            "src/middlewares/authenticate.ts": `import { defineMiddleware, ForbiddenError, inject, UnauthorizedError } from "@raiyyan/brisk";
+import { Tokens, type Role } from "../auth/tokens.ts";
+
+/** Requires \`Authorization: Bearer <token>\` and adds \`user\` to ctx; request logs gain the user id. */
+export const authenticate = defineMiddleware(({ req, log }) => {
+  const header = req.get("authorization");
+  const token = header?.startsWith("Bearer ") ? header.slice(7) : undefined;
+  const claims = token ? inject(Tokens).verify(token) : undefined;
+  if (!claims) throw new UnauthorizedError("Valid bearer token required", { challenge: "Bearer" });
+  const user = { id: claims.sub, role: claims.role };
+  return { user, log: log.child({ userId: user.id }) };
+}, "authenticate");
+
+/** Requires an authenticated user with \`role\`; use it after or instead of \`authenticate\`. */
+export const requireRole = (role: Role) =>
+  defineMiddleware(async (ctx) => {
+    const { user } = await authenticate.run(ctx);
+    if (user.role !== role) throw new ForbiddenError(\`Requires the \${role} role\`);
+    return { user };
+  }, \`requireRole(\${role})\`);
+`,
+            "test/auth.test.ts": `import { describe, expect, it } from "vitest";
+import { Container } from "@raiyyan/brisk";
+import { Tokens } from "../src/auth/tokens.ts";
+
+const tokens = new Container().get(Tokens);
+
+describe("tokens", () => {
+  it("round-trips claims", () => {
+    expect(tokens.verify(tokens.sign("u1", "admin"))).toMatchObject({ sub: "u1", role: "admin" });
+  });
+
+  it("rejects forged, malformed and expired tokens", () => {
+    const [header, payload] = tokens.sign("u1", "user").split(".");
+    expect(tokens.verify(\`\${header}.\${payload}.forged\`)).toBeUndefined();
+    expect(tokens.verify("not-a-token")).toBeUndefined();
+    expect(tokens.verify(tokens.sign("u1", "user", -1))).toBeUndefined();
+  });
+});
+`,
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/cli/templates/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/cli/templates/auth.ts"],"names":[],"mappings":"AAEA,2GAA2G;AAC3G,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,KAAK,EAAE;YACL,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC3B;YACK,iCAAiC,EAAE;;;;;;;;;;;;;;;;;;;;CAoBxC;YACK,mBAAmB,EAAE;;;;;;;;;;;;;;;;;;CAkB1B;SACI;KACF,CAAC;AACJ,CAAC"}

package/dist/src/cli/templates/database.d.ts

@@ -0,0 +1,4 @@
+import type { Plan } from "./project.ts";
+/** A database provider with its lifecycle, a unique-violation mapper, and what the engine needs. */
+export declare function databaseFiles(db: "sqlite" | "postgres"): Partial<Plan>;
+//# sourceMappingURL=database.d.ts.map

package/dist/src/cli/templates/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../../src/cli/templates/database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE"}

package/dist/src/cli/templates/database.js

@@ -0,0 +1,107 @@
+/** A database provider with its lifecycle, a unique-violation mapper, and what the engine needs. */
+export function databaseFiles(db) {
+    return db === "sqlite" ? sqlite() : postgres();
+}
+const errorsTemplate = (check) => `import { ConflictError, type ErrorMapper } from "@raiyyan/brisk";
+
+/** A unique constraint failed, here or in an error the driver wrapped: answer 409 instead of 500. */
+export const uniqueViolation: ErrorMapper = (error) => {
+  for (let current: unknown = error; current instanceof Error; current = current.cause) {
+    if (${check}) {
+      return new ConflictError("Already exists", { code: "ALREADY_EXISTS", cause: error });
+    }
+  }
+  return undefined;
+};
+`;
+function sqlite() {
+    return {
+        files: {
+            "src/database/database.ts": `import { DatabaseSync } from "node:sqlite";
+import { inject, Logger, type OnInit, type OnShutdown } from "@raiyyan/brisk";
+import { env } from "../env.ts";
+
+/**
+ * The app's SQLite connection (Node's built-in \`node:sqlite\`), opened at boot and closed on shutdown.
+ * Repositories inject it: \`readonly #db = inject(Database)\`, then \`this.#db.sql.prepare(...)\`.
+ */
+export class Database implements OnInit, OnShutdown {
+  readonly #log = inject(Logger);
+  #connection: DatabaseSync | undefined;
+
+  get sql(): DatabaseSync {
+    if (!this.#connection) throw new Error("Database used before the app booted");
+    return this.#connection;
+  }
+
+  onInit(): void {
+    this.#connection = new DatabaseSync(env.DATABASE_PATH);
+    this.#connection.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;");
+    this.#log.info({ path: env.DATABASE_PATH }, "database opened");
+  }
+
+  onShutdown(): void {
+    this.#connection?.close();
+  }
+}
+`,
+            "src/database/errors.ts": errorsTemplate(`"errcode" in current && (current.errcode === 2067 || current.errcode === 1555)`),
+        },
+    };
+}
+function postgres() {
+    return {
+        files: {
+            "src/database/database.ts": `import { inject, Logger, type OnInit, type OnShutdown } from "@raiyyan/brisk";
+import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import { env } from "../env.ts";
+import * as schema from "./schema.ts";
+
+/**
+ * The app's PostgreSQL pool with Drizzle on top. Connections open lazily; \`onInit\` checks the database is
+ * reachable before the server listens, and \`onShutdown\` closes the pool after the last request.
+ * Repositories inject it: \`readonly #db = inject(Database).db\`.
+ */
+export class Database implements OnInit, OnShutdown {
+  readonly #log = inject(Logger);
+  readonly pool = new Pool({ connectionString: env.DATABASE_URL, max: env.DATABASE_POOL_SIZE });
+  readonly db: NodePgDatabase<typeof schema> = drizzle(this.pool, { schema });
+
+  async onInit(): Promise<void> {
+    await this.pool.query("select 1");
+    this.#log.info("database connected");
+  }
+
+  async onShutdown(): Promise<void> {
+    await this.pool.end();
+  }
+}
+`,
+            "src/database/schema.ts": `// Drizzle tables. Define them here, then \`npm run db:generate\` and \`npm run db:migrate\`.
+// import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+//
+// export const users = pgTable("users", {
+//   id: uuid().primaryKey().defaultRandom(),
+//   email: text().notNull().unique(),
+//   createdAt: timestamp().notNull().defaultNow(),
+// });
+export {};
+`,
+            "src/database/errors.ts": errorsTemplate(`"code" in current && current.code === "23505"`),
+            "drizzle.config.ts": `import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./src/database/schema.ts",
+  out: "./drizzle",
+  dbCredentials: { url: process.env["DATABASE_URL"] ?? "" },
+});
+`,
+        },
+        dependencies: ["pg", "drizzle-orm"],
+        devDependencies: ["drizzle-kit", "@types/pg"],
+        scripts: { "db:generate": "drizzle-kit generate", "db:migrate": "drizzle-kit migrate" },
+    };
+}
+//# sourceMappingURL=database.js.map

package/dist/src/cli/templates/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../../src/cli/templates/database.ts"],"names":[],"mappings":"AAEA,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,EAAyB;IACrD,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,cAAc,GAAG,CACrB,KAAa,EACL,EAAE,CAAC;;;;;UAKH,KAAK;;;;;;CAMd,CAAC;AAEF,SAAS,MAAM;IACb,OAAO;QACL,KAAK,EAAE;YACL,0BAA0B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BjC;YACK,wBAAwB,EAAE,cAAc,CACtC,gFAAgF,CACjF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO;QACL,KAAK,EAAE;YACL,0BAA0B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBjC;YACK,wBAAwB,EAAE;;;;;;;;;CAS/B;YACK,wBAAwB,EAAE,cAAc,CAAC,+CAA+C,CAAC;YACzF,mBAAmB,EAAE;;;;;;;;CAQ1B;SACI;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC;QACnC,eAAe,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,sBAAsB,EAAE,YAAY,EAAE,qBAAqB,EAAE;KACxF,CAAC;AACJ,CAAC"}

package/dist/src/cli/templates/docker.d.ts

@@ -0,0 +1,4 @@
+import type { InitOptions, Plan } from "./project.ts";
+/** Dockerfile and compose for `docker`, a GitHub Actions workflow for `ci`. */
+export declare function dockerFiles({ pm, db, docker, ci }: InitOptions): Partial<Plan>;
+//# sourceMappingURL=docker.d.ts.map

package/dist/src/cli/templates/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../../src/cli/templates/docker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAgBtD,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}

package/dist/src/cli/templates/docker.js

@@ -0,0 +1,102 @@
+const INSTALL = {
+    pnpm: {
+        lock: "pnpm-lock.yaml",
+        prod: "pnpm install --prod --frozen-lockfile",
+        ci: "pnpm install --frozen-lockfile",
+    },
+    npm: { lock: "package-lock.json", prod: "npm ci --omit=dev", ci: "npm ci" },
+    yarn: {
+        lock: "yarn.lock",
+        prod: "yarn install --production --frozen-lockfile",
+        ci: "yarn install --frozen-lockfile",
+    },
+};
+/** Dockerfile and compose for `docker`, a GitHub Actions workflow for `ci`. */
+export function dockerFiles({ pm, db, docker, ci }) {
+    const install = INSTALL[pm];
+    const files = {};
+    if (docker) {
+        files["Dockerfile"] = `# Node runs the TypeScript sources directly: no build step.
+FROM node:26-slim
+WORKDIR /app
+ENV NODE_ENV=production
+${pm === "npm" ? "" : "RUN corepack enable\n"}COPY package.json ${install.lock} ./
+RUN ${install.prod}
+COPY tsconfig.json ./
+COPY src ./src
+${db === "sqlite" ? "RUN mkdir -p /app/data && chown node:node /app/data\n" : ""}USER node
+EXPOSE 3000
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \\
+  CMD node -e "fetch('http://127.0.0.1:' + (process.env.PORT ?? 3000) + '/health').then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"
+# SIGTERM from \`docker stop\` starts brisk's graceful shutdown.
+CMD ["node", "src/main.ts"]
+`;
+        files[".dockerignore"] = "node_modules\n.env\ncoverage\n.git\n*.db\n*.db-*\n";
+        files["compose.yaml"] = composeTemplate(db);
+    }
+    if (ci)
+        files[".github/workflows/ci.yml"] = ciTemplate(pm, install.ci);
+    return { files };
+}
+function composeTemplate(db) {
+    const app = [
+        "  app:",
+        "    build: .",
+        "    env_file: .env",
+        "    ports:",
+        '      - "3000:3000"',
+        "    stop_grace_period: 30s",
+    ];
+    if (db === "postgres") {
+        app.push("    environment:", "      DATABASE_URL: postgres://app:app@db:5432/app", "    depends_on:", "      db:", "        condition: service_healthy");
+        return `services:
+${app.join("\n")}
+  db:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: app
+      POSTGRES_PASSWORD: app
+      POSTGRES_DB: app
+    ports:
+      - "5432:5432"
+    volumes:
+      - db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U app"]
+      interval: 5s
+      retries: 10
+
+volumes:
+  db:
+`;
+    }
+    if (db === "sqlite") {
+        app.push("    environment:", "      DATABASE_PATH: /app/data/app.db", "    volumes:", "      - data:/app/data");
+        return `services:\n${app.join("\n")}\n\nvolumes:\n  data:\n`;
+    }
+    return `services:\n${app.join("\n")}\n`;
+}
+function ciTemplate(pm, install) {
+    const setup = pm === "pnpm" ? "      - uses: pnpm/action-setup@v4\n" : "";
+    return `name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+${setup}      - uses: actions/setup-node@v4
+        with:
+          node-version: 26
+          cache: ${pm}
+      - run: ${install}
+      - run: ${pm} run typecheck
+      - run: ${pm} test
+`;
+}
+//# sourceMappingURL=docker.js.map

package/dist/src/cli/templates/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../../src/cli/templates/docker.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG;IACd,IAAI,EAAE;QACJ,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,uCAAuC;QAC7C,EAAE,EAAE,gCAAgC;KACrC;IACD,GAAG,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE;IAC3E,IAAI,EAAE;QACJ,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,6CAA6C;QACnD,EAAE,EAAE,gCAAgC;KACrC;CACO,CAAC;AAEX,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAe;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,YAAY,CAAC,GAAG;;;;EAIxB,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,qBAAqB,OAAO,CAAC,IAAI;MACxE,OAAO,CAAC,IAAI;;;EAGhB,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,EAAE;;;;;;CAM/E,CAAC;QACE,KAAK,CAAC,eAAe,CAAC,GAAG,oDAAoD,CAAC;QAC9E,KAAK,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,EAAE;QAAE,KAAK,CAAC,0BAA0B,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB;IAC5C,MAAM,GAAG,GAAG;QACV,QAAQ;QACR,cAAc;QACd,oBAAoB;QACpB,YAAY;QACZ,qBAAqB;QACrB,4BAA4B;KAC7B,CAAC;IACF,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB,oDAAoD,EACpD,iBAAiB,EACjB,WAAW,EACX,oCAAoC,CACrC,CAAC;QACF,OAAO;EACT,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;CAkBf,CAAC;IACA,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB,uCAAuC,EACvC,cAAc,EACd,wBAAwB,CACzB,CAAC;QACF,OAAO,cAAc,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC/D,CAAC;IACD,OAAO,cAAc,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,EAAqB,EAAE,OAAe;IACxD,MAAM,KAAK,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO;;;;;;;;;;;;EAYP,KAAK;;;mBAGY,EAAE;eACN,OAAO;eACP,EAAE;eACF,EAAE;CAChB,CAAC;AACF,CAAC"}

package/dist/src/cli/templates/feature.d.ts

@@ -0,0 +1,8 @@
+import type { Names } from "../names.ts";
+export declare const schemaTemplate: ({ entity }: Names) => string;
+export declare const repositoryTemplate: ({ pascal, entity }: Names) => string;
+export declare const serviceTemplate: ({ kebab, pascal, entity, }: Names) => string;
+export declare const controllerTemplate: ({ kebab, camel, pascal, entity, }: Names) => string;
+export declare const testTemplate: ({ kebab, camel, }: Names) => string;
+export declare const middlewareTemplate: ({ kebab, camel, }: Names) => string;
+//# sourceMappingURL=feature.d.ts.map

package/dist/src/cli/templates/feature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.d.ts","sourceRoot":"","sources":["../../../../src/cli/templates/feature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAO,MAAM,cAAc,eAAgB,KAAK,KAAG,MAkBlD,CAAC;AAEF,eAAO,MAAM,kBAAkB,uBAAwB,KAAK,KAAG,MA0B9D,CAAC;AAEF,eAAO,MAAM,eAAe,+BAIzB,KAAK,KAAG,MA+BV,CAAC;AAEF,eAAO,MAAM,kBAAkB,sCAK5B,KAAK,KAAG,MA6BV,CAAC;AAEF,eAAO,MAAM,YAAY,sBAGtB,KAAK,KAAG,MAuBV,CAAC;AAEF,eAAO,MAAM,kBAAkB,sBAG5B,KAAK,KAAG,MAWV,CAAC"}

package/dist/src/cli/templates/feature.js

@@ -0,0 +1,145 @@
+export const schemaTemplate = ({ entity }) => `import { z } from "@raiyyan/brisk";
+
+export const Create${entity}Body = z.object({
+  name: z.string().trim().min(1),
+});
+
+// Keep .default() out of the create schema: .partial() keeps defaults, and a PATCH would reset omitted fields.
+export const Update${entity}Body = Create${entity}Body.partial();
+
+export const ${entity}IdParams = z.object({ id: z.uuid() });
+
+export const ${entity}Response = z.object({
+  id: z.string(),
+  name: z.string(),
+});
+
+export type Create${entity}Body = z.infer<typeof Create${entity}Body>;
+export type Update${entity}Body = z.infer<typeof Update${entity}Body>;
+`;
+export const repositoryTemplate = ({ pascal, entity }) => `export interface ${entity} {
+  id: string;
+  name: string;
+}
+
+/** In-memory storage. Swap the map for your database; the service does not change. */
+export class ${pascal}Repository {
+  readonly #rows = new Map<string, ${entity}>();
+
+  findAll(): ${entity}[] {
+    return [...this.#rows.values()];
+  }
+
+  findById(id: string): ${entity} | undefined {
+    return this.#rows.get(id);
+  }
+
+  save(row: ${entity}): ${entity} {
+    this.#rows.set(row.id, row);
+    return row;
+  }
+
+  delete(id: string): boolean {
+    return this.#rows.delete(id);
+  }
+}
+`;
+export const serviceTemplate = ({ kebab, pascal, entity, }) => `import { randomUUID } from "node:crypto";
+import { inject, NotFoundError } from "@raiyyan/brisk";
+import { ${pascal}Repository, type ${entity} } from "./${kebab}.repository.ts";
+import type { Create${entity}Body, Update${entity}Body } from "./${kebab}.schema.ts";
+
+export class ${pascal}Service {
+  readonly #repository = inject(${pascal}Repository);
+
+  list(): ${entity}[] {
+    return this.#repository.findAll();
+  }
+
+  get(id: string): ${entity} {
+    const row = this.#repository.findById(id);
+    if (!row) throw new NotFoundError("${entity} not found", { details: { id } });
+    return row;
+  }
+
+  create(input: Create${entity}Body): ${entity} {
+    return this.#repository.save({ id: randomUUID(), ...input });
+  }
+
+  update(id: string, { name }: Update${entity}Body): ${entity} {
+    const row = this.get(id);
+    return this.#repository.save({ ...row, name: name ?? row.name });
+  }
+
+  remove(id: string): void {
+    if (!this.#repository.delete(id)) throw new NotFoundError("${entity} not found", { details: { id } });
+  }
+}
+`;
+export const controllerTemplate = ({ kebab, camel, pascal, entity, }) => `import { defineController, inject } from "@raiyyan/brisk";
+import { Create${entity}Body, ${entity}IdParams, ${entity}Response, Update${entity}Body } from "./${kebab}.schema.ts";
+import { ${pascal}Service } from "./${kebab}.service.ts";
+
+export const ${camel}Controller = defineController({ prefix: "/${kebab}" }, (route) => {
+  const ${camel} = inject(${pascal}Service);
+
+  return {
+    list: route.get("/", { response: ${entity}Response.array() }, () => ${camel}.list()),
+
+    get: route.get("/:id", { params: ${entity}IdParams, response: ${entity}Response }, ({ params }) =>
+      ${camel}.get(params.id),
+    ),
+
+    create: route.post("/", { body: Create${entity}Body, response: ${entity}Response }, ({ body }) =>
+      ${camel}.create(body),
+    ),
+
+    update: route.patch(
+      "/:id",
+      { params: ${entity}IdParams, body: Update${entity}Body, response: ${entity}Response },
+      ({ params, body }) => ${camel}.update(params.id, body),
+    ),
+
+    remove: route.delete("/:id", { params: ${entity}IdParams }, ({ params }) => {
+      ${camel}.remove(params.id);
+    }),
+  };
+});
+`;
+export const testTemplate = ({ kebab, camel, }) => `import { afterAll, describe, expect, it } from "vitest";
+import { createTestClient } from "@raiyyan/brisk/testing";
+import { app } from "../src/app.ts";
+
+const api = await createTestClient(app);
+afterAll(() => api.close());
+
+describe("${kebab}", () => {
+  it("creates, reads, updates and deletes", async () => {
+    const created = await api.call.${camel}.create({ body: { name: "first" } });
+    const { id } = created;
+
+    expect(await api.call.${camel}.get({ params: { id } })).toEqual(created);
+    expect(await api.call.${camel}.update({ params: { id }, body: { name: "second" } })).toEqual({ id, name: "second" });
+    await api.call.${camel}.remove({ params: { id } });
+    await expect(api.call.${camel}.get({ params: { id } })).rejects.toMatchObject({ status: 404 });
+  });
+
+  it("rejects invalid input with field issues", async () => {
+    const res = await api.post("/api/${kebab}", { body: { name: "" } });
+    expect(res.status).toBe(400);
+  });
+});
+`;
+export const middlewareTemplate = ({ kebab, camel, }) => `import { BadRequestError, defineMiddleware } from "@raiyyan/brisk";
+
+/**
+ * Reads the \`x-${kebab}\` header and adds \`${camel}\` to the ctx of every route that uses it.
+ * Replace the check with your own logic; return nothing for a check-only middleware.
+ */
+export const ${camel} = defineMiddleware(({ req }) => {
+  const value = req.get("x-${kebab}");
+  if (!value) throw new BadRequestError("Missing x-${kebab} header", { code: "MISSING_${kebab.toUpperCase().replaceAll("-", "_")}" });
+  return { ${camel}: value };
+}, "${camel}");
+`;
+//# sourceMappingURL=feature.js.map

package/dist/src/cli/templates/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.js","sourceRoot":"","sources":["../../../../src/cli/templates/feature.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAS,EAAU,EAAE,CAAC;;qBAExC,MAAM;;;;;qBAKN,MAAM,gBAAgB,MAAM;;eAElC,MAAM;;eAEN,MAAM;;;;;oBAKD,MAAM,+BAA+B,MAAM;oBAC3C,MAAM,+BAA+B,MAAM;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAS,EAAU,EAAE,CAAC,oBAAoB,MAAM;;;;;;eAMpF,MAAM;qCACgB,MAAM;;eAE5B,MAAM;;;;0BAIK,MAAM;;;;cAIlB,MAAM,MAAM,MAAM;;;;;;;;;CAS/B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAC9B,KAAK,EACL,MAAM,EACN,MAAM,GACA,EAAU,EAAE,CAAC;;WAEV,MAAM,oBAAoB,MAAM,cAAc,KAAK;sBACxC,MAAM,eAAe,MAAM,kBAAkB,KAAK;;eAEzD,MAAM;kCACa,MAAM;;YAE5B,MAAM;;;;qBAIG,MAAM;;yCAEc,MAAM;;;;wBAIvB,MAAM,UAAU,MAAM;;;;uCAIP,MAAM,UAAU,MAAM;;;;;;iEAMI,MAAM;;;CAGtE,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EACjC,KAAK,EACL,KAAK,EACL,MAAM,EACN,MAAM,GACA,EAAU,EAAE,CAAC;iBACJ,MAAM,SAAS,MAAM,aAAa,MAAM,mBAAmB,MAAM,kBAAkB,KAAK;WAC9F,MAAM,qBAAqB,KAAK;;eAE5B,KAAK,6CAA6C,KAAK;UAC5D,KAAK,aAAa,MAAM;;;uCAGK,MAAM,6BAA6B,KAAK;;uCAExC,MAAM,uBAAuB,MAAM;QAClE,KAAK;;;4CAG+B,MAAM,mBAAmB,MAAM;QACnE,KAAK;;;;;kBAKK,MAAM,yBAAyB,MAAM,mBAAmB,MAAM;8BAClD,KAAK;;;6CAGU,MAAM;QAC3C,KAAK;;;;CAIZ,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAC3B,KAAK,EACL,KAAK,GACC,EAAU,EAAE,CAAC;;;;;;;YAOT,KAAK;;qCAEoB,KAAK;;;4BAGd,KAAK;4BACL,KAAK;qBACZ,KAAK;4BACE,KAAK;;;;uCAIM,KAAK;;;;CAI3C,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EACjC,KAAK,EACL,KAAK,GACC,EAAU,EAAE,CAAC;;;mBAGF,KAAK,wBAAwB,KAAK;;;eAGtC,KAAK;6BACS,KAAK;qDACmB,KAAK,8BAA8B,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;aACnH,KAAK;MACZ,KAAK;CACV,CAAC"}