@simple-auth-kit/cli 1.3.1 → 1.4.0

package/registry/combos/express-drizzle/package.json

@@ -7,6 +7,7 @@
   "scripts": {
     "materialize": "node scripts/materialize.mjs",
     "typecheck": "node scripts/materialize.mjs --all && tsc -p .variant/base && tsc -p .variant/workspaces",
+    "lint": "eslint shared variants",
     "prove-cycle": "node scripts/prove-cycle.mjs",
     "migrate": "node scripts/migrate.mjs",
     "seed": "node scripts/seed.mjs"
@@ -19,14 +20,17 @@
     "swagger-ui-express": "^5.0.1"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@types/express": "^5.0.6",
     "@types/node": "^26.2.0",
     "@types/pg": "^8.21.0",
     "@types/swagger-ui-express": "^4.1.8",
     "dotenv": "^17.4.2",
     "drizzle-kit": "^0.31.10",
+    "eslint": "^9.39.5",
     "tsx": "^4.23.11",
-    "typescript": "^7.0.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.70.0",
     "vitest": "^4.1.10"
   }
 }

package/registry/combos/express-drizzle/shared/src/request-context.ts

@@ -23,6 +23,9 @@ import type { AppAbility } from "./ability.js";
 import type { AuthzContext } from "./authz.middleware.js";
 
 declare global {
+  // Express's own declaration-merging style for augmenting its Request type requires a
+  // `namespace` here; there's no ES module form.
+  // eslint-disable-next-line @typescript-eslint/no-namespace
   namespace Express {
     interface Request {
       auth?: AccessTokenClaims;

package/registry/combos/express-prisma/eslint.config.js

@@ -0,0 +1,18 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: [".variant/**", "node_modules/**", "dist/**", "generated/**"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      // This combo's leading-underscore convention (e.g. an interface-required parameter that's
+      // deliberately unused) predates this eslint config — respect it rather than flag it.
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
+      ],
+    },
+  },
+);

package/registry/combos/express-prisma/package.json

@@ -8,6 +8,7 @@
     "materialize": "node scripts/materialize.mjs",
     "prisma:generate": "node scripts/materialize.mjs --all --generate",
     "typecheck": "npm run prisma:generate && tsc -p .variant/base && tsc -p .variant/workspaces",
+    "lint": "eslint shared variants",
     "prove-cycle": "node scripts/prove-cycle.mjs",
     "migrate": "node scripts/migrate.mjs",
     "seed": "node scripts/seed.mjs"
@@ -20,13 +21,16 @@
     "swagger-ui-express": "^5.0.1"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@types/express": "^5.0.6",
     "@types/node": "^26.2.0",
     "@types/swagger-ui-express": "^4.1.8",
     "dotenv": "^17.4.2",
+    "eslint": "^9.39.5",
     "prisma": "^7.9.1",
     "tsx": "^4.23.11",
-    "typescript": "^7.0.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.70.0",
     "vitest": "^4.1.10"
   }
 }

package/registry/combos/express-prisma/shared/src/request-context.ts

@@ -23,6 +23,9 @@ import type { AppAbility } from "./ability.js";
 import type { AuthzContext } from "./authz.middleware.js";
 
 declare global {
+  // Express's own declaration-merging style for augmenting its Request type requires a
+  // `namespace` here; there's no ES module form.
+  // eslint-disable-next-line @typescript-eslint/no-namespace
   namespace Express {
     interface Request {
       auth?: AccessTokenClaims;

package/registry/combos/nestjs-drizzle/eslint.config.js

@@ -0,0 +1,18 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: [".variant/**", "node_modules/**", "dist/**", "generated/**"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      // This combo's leading-underscore convention (e.g. an interface-required parameter that's
+      // deliberately unused) predates this eslint config — respect it rather than flag it.
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
+      ],
+    },
+  },
+);

package/registry/combos/nestjs-drizzle/package.json

@@ -7,6 +7,7 @@
   "scripts": {
     "materialize": "node scripts/materialize.mjs",
     "typecheck": "node scripts/materialize.mjs --all && tsc -p .variant/base && tsc -p .variant/workspaces",
+    "lint": "eslint shared variants",
     "prove-cycle": "node scripts/prove-cycle.mjs",
     "migrate": "node scripts/migrate.mjs",
     "seed": "node scripts/seed.mjs"
@@ -24,13 +25,16 @@
     "rxjs": "^7.8.2"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@types/express": "^5.0.6",
     "@types/node": "^26.2.0",
     "@types/pg": "^8.21.0",
     "dotenv": "^17.4.2",
     "drizzle-kit": "^0.31.10",
+    "eslint": "^9.39.5",
     "tsx": "^4.23.11",
-    "typescript": "^7.0.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.70.0",
     "vitest": "^4.1.10"
   }
 }

package/registry/combos/nestjs-drizzle/shared/src/auth.controller.ts

@@ -1,5 +1,26 @@
-import { BadRequestException, Body, Controller, Get, Inject, Ip, Param, Patch, Post, Query, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  Inject,
+  Ip,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiOperation,
+  ApiParam,
+  ApiQuery,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import type { Request } from "express";
 import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
 import { AuthGuard } from "./auth.guard.js";
@@ -23,17 +44,18 @@ import {
   SelfProfileDto,
   SessionSummaryDto,
   SignupDto,
-  TwoFactorChallengeDto,
   TwoFactorCodeDto,
   UpdateUserDto,
 } from "./dto/auth.dto.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
 
 /**
  * Identity endpoints — everything that is about *a user*, never about a group of them.
@@ -52,7 +74,11 @@ export class AuthController {
   @ApiOperation({ summary: "Create a user and issue a session" })
   @ApiBody({ type: SignupDto })
   @ApiResponse({ status: 201, type: AuthTokensDto })
-  async signup(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  async signup(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.signup({
       email: requireString(body.email, "email"),
       password: requireString(body.password, "password"),
@@ -70,11 +96,24 @@ export class AuthController {
   @Public()
   @ApiOperation({
     summary: "Log in with email, username, or phone + password",
-    description: "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
+    description:
+      "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
   })
   @ApiBody({ type: LoginDto })
-  @ApiResponse({ status: 201, schema: { oneOf: [{ $ref: "#/components/schemas/AuthTokensDto" }, { $ref: "#/components/schemas/TwoFactorChallengeDto" }] } })
-  async login(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  @ApiResponse({
+    status: 201,
+    schema: {
+      oneOf: [
+        { $ref: "#/components/schemas/AuthTokensDto" },
+        { $ref: "#/components/schemas/TwoFactorChallengeDto" },
+      ],
+    },
+  })
+  async login(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.login({
       identifier: requireString(body.identifier, "identifier"),
       password: requireString(body.password, "password"),
@@ -88,7 +127,11 @@ export class AuthController {
   @ApiOperation({ summary: "Complete the 2FA challenge from POST /auth/login" })
   @ApiBody({ type: LoginTwoFactorDto })
   @ApiResponse({ status: 201, type: AuthTokensDto })
-  async loginTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  async loginTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.loginTwoFactor({
       challengeToken: requireString(body.challengeToken, "challengeToken"),
       code: requireString(body.code, "code"),
@@ -99,7 +142,9 @@ export class AuthController {
 
   @Post("refresh")
   @Public()
-  @ApiOperation({ summary: "Rotate a refresh token for a new access+refresh pair" })
+  @ApiOperation({
+    summary: "Rotate a refresh token for a new access+refresh pair",
+  })
   @ApiBody({ type: RefreshDto })
   @ApiResponse({ status: 201, type: RefreshResponseDto })
   async refresh(@Body() body: Record<string, unknown>) {
@@ -121,7 +166,10 @@ export class AuthController {
   @ApiResponse({ status: 200, type: CurrentUserDto })
   async me(@Req() req: Request) {
     const { sub, sessionId } = req.auth!;
-    const [{ twoFactorEnabled }, profile] = await Promise.all([this.auth.getTwoFactorStatus(sub), this.auth.getProfile(sub)]);
+    const [{ twoFactorEnabled }, profile] = await Promise.all([
+      this.auth.getTwoFactorStatus(sub),
+      this.auth.getProfile(sub),
+    ]);
     // The same `req.authz` AbilityGuard's ability was built from — not re-resolved here.
     return {
       sub,
@@ -143,7 +191,9 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "List the current user's active (non-revoked) sessions" })
+  @ApiOperation({
+    summary: "List the current user's active (non-revoked) sessions",
+  })
   @ApiResponse({ status: 200, type: [SessionSummaryDto] })
   async sessions(@Req() req: Request) {
     return this.auth.listActiveSessions(req.auth!.sub);
@@ -159,7 +209,10 @@ export class AuthController {
     const { sessionId, jti, sub } = req.auth!;
     // The revoker is the caller themselves. Recorded so the row can later be told apart from a
     // session an administrator ended — see `sessions.revoked_by`.
-    await this.auth.logout(sessionId, jti, this.config.accessTokenTtlSeconds, { userId: sub, ip });
+    await this.auth.logout(sessionId, jti, this.config.accessTokenTtlSeconds, {
+      userId: sub,
+      ip,
+    });
     return { ok: true };
   }
 
@@ -181,7 +234,10 @@ export class AuthController {
   @ApiOperation({ summary: "Revoke every session except the current one" })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async logoutOthers(@Req() req: Request, @Ip() ip: string) {
-    await this.auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, { userId: req.auth!.sub, ip });
+    await this.auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, {
+      userId: req.auth!.sub,
+      ip,
+    });
     return { ok: true };
   }
 
@@ -191,11 +247,15 @@ export class AuthController {
   @UseGuards(AuthGuard)
   @ApiOperation({
     summary: "Change the current password",
-    description: "Requires the current password. Every other session is revoked; the one making this call is left alone.",
+    description:
+      "Requires the current password. Every other session is revoked; the one making this call is left alone.",
   })
   @ApiBody({ type: ChangePasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async changePassword(@Body() body: Record<string, unknown>, @Req() req: Request) {
+  async changePassword(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     await this.auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
       currentPassword: requireString(body.currentPassword, "currentPassword"),
       newPassword: requireString(body.newPassword, "newPassword"),
@@ -209,15 +269,18 @@ export class AuthController {
   @UseGuards(AuthGuard)
   @ApiOperation({
     summary: "Update the current user's own profile",
-    description: "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
+    description:
+      "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
   })
   @ApiBody({ type: UpdateUserDto })
   @ApiResponse({ status: 200, type: SelfProfileDto })
   async updateMe(@Body() body: Record<string, unknown>, @Req() req: Request) {
     return this.auth.updateProfile(req.auth!.sub, {
-      firstName: body.firstName === null ? null : optionalString(body.firstName),
+      firstName:
+        body.firstName === null ? null : optionalString(body.firstName),
       lastName: body.lastName === null ? null : optionalString(body.lastName),
-      displayName: body.displayName === null ? null : optionalString(body.displayName),
+      displayName:
+        body.displayName === null ? null : optionalString(body.displayName),
       phone: body.phone === null ? null : optionalString(body.phone),
       username: body.username === null ? null : optionalString(body.username),
       photo: body.photo === null ? null : optionalString(body.photo),
@@ -228,7 +291,10 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Begin TOTP enrollment", description: "Not active until confirmed via POST /auth/2fa/confirm." })
+  @ApiOperation({
+    summary: "Begin TOTP enrollment",
+    description: "Not active until confirmed via POST /auth/2fa/confirm.",
+  })
   @ApiResponse({ status: 201, type: EnrollTwoFactorResponseDto })
   async enrollTwoFactor(@Req() req: Request) {
     return this.auth.enrollTwoFactor(req.auth!.sub);
@@ -238,28 +304,51 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Confirm TOTP enrollment with a code", description: "Enables 2FA and returns one-time backup codes, shown only here." })
+  @ApiOperation({
+    summary: "Confirm TOTP enrollment with a code",
+    description:
+      "Enables 2FA and returns one-time backup codes, shown only here.",
+  })
   @ApiBody({ type: TwoFactorCodeDto })
   @ApiResponse({ status: 201, type: ConfirmTwoFactorResponseDto })
-  async confirmTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    return this.auth.confirmTwoFactor(req.auth!.sub, requireString(body.code, "code"));
+  async confirmTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    return this.auth.confirmTwoFactor(
+      req.auth!.sub,
+      requireString(body.code, "code"),
+    );
   }
 
   @Post("2fa/disable")
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Disable 2FA", description: "Requires a valid TOTP or backup code." })
+  @ApiOperation({
+    summary: "Disable 2FA",
+    description: "Requires a valid TOTP or backup code.",
+  })
   @ApiBody({ type: TwoFactorCodeDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async disableTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.disableTwoFactor(req.auth!.sub, requireString(body.code, "code"));
+  async disableTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.disableTwoFactor(
+      req.auth!.sub,
+      requireString(body.code, "code"),
+    );
     return { ok: true };
   }
 
   @Post("password/forgot")
   @Public()
-  @ApiOperation({ summary: "Request a password reset", description: "Always reports success, whether or not the email exists — avoids account enumeration." })
+  @ApiOperation({
+    summary: "Request a password reset",
+    description:
+      "Always reports success, whether or not the email exists — avoids account enumeration.",
+  })
   @ApiBody({ type: ForgotPasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async forgotPassword(@Body() body: Record<string, unknown>) {
@@ -269,11 +358,17 @@ export class AuthController {
 
   @Post("password/reset")
   @Public()
-  @ApiOperation({ summary: "Complete a password reset", description: "Revokes every existing session for the user on success." })
+  @ApiOperation({
+    summary: "Complete a password reset",
+    description: "Revokes every existing session for the user on success.",
+  })
   @ApiBody({ type: ResetPasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async resetPassword(@Body() body: Record<string, unknown>) {
-    await this.auth.resetPassword(requireString(body.token, "token"), requireString(body.newPassword, "newPassword"));
+    await this.auth.resetPassword(
+      requireString(body.token, "token"),
+      requireString(body.newPassword, "newPassword"),
+    );
     return { ok: true };
   }
 
@@ -288,12 +383,22 @@ export class AuthController {
 
   @Get("oauth/:provider/callback")
   @Public()
-  @ApiOperation({ summary: "OAuth provider callback — exchanges the code and completes login" })
+  @ApiOperation({
+    summary: "OAuth provider callback — exchanges the code and completes login",
+  })
   @ApiParam({ name: "provider", enum: ["google", "apple"] })
   @ApiQuery({ name: "code", required: true })
   @ApiQuery({ name: "state", required: true })
   @ApiResponse({ status: 200, type: AuthTokensDto })
-  async oauthCallback(@Param("provider") provider: string, @Query("code") code: string, @Query("state") state: string) {
-    return this.auth.completeOAuthCallback(provider, requireString(code, "code"), requireString(state, "state"));
+  async oauthCallback(
+    @Param("provider") provider: string,
+    @Query("code") code: string,
+    @Query("state") state: string,
+  ) {
+    return this.auth.completeOAuthCallback(
+      provider,
+      requireString(code, "code"),
+      requireString(state, "state"),
+    );
   }
 }

package/registry/combos/nestjs-drizzle/shared/src/route-tiers.ts

@@ -18,7 +18,11 @@
 // with no AuthGuard, or @CheckAbility(...) with no AbilityGuard, is the same class of mistake as
 // declaring nothing at all, and would otherwise be an open route that looks closed in the source.
 import { RequestMethod, SetMetadata } from "@nestjs/common";
-import { GUARDS_METADATA, METHOD_METADATA, PATH_METADATA } from "@nestjs/common/constants.js";
+import {
+  GUARDS_METADATA,
+  METHOD_METADATA,
+  PATH_METADATA,
+} from "@nestjs/common/constants.js";
 import type { PermissionSlug } from "./rbac.defaults.js";
 
 export const ROUTE_TIER_KEY = "routeTier";
@@ -32,14 +36,16 @@ export type RouteTier = "public" | "authenticated" | "ability";
  * said out loud — "this route is open" must be a decision someone wrote down, not the absence of
  * one.
  */
-export const Public = () => SetMetadata(ROUTE_TIER_KEY, "public" satisfies RouteTier);
+export const Public = () =>
+  SetMetadata(ROUTE_TIER_KEY, "public" satisfies RouteTier);
 
 /**
  * Tier 2: any authenticated caller, no permission required. Pair with `@UseGuards(AuthGuard)`
  * (plus the variant's authorization guard where the handler reads `req.authz`) — the startup
  * check refuses a route that claims this tier without an authentication guard behind it.
  */
-export const Authenticated = () => SetMetadata(ROUTE_TIER_KEY, "authenticated" satisfies RouteTier);
+export const Authenticated = () =>
+  SetMetadata(ROUTE_TIER_KEY, "authenticated" satisfies RouteTier);
 
 /**
  * Tier 3: `@CheckAbility("users:block")`. Requires `AuthGuard`, then the variant's authorization
@@ -53,7 +59,10 @@ export const Authenticated = () => SetMetadata(ROUTE_TIER_KEY, "authenticated" s
  * explain. Which *users* hold the slug is entirely a matter of rows.
  */
 export const CheckAbility = (...abilities: PermissionSlug[]) =>
-  applyBoth(SetMetadata(ROUTE_TIER_KEY, "ability" satisfies RouteTier), SetMetadata(CHECK_ABILITY_KEY, abilities as string[]));
+  applyBoth(
+    SetMetadata(ROUTE_TIER_KEY, "ability" satisfies RouteTier),
+    SetMetadata(CHECK_ABILITY_KEY, abilities as string[]),
+  );
 
 /** `applyDecorators` from @nestjs/common, minus its class-decorator branch — these two are method decorators. */
 function applyBoth(...decorators: MethodDecorator[]): MethodDecorator {
@@ -63,11 +72,26 @@ function applyBoth(...decorators: MethodDecorator[]): MethodDecorator {
   };
 }
 
+// `any` here is real type erasure, not laziness: controllers/guards have heterogeneous
+// constructor signatures, and these types only need to carry a class/method identity through
+// reflection — never construct or invoke anything — so `unknown` params would reject every real,
+// differently-typed class assigned to them.
+/* eslint-disable @typescript-eslint/no-explicit-any -- see comment above */
+/** A NestJS controller/guard class reference — reflected on via metadata, never constructed here. */
+type Ctor = abstract new (...args: any[]) => object;
+
+/** A route-handler method — reflected on and invoked by Nest's own pipeline, never called directly here. */
+type HandlerFn = (...args: any[]) => unknown;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
 /** A guard entry in `@UseGuards` may be a class or an already-constructed instance; both reduce to a class. */
-type GuardEntry = Function | { constructor: Function };
+type GuardEntry = Ctor | { constructor: Ctor };
 
-const guardClassesOn = (target: object): Function[] =>
-  ((Reflect.getMetadata(GUARDS_METADATA, target) as GuardEntry[] | undefined) ?? []).map((g) => (typeof g === "function" ? g : g.constructor));
+const guardClassesOn = (target: object): Ctor[] =>
+  (
+    (Reflect.getMetadata(GUARDS_METADATA, target) as
+      GuardEntry[] | undefined) ?? []
+  ).map((g) => (typeof g === "function" ? g : g.constructor));
 
 const joinPath = (...parts: unknown[]) =>
   "/" +
@@ -78,13 +102,21 @@ const joinPath = (...parts: unknown[]) =>
     .join("/");
 
 /** Own methods carrying Nest's route metadata. Controllers here are flat classes; inherited routes are not a shape this combo uses. */
-function routeHandlersOf(controller: Function): Array<{ name: string; handler: Function }> {
+function routeHandlersOf(
+  controller: Ctor,
+): Array<{ name: string; handler: HandlerFn }> {
   const prototype = controller.prototype as Record<string, unknown>;
   return Object.getOwnPropertyNames(prototype)
     .filter((name) => name !== "constructor")
     .map((name) => ({ name, handler: prototype[name] }))
-    .filter((entry): entry is { name: string; handler: Function } => typeof entry.handler === "function")
-    .filter((entry) => Reflect.getMetadata(PATH_METADATA, entry.handler) !== undefined);
+    .filter(
+      (entry): entry is { name: string; handler: HandlerFn } =>
+        typeof entry.handler === "function",
+    )
+    .filter(
+      (entry) =>
+        Reflect.getMetadata(PATH_METADATA, entry.handler) !== undefined,
+    );
 }
 
 /**
@@ -103,7 +135,10 @@ function routeHandlersOf(controller: Function): Array<{ name: string; handler: F
  * @param controllers the module's controller classes
  * @param guards      the two guard classes whose presence defines tiers 2 and 3
  */
-export function assertEveryRouteDeclaresATier(controllers: readonly Function[], guards: { authentication: Function; ability: Function }): void {
+export function assertEveryRouteDeclaresATier(
+  controllers: readonly Ctor[],
+  guards: { authentication: Ctor; ability: Ctor },
+): void {
   const offenders: string[] = [];
 
   for (const controller of controllers) {
@@ -111,12 +146,19 @@ export function assertEveryRouteDeclaresATier(controllers: readonly Function[],
     const controllerGuards = guardClassesOn(controller);
 
     for (const { name, handler } of routeHandlersOf(controller)) {
-      const method = RequestMethod[Reflect.getMetadata(METHOD_METADATA, handler) as RequestMethod] ?? "?";
+      const method =
+        RequestMethod[
+          Reflect.getMetadata(METHOD_METADATA, handler) as RequestMethod
+        ] ?? "?";
       const route = `${method} ${joinPath(controllerPath, Reflect.getMetadata(PATH_METADATA, handler))} (${controller.name}.${name})`;
 
-      const tier: RouteTier | undefined = Reflect.getMetadata(ROUTE_TIER_KEY, handler) ?? Reflect.getMetadata(ROUTE_TIER_KEY, controller);
+      const tier: RouteTier | undefined =
+        Reflect.getMetadata(ROUTE_TIER_KEY, handler) ??
+        Reflect.getMetadata(ROUTE_TIER_KEY, controller);
       if (!tier) {
-        offenders.push(`${route} — declares no tier: add @Public(), @Authenticated(), or @CheckAbility(slug)`);
+        offenders.push(
+          `${route} — declares no tier: add @Public(), @Authenticated(), or @CheckAbility(slug)`,
+        );
         continue;
       }
 
@@ -126,11 +168,22 @@ export function assertEveryRouteDeclaresATier(controllers: readonly Function[],
       const authenticated = attached.includes(guards.authentication);
       const ability = attached.includes(guards.ability);
 
-      if (tier === "public" && (authenticated || ability)) offenders.push(`${route} — declares @Public() but is behind ${attached.map((g) => g.name).join(", ")}`);
-      if (tier === "authenticated" && !authenticated) offenders.push(`${route} — declares @Authenticated() but has no ${guards.authentication.name}`);
-      if (tier === "authenticated" && ability) offenders.push(`${route} — declares @Authenticated() but is behind ${guards.ability.name}; use @CheckAbility instead`);
+      if (tier === "public" && (authenticated || ability))
+        offenders.push(
+          `${route} — declares @Public() but is behind ${attached.map((g) => g.name).join(", ")}`,
+        );
+      if (tier === "authenticated" && !authenticated)
+        offenders.push(
+          `${route} — declares @Authenticated() but has no ${guards.authentication.name}`,
+        );
+      if (tier === "authenticated" && ability)
+        offenders.push(
+          `${route} — declares @Authenticated() but is behind ${guards.ability.name}; use @CheckAbility instead`,
+        );
       if (tier === "ability" && !(authenticated && ability))
-        offenders.push(`${route} — declares @CheckAbility but is not behind ${guards.authentication.name} + ${guards.ability.name}`);
+        offenders.push(
+          `${route} — declares @CheckAbility but is not behind ${guards.authentication.name} + ${guards.ability.name}`,
+        );
     }
   }
 

package/registry/combos/nestjs-prisma/eslint.config.js

@@ -0,0 +1,18 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: [".variant/**", "node_modules/**", "dist/**", "generated/**"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      // This combo's leading-underscore convention (e.g. an interface-required parameter that's
+      // deliberately unused) predates this eslint config — respect it rather than flag it.
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
+      ],
+    },
+  },
+);

package/registry/combos/nestjs-prisma/package.json

@@ -8,6 +8,7 @@
     "materialize": "node scripts/materialize.mjs",
     "prisma:generate": "node scripts/materialize.mjs --all --generate",
     "typecheck": "npm run prisma:generate && tsc -p .variant/base && tsc -p .variant/workspaces",
+    "lint": "eslint shared variants",
     "prove-cycle": "node scripts/prove-cycle.mjs",
     "migrate": "node scripts/migrate.mjs",
     "seed": "node scripts/seed.mjs"
@@ -30,12 +31,15 @@
     "socket.io": "^4.8.3"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@types/express": "^5.0.6",
     "@types/node": "^26.2.0",
     "dotenv": "^17.4.2",
+    "eslint": "^9.39.5",
     "prisma": "^7.9.1",
     "tsx": "^4.23.11",
-    "typescript": "^7.0.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.70.0",
     "vitest": "^4.1.10"
   }
 }