@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/nestjs-prisma/shared/src/{guards → ability}/ability.guard.ts

@@ -6,7 +6,7 @@ import {
   Injectable,
 } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-import { ABILITY_SUBJECT } from "../ability.js";
+import { ABILITY_SUBJECT } from "./ability.js";
 import { CHECK_ABILITY_KEY } from "../route-tiers.js";
 
 // The authorization boundary for tier-3 routes — no role-based bypass beside it, so a role

package/registry/combos/nestjs-prisma/shared/src/{ability.ts → ability/ability.ts}

@@ -6,7 +6,11 @@
 // A permission slug is CASL's *action*; the subject is always a constant empty string. That
 // keeps the model flat — no subject taxonomy, no (action, subject) pairing to get wrong, no
 // conditions.
-import { AbilityBuilder, createMongoAbility, type MongoAbility } from "@casl/ability";
+import {
+  AbilityBuilder,
+  createMongoAbility,
+  type MongoAbility,
+} from "@casl/ability";
 
 // Constant rather than a repeated string literal — `can("users:read", "")` in one place and
 // `can("users:read", "all")` in another would silently never match.
@@ -16,7 +20,9 @@ export type AppAbility = MongoAbility<[string, typeof ABILITY_SUBJECT]>;
 
 // An empty list builds an ability with no rules, which denies everything — the fail-closed
 // answer whether permissions failed to resolve or the user genuinely has none.
-export function defineAbilitiesFor(permissions: readonly string[] = []): AppAbility {
+export function defineAbilitiesFor(
+  permissions: readonly string[] = [],
+): AppAbility {
   const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
   for (const permission of permissions) can(permission, ABILITY_SUBJECT);
   return build();

package/registry/combos/nestjs-prisma/shared/src/{permission-cache.ts → cache/permission-cache.ts}

@@ -14,7 +14,7 @@
 // happen on `AuthGuard`, which never reads this cache. Negative results aren't cached either —
 // "not a member of this workspace" is re-read every time.
 import { Inject, Injectable } from "@nestjs/common";
-import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 
 /** DI token for the store. Provide your own to `AuthModule.forRoot({ permissionCacheStore })`. */
 export const PERMISSION_CACHE_STORE = Symbol("PERMISSION_CACHE_STORE");
@@ -37,7 +37,10 @@ export interface PermissionCacheStore {
 // database resolution, not N.
 export class InMemoryPermissionCacheStore implements PermissionCacheStore {
   readonly stats = { hits: 0, misses: 0, writes: 0 };
-  private readonly entries = new Map<string, { value: string; expiresAt: number }>();
+  private readonly entries = new Map<
+    string,
+    { value: string; expiresAt: number }
+  >();
 
   async get(key: string): Promise<string | undefined> {
     const entry = this.entries.get(key);
@@ -70,10 +73,14 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
 
   async bump(key: string): Promise<number> {
     const entry = this.entries.get(key);
-    const next = Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
+    const next =
+      Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
     // Version counters outlive entries on purpose: a counter that expired back to 0 would make
     // every superseded entry reachable again.
-    this.entries.set(key, { value: String(next), expiresAt: Number.MAX_SAFE_INTEGER });
+    this.entries.set(key, {
+      value: String(next),
+      expiresAt: Number.MAX_SAFE_INTEGER,
+    });
     return next;
   }
 }
@@ -82,8 +89,10 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
 // migration, a psql session) can bump the counter itself — otherwise an out-of-band write is
 // only picked up once the cache entry expires.
 export const POLICY_VERSION_KEY = `${CACHE_NAMESPACE}:policy-version`;
-export const subjectVersionKey = (subject: string) => `${CACHE_NAMESPACE}:subject-version:${subject}`;
-const entryKey = (subject: string, policy: string, subjectVersion: string) => `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
+export const subjectVersionKey = (subject: string) =>
+  `${CACHE_NAMESPACE}:subject-version:${subject}`;
+const entryKey = (subject: string, policy: string, subjectVersion: string) =>
+  `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
 
 // Reads through to the database once per (principal, policy version, subject version). Used by
 // each variant's `AuthzGuard` — the variants differ only in what a "subject" is (a user id in
@@ -92,7 +101,8 @@ const entryKey = (subject: string, policy: string, subjectVersion: string) => `$
 @Injectable()
 export class PermissionCache {
   constructor(
-    @Inject(PERMISSION_CACHE_STORE) private readonly store: PermissionCacheStore,
+    @Inject(PERMISSION_CACHE_STORE)
+    private readonly store: PermissionCacheStore,
     @Inject(AUTH_CONFIG) private readonly config: AuthConfig,
   ) {}
 
@@ -100,11 +110,17 @@ export class PermissionCache {
   // under load costs one database read per instance rather than one per request.
   private readonly inFlight = new Map<string, Promise<unknown>>();
 
-  async resolve<T>(subject: string, load: () => Promise<T | null>): Promise<T | null> {
+  async resolve<T>(
+    subject: string,
+    load: () => Promise<T | null>,
+  ): Promise<T | null> {
     const ttl = this.config.permissionCacheTtlSeconds;
     if (ttl <= 0) return load(); // caching off; the semantics are identical, only the cost differs
 
-    const [policy = "0", version = "0"] = await this.store.getMany([POLICY_VERSION_KEY, subjectVersionKey(subject)]);
+    const [policy = "0", version = "0"] = await this.store.getMany([
+      POLICY_VERSION_KEY,
+      subjectVersionKey(subject),
+    ]);
     const key = entryKey(subject, policy, version);
 
     const cached = await this.store.get(key);
@@ -116,7 +132,8 @@ export class PermissionCache {
     const pending = (async () => {
       const resolved = await load();
       // A negative result is not written: see the module comment. Only a real answer is cached.
-      if (resolved !== null) await this.store.set(key, JSON.stringify(resolved), ttl);
+      if (resolved !== null)
+        await this.store.set(key, JSON.stringify(resolved), ttl);
       return resolved;
     })();
 

package/registry/combos/{nestjs-drizzle/shared/src → nestjs-prisma/shared/src/cache}/rate-limit.store.ts

@@ -8,7 +8,10 @@ import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
  */
 @Injectable()
 export class InMemoryRateLimitStore implements RateLimitDeps {
-  private readonly windows = new Map<string, { count: number; resetAt: number }>();
+  private readonly windows = new Map<
+    string,
+    { count: number; resetAt: number }
+  >();
 
   async increment(key: string, windowMs: number): Promise<number> {
     const now = Date.now();

package/registry/combos/nestjs-prisma/shared/src/{auth.config.ts → config/auth.config.ts}

@@ -1,4 +1,4 @@
-import type { PermissionCacheStore } from "./permission-cache.js";
+import type { PermissionCacheStore } from "../cache/permission-cache.js";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
 
 export const AUTH_CONFIG = Symbol("AUTH_CONFIG");

package/registry/combos/nestjs-prisma/shared/src/{key-provider.ts → config/key-provider.ts}

@@ -10,11 +10,15 @@ const MIN_SECRET_BYTES = 32; // 256 bits, HS256's own minimum
 function loadSecret(): Uint8Array {
   const raw = process.env[ENV_VAR];
   if (!raw) {
-    throw new Error(`${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`);
+    throw new Error(
+      `${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`,
+    );
   }
   const secret = Buffer.from(raw, "base64");
   if (secret.length < MIN_SECRET_BYTES) {
-    throw new Error(`${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`);
+    throw new Error(
+      `${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`,
+    );
   }
   return secret;
 }

package/registry/combos/nestjs-prisma/shared/src/controllers/auth.controller.ts

@@ -27,7 +27,7 @@ import {
   AUTH_CONFIG,
   AuthConfig,
   defaultThrottleBuckets,
-} from "../auth.config.js";
+} from "../config/auth.config.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { AuthzGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-prisma/shared/src/guards/auth.guard.ts

@@ -6,7 +6,7 @@ import {
   UnauthorizedException,
 } from "@nestjs/common";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import "../request-context.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 

package/registry/combos/{express-prisma/shared/src → nestjs-prisma/shared/src/helpers}/id.helper.ts

@@ -11,12 +11,16 @@ export function toId(value: string | number | bigint): bigint {
   }
 }
 
-export function toIdOrUndefined(value: string | number | bigint | null | undefined): bigint | undefined {
+export function toIdOrUndefined(
+  value: string | number | bigint | null | undefined,
+): bigint | undefined {
   if (value === null || value === undefined || value === "") return undefined;
   return toId(value);
 }
 
-export function toIdOrNull(value: string | number | bigint | null | undefined): bigint | null {
+export function toIdOrNull(
+  value: string | number | bigint | null | undefined,
+): bigint | null {
   if (value === null || value === undefined || value === "") return null;
   return toId(value);
 }

package/registry/combos/nestjs-prisma/shared/src/{pagination.ts → helpers/pagination.ts}

@@ -21,10 +21,24 @@ export function normalizePage(page: number | undefined): number {
 }
 
 export function normalizeLimit(limit: number | undefined): number {
-  return Math.min(limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+  return Math.min(
+    limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE,
+    MAX_PAGE_SIZE,
+  );
 }
 
-export function buildPageMeta(page: number, limit: number, total: number): PageMeta {
+export function buildPageMeta(
+  page: number,
+  limit: number,
+  total: number,
+): PageMeta {
   const pageCount = Math.ceil(total / limit);
-  return { page, limit, total, pageCount, hasPreviousPage: page > 1, hasNextPage: page < pageCount };
+  return {
+    page,
+    limit,
+    total,
+    pageCount,
+    hasPreviousPage: page > 1,
+    hasNextPage: page < pageCount,
+  };
 }

package/registry/combos/nestjs-prisma/shared/src/repositories/oauth.repository.ts

@@ -1,7 +1,7 @@
 import { BadRequestException, Inject, Injectable } from "@nestjs/common";
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 @Injectable()
 export class OAuthRepository implements OAuthStoreDeps {

package/registry/combos/nestjs-prisma/shared/src/repositories/password-reset.repository.ts

@@ -1,7 +1,7 @@
 import { Inject, Injectable } from "@nestjs/common";
 import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 @Injectable()
 export class PasswordResetRepository implements PasswordResetStoreDeps {
@@ -21,9 +21,7 @@ export class PasswordResetRepository implements PasswordResetStoreDeps {
     });
   }
 
-  async findValidResetToken(
-    tokenHash: string,
-  ): Promise<{
+  async findValidResetToken(tokenHash: string): Promise<{
     userId: string;
     expiresAt: string;
     consumedAt: string | null;

package/registry/combos/nestjs-prisma/shared/src/repositories/session.repository.ts

@@ -7,9 +7,9 @@ import type {
   SessionRecord,
 } from "@/lib/auth/core/types.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 function toSessionRecord(row: {
   id: bigint;

package/registry/combos/nestjs-prisma/shared/src/request-context.ts

@@ -7,7 +7,7 @@
 //
 // Importing this module for its side effect installs the Express `Request` augmentation.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
-import type { AppAbility } from "./ability.js";
+import type { AppAbility } from "./ability/ability.js";
 import type { AuthzContext } from "./guards/authz.guard.js";
 
 declare module "express" {

package/registry/combos/nestjs-prisma/test/bootstrap.ts

@@ -2,7 +2,7 @@ import "reflect-metadata";
 import { Module } from "@nestjs/common";
 import { NestFactory } from "@nestjs/core";
 import { AuthModule } from "../src/auth.module.js";
-import { InMemoryPermissionCacheStore } from "../src/permission-cache.js";
+import { InMemoryPermissionCacheStore } from "../src/cache/permission-cache.js";
 
 // No mailer is wired up for the proof, so this stands in for one — prove-cycle.ts reads the
 // raw token back out of here the same way a test inbox would, to exercise the reset flow.

package/registry/combos/nestjs-prisma/test/prove-cycle.ts

@@ -11,7 +11,7 @@ import "dotenv/config";
 import { randomUUID } from "node:crypto";
 import { Get } from "@nestjs/common";
 import { generateTotpCode } from "@/lib/auth/core/two-factor.js";
-import { ABILITY_SUBJECT, defineAbilitiesFor } from "../src/ability.js";
+import { ABILITY_SUBJECT, defineAbilitiesFor } from "../src/ability/ability.js";
 import { AuthController } from "../src/controllers/auth.controller.js";
 import { bootstrap, capturedResetTokens } from "./bootstrap.js";
 import {

package/registry/combos/nestjs-prisma/variants/base/src/auth.module.ts

@@ -2,12 +2,16 @@ import { PrismaPg } from "@prisma/adapter-pg";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
 import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
-import { AbilityGuard } from "./guards/ability.guard.js";
+import { AbilityGuard } from "./ability/ability.guard.js";
 import { AdminController } from "./controllers/admin.controller.js";
 import { AuditLogGateway } from "./gateways/audit-log.gateway.js";
 import { AuditLogRepository } from "./repositories/audit-log.repository.js";
 import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
-import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
+import {
+  AUTH_CONFIG,
+  AuthConfig,
+  defaultAuthConfig,
+} from "./config/auth.config.js";
 import { AuthController } from "./controllers/auth.controller.js";
 import { AuthGuard } from "./guards/auth.guard.js";
 import { AuthService } from "./services/auth.service.js";
@@ -15,7 +19,7 @@ import { AuthzGuard } from "./guards/authz.guard.js";
 import { PrismaClient } from "./../generated/prisma/client.js";
 import { CountryRepository } from "./repositories/country.repository.js";
 import { CustomerRepository } from "./repositories/customer.repository.js";
-import { KeyProviderService } from "./key-provider.js";
+import { KeyProviderService } from "./config/key-provider.js";
 import { LanguageRepository } from "./repositories/language.repository.js";
 import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
@@ -23,11 +27,11 @@ import {
   InMemoryPermissionCacheStore,
   PERMISSION_CACHE_STORE,
   PermissionCache,
-} from "./permission-cache.js";
+} from "./cache/permission-cache.js";
 import {
   InMemoryRateLimitStore,
   RATE_LIMIT_STORE,
-} from "./rate-limit.store.js";
+} from "./cache/rate-limit.store.js";
 import { RbacRepository } from "./repositories/rbac.repository.js";
 import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";

package/registry/combos/nestjs-prisma/variants/base/src/controllers/admin.controller.ts

@@ -24,7 +24,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { AuthzGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-prisma/variants/base/src/gateways/audit-log.gateway.ts

@@ -10,7 +10,7 @@ import {
   AuditLogEntry,
   AuditLogRepository,
 } from "../repositories/audit-log.repository.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 
 // socket.io clients disagree on where a bearer token travels: `auth.token` (the socket.io-native

package/registry/combos/nestjs-prisma/variants/base/src/guards/authz.guard.ts

@@ -4,8 +4,8 @@ import {
   Inject,
   Injectable,
 } from "@nestjs/common";
-import { defineAbilitiesFor } from "../ability.js";
-import { PermissionCache } from "../permission-cache.js";
+import { defineAbilitiesFor } from "../ability/ability.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import { RbacRepository } from "../repositories/rbac.repository.js";
 
 // Roles and permissions are global to this deployment — one set per user, resolved from the

package/registry/combos/nestjs-prisma/variants/base/src/index.ts

@@ -0,0 +1,9 @@
+export * from "./auth.module.js";
+
+export * from "./route-tiers.js";
+
+export * from "./guards/auth.guard.js";
+export * from "./guards/authz.guard.js";
+
+export * from "./ability/ability.js";
+export * from "./ability/ability.guard.js";

package/registry/combos/nestjs-prisma/variants/base/src/{docs.ts → openapi/docs.ts}

@@ -6,20 +6,30 @@ import type { NextFunction, Request, Response } from "express";
 
 // Production-only gate: development keeps zero-friction docs, production requires the DOCS_*
 // pair on every docs route. Credentials missing in production fail closed (503), not open.
-export function docsBasicAuth(req: Request, res: Response, next: NextFunction): void {
+export function docsBasicAuth(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): void {
   if (process.env["NODE_ENV"] !== "production") return next();
 
   const username = process.env["DOCS_USERNAME"];
   const password = process.env["DOCS_PASSWORD"];
   if (!username || !password) {
-    res.status(503).send("Docs are unavailable: DOCS_USERNAME and DOCS_PASSWORD are not set");
+    res
+      .status(503)
+      .send(
+        "Docs are unavailable: DOCS_USERNAME and DOCS_PASSWORD are not set",
+      );
     return;
   }
 
   const header = req.headers.authorization;
   if (header?.startsWith("Basic ")) {
     // Split on the first colon only — RFC 7617 allows colons inside the password.
-    const [user, ...rest] = Buffer.from(header.slice("Basic ".length), "base64").toString("utf8").split(":");
+    const [user, ...rest] = Buffer.from(header.slice("Basic ".length), "base64")
+      .toString("utf8")
+      .split(":");
     if (user === username && rest.join(":") === password) return next();
   }
 
@@ -38,12 +48,18 @@ export interface DocsOptions {
  * Swagger registers alongside the UI) behind `docsBasicAuth`. Call after `NestFactory.create`,
  * before `listen`.
  */
-export function setupDocs(app: INestApplication, opts: DocsOptions = {}): OpenAPIObject {
+export function setupDocs(
+  app: INestApplication,
+  opts: DocsOptions = {},
+): OpenAPIObject {
   const document = SwaggerModule.createDocument(
     app,
     new DocumentBuilder()
       .setTitle(opts.title ?? "simple-auth-kit API")
-      .setDescription(opts.description ?? "nestjs-prisma reference combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC, audit log")
+      .setDescription(
+        opts.description ??
+          "nestjs-prisma reference combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC, audit log",
+      )
       .setVersion(opts.version ?? "1.0")
       .addBearerAuth()
       .build(),
@@ -52,7 +68,8 @@ export function setupDocs(app: INestApplication, opts: DocsOptions = {}): OpenAP
   // The gates must be registered before SwaggerModule.setup so they run ahead of the UI
   // middleware. `/docs-json` and `/docs-yaml` are separate express paths — a `/docs` prefix
   // mount does not cover them.
-  for (const path of ["/docs", "/docs-json", "/docs-yaml", "/reference"]) app.use(path, docsBasicAuth);
+  for (const path of ["/docs", "/docs-json", "/docs-yaml", "/reference"])
+    app.use(path, docsBasicAuth);
 
   SwaggerModule.setup("docs", app, document);
   app.use("/reference", apiReference({ content: document }));

package/registry/combos/nestjs-prisma/variants/base/src/repositories/audit-log.repository.ts

@@ -1,13 +1,13 @@
 import { Inject, Injectable } from "@nestjs/common";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/nestjs-prisma/variants/base/src/repositories/country.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Country` row as `findUnique`/`findMany` return it. */
 export type CountryRow = Prisma.CountryGetPayload<object>;

package/registry/combos/nestjs-prisma/variants/base/src/repositories/customer.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Customer` row as `findUnique`/`findMany` return it. */
 export type CustomerRow = Prisma.CustomerGetPayload<object>;
@@ -88,9 +88,10 @@ export interface CustomerInput {
   isActive?: boolean;
 }
 
-function toPrismaInput(
-  input: Partial<CustomerInput>,
-): Omit<Partial<CustomerInput>, "dob" | "joinedDate"> & {
+function toPrismaInput(input: Partial<CustomerInput>): Omit<
+  Partial<CustomerInput>,
+  "dob" | "joinedDate"
+> & {
   dob?: Date | null;
   joinedDate?: Date;
 } {

package/registry/combos/nestjs-prisma/variants/base/src/repositories/language.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Language` row as `findUnique`/`findMany` return it. */
 export type LanguageRow = Prisma.LanguageGetPayload<object>;

package/registry/combos/nestjs-prisma/variants/base/src/repositories/rbac.repository.ts

@@ -6,14 +6,14 @@ import {
 } from "@nestjs/common";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { PermissionCache } from "../permission-cache.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { PermissionCache } from "../cache/permission-cache.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 const USER_ROLES_INCLUDE = {
   roles: { select: { role: { select: { slug: true } } } },

package/registry/combos/nestjs-prisma/variants/base/src/services/auth.service.ts

@@ -51,7 +51,7 @@ import {
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 import {
   AuditLogEntry,
   AuditLogListFilter,
@@ -73,7 +73,7 @@ import {
   CustomerRepository,
   CustomerSummary,
 } from "../repositories/customer.repository.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import {
   LanguageInput,
   LanguageListFilter,
@@ -83,8 +83,8 @@ import {
 } from "../repositories/language.repository.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
-import type { Paginated } from "../pagination.js";
-import { RATE_LIMIT_STORE } from "../rate-limit.store.js";
+import type { Paginated } from "../helpers/pagination.js";
+import { RATE_LIMIT_STORE } from "../cache/rate-limit.store.js";
 import {
   PermissionInput,
   PermissionSummary,
@@ -97,7 +97,7 @@ import {
 } from "../repositories/rbac.repository.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -499,9 +499,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;