@simple-auth-kit/cli 1.5.1 → 1.6.1

package/registry/combos/nestjs-drizzle/shared/src/{guards → ability}/ability.guard.ts

@@ -6,7 +6,7 @@ import {
   Injectable,
 } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-import { ABILITY_SUBJECT } from "../ability.js";
+import { ABILITY_SUBJECT } from "./ability.js";
 import { CHECK_ABILITY_KEY } from "../route-tiers.js";
 
 /**

package/registry/combos/nestjs-drizzle/shared/src/{ability.ts → ability/ability.ts}

@@ -17,7 +17,11 @@
 // database, no `(action, subject)` pairing to get wrong, and no conditions — which in turn means
 // there is no such thing as a rule the route guard can only *partially* evaluate. What a slug
 // means is decided entirely by which routes name it.
-import { AbilityBuilder, createMongoAbility, type MongoAbility } from "@casl/ability";
+import {
+  AbilityBuilder,
+  createMongoAbility,
+  type MongoAbility,
+} from "@casl/ability";
 
 /**
  * The subject every rule is written against. CASL needs one; this model does not use subjects, so
@@ -37,7 +41,9 @@ export type AppAbility = MongoAbility<[string, typeof ABILITY_SUBJECT]>;
  * answer for "we could not resolve any permissions", and the same answer as "this user genuinely
  * has none". There is no default-allow branch anywhere in this file.
  */
-export function defineAbilitiesFor(permissions: readonly string[] = []): AppAbility {
+export function defineAbilitiesFor(
+  permissions: readonly string[] = [],
+): AppAbility {
   const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
   for (const permission of permissions) can(permission, ABILITY_SUBJECT);
   return build();

package/registry/combos/nestjs-drizzle/shared/src/{permission-cache.ts → cache/permission-cache.ts}

@@ -36,7 +36,7 @@
 // Negative results are not cached either: "not a member of this workspace" is re-read every time,
 // so being added to a workspace is effective immediately rather than after a TTL.
 import { Inject, Injectable } from "@nestjs/common";
-import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 
 /** DI token for the store. Provide your own to `AuthModule.forRoot({ permissionCacheStore })`. */
 export const PERMISSION_CACHE_STORE = Symbol("PERMISSION_CACHE_STORE");
@@ -70,7 +70,10 @@ export interface PermissionCacheStore {
  */
 export class InMemoryPermissionCacheStore implements PermissionCacheStore {
   readonly stats = { hits: 0, misses: 0, writes: 0 };
-  private readonly entries = new Map<string, { value: string; expiresAt: number }>();
+  private readonly entries = new Map<
+    string,
+    { value: string; expiresAt: number }
+  >();
 
   async get(key: string): Promise<string | undefined> {
     const entry = this.entries.get(key);
@@ -103,10 +106,14 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
 
   async bump(key: string): Promise<number> {
     const entry = this.entries.get(key);
-    const next = Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
+    const next =
+      Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
     // Version counters outlive entries on purpose: a counter that expired back to 0 would make
     // every superseded entry reachable again.
-    this.entries.set(key, { value: String(next), expiresAt: Number.MAX_SAFE_INTEGER });
+    this.entries.set(key, {
+      value: String(next),
+      expiresAt: Number.MAX_SAFE_INTEGER,
+    });
     return next;
   }
 }
@@ -118,8 +125,10 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
  * write is picked up when the entry expires (`permissionCacheTtlSeconds`), not immediately.
  */
 export const POLICY_VERSION_KEY = `${CACHE_NAMESPACE}:policy-version`;
-export const subjectVersionKey = (subject: string) => `${CACHE_NAMESPACE}:subject-version:${subject}`;
-const entryKey = (subject: string, policy: string, subjectVersion: string) => `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
+export const subjectVersionKey = (subject: string) =>
+  `${CACHE_NAMESPACE}:subject-version:${subject}`;
+const entryKey = (subject: string, policy: string, subjectVersion: string) =>
+  `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
 
 /**
  * Reads through to the database, once per (principal, policy version, subject version).
@@ -131,7 +140,8 @@ const entryKey = (subject: string, policy: string, subjectVersion: string) => `$
 @Injectable()
 export class PermissionCache {
   constructor(
-    @Inject(PERMISSION_CACHE_STORE) private readonly store: PermissionCacheStore,
+    @Inject(PERMISSION_CACHE_STORE)
+    private readonly store: PermissionCacheStore,
     @Inject(AUTH_CONFIG) private readonly config: AuthConfig,
   ) {}
 
@@ -149,11 +159,17 @@ export class PermissionCache {
    * @param subject the identity these permissions belong to — the cache key's principal
    * @param load    resolves from the database on a miss. Returning `null` is not cached.
    */
-  async resolve<T>(subject: string, load: () => Promise<T | null>): Promise<T | null> {
+  async resolve<T>(
+    subject: string,
+    load: () => Promise<T | null>,
+  ): Promise<T | null> {
     const ttl = this.config.permissionCacheTtlSeconds;
     if (ttl <= 0) return load(); // caching off; the semantics are identical, only the cost differs
 
-    const [policy = "0", version = "0"] = await this.store.getMany([POLICY_VERSION_KEY, subjectVersionKey(subject)]);
+    const [policy = "0", version = "0"] = await this.store.getMany([
+      POLICY_VERSION_KEY,
+      subjectVersionKey(subject),
+    ]);
     const key = entryKey(subject, policy, version);
 
     const cached = await this.store.get(key);
@@ -165,7 +181,8 @@ export class PermissionCache {
     const pending = (async () => {
       const resolved = await load();
       // A negative result is not written: see the module comment. Only a real answer is cached.
-      if (resolved !== null) await this.store.set(key, JSON.stringify(resolved), ttl);
+      if (resolved !== null)
+        await this.store.set(key, JSON.stringify(resolved), ttl);
       return resolved;
     })();
 

package/registry/combos/{nestjs-prisma/shared/src → nestjs-drizzle/shared/src/cache}/rate-limit.store.ts

@@ -8,7 +8,10 @@ import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
  */
 @Injectable()
 export class InMemoryRateLimitStore implements RateLimitDeps {
-  private readonly windows = new Map<string, { count: number; resetAt: number }>();
+  private readonly windows = new Map<
+    string,
+    { count: number; resetAt: number }
+  >();
 
   async increment(key: string, windowMs: number): Promise<number> {
     const now = Date.now();

package/registry/combos/nestjs-drizzle/shared/src/{auth.config.ts → config/auth.config.ts}

@@ -1,4 +1,4 @@
-import type { PermissionCacheStore } from "./permission-cache.js";
+import type { PermissionCacheStore } from "../cache/permission-cache.js";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
 
 export const AUTH_CONFIG = Symbol("AUTH_CONFIG");

package/registry/combos/nestjs-drizzle/shared/src/{db.ts → config/db.ts}

@@ -5,7 +5,7 @@
 // style, which is required (not just stylistic) for DI to keep working under esbuild-based
 // tooling like tsx that skips `emitDecoratorMetadata`'s runtime type reflection.
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
-import type * as schema from "./schema.js";
+import type * as schema from "../schema.js";
 
 export const DRIZZLE_DB = Symbol("DRIZZLE_DB");
 

package/registry/combos/nestjs-drizzle/shared/src/{key-provider.ts → config/key-provider.ts}

@@ -10,11 +10,15 @@ const MIN_SECRET_BYTES = 32; // 256 bits, HS256's own minimum
 function loadSecret(): Uint8Array {
   const raw = process.env[ENV_VAR];
   if (!raw) {
-    throw new Error(`${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`);
+    throw new Error(
+      `${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`,
+    );
   }
   const secret = Buffer.from(raw, "base64");
   if (secret.length < MIN_SECRET_BYTES) {
-    throw new Error(`${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`);
+    throw new Error(
+      `${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`,
+    );
   }
   return secret;
 }

package/registry/combos/nestjs-drizzle/shared/src/controllers/auth.controller.ts

@@ -22,7 +22,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { AuthzGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-drizzle/shared/src/guards/auth.guard.ts

@@ -6,7 +6,7 @@ import {
   UnauthorizedException,
 } from "@nestjs/common";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import "../request-context.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 

package/registry/combos/nestjs-drizzle/shared/src/{id.helper.ts → helpers/id.helper.ts}

@@ -11,12 +11,16 @@ export function toId(value: string | number | bigint): bigint {
   }
 }
 
-export function toIdOrUndefined(value: string | number | bigint | null | undefined): bigint | undefined {
+export function toIdOrUndefined(
+  value: string | number | bigint | null | undefined,
+): bigint | undefined {
   if (value === null || value === undefined || value === "") return undefined;
   return toId(value);
 }
 
-export function toIdOrNull(value: string | number | bigint | null | undefined): bigint | null {
+export function toIdOrNull(
+  value: string | number | bigint | null | undefined,
+): bigint | null {
   if (value === null || value === undefined || value === "") return null;
   return toId(value);
 }

package/registry/combos/{express-prisma/shared/src → nestjs-drizzle/shared/src/helpers}/pagination.ts

@@ -21,10 +21,24 @@ export function normalizePage(page: number | undefined): number {
 }
 
 export function normalizeLimit(limit: number | undefined): number {
-  return Math.min(limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+  return Math.min(
+    limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE,
+    MAX_PAGE_SIZE,
+  );
 }
 
-export function buildPageMeta(page: number, limit: number, total: number): PageMeta {
+export function buildPageMeta(
+  page: number,
+  limit: number,
+  total: number,
+): PageMeta {
   const pageCount = Math.ceil(total / limit);
-  return { page, limit, total, pageCount, hasPreviousPage: page > 1, hasNextPage: page < pageCount };
+  return {
+    page,
+    limit,
+    total,
+    pageCount,
+    hasPreviousPage: page > 1,
+    hasNextPage: page < pageCount,
+  };
 }

package/registry/combos/nestjs-drizzle/shared/src/repositories/oauth.repository.ts

@@ -1,9 +1,9 @@
 import { BadRequestException, Inject, Injectable } from "@nestjs/common";
 import { and, eq } from "drizzle-orm";
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import { oauthAccounts, users } from "../schema.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 @Injectable()
 export class OAuthRepository implements OAuthStoreDeps {

package/registry/combos/nestjs-drizzle/shared/src/repositories/password-reset.repository.ts

@@ -1,9 +1,9 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { eq } from "drizzle-orm";
 import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import { passwordResetTokens, users } from "../schema.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 @Injectable()
 export class PasswordResetRepository implements PasswordResetStoreDeps {
@@ -14,18 +14,14 @@ export class PasswordResetRepository implements PasswordResetStoreDeps {
     tokenHash: string;
     expiresAt: string;
   }): Promise<void> {
-    await this.db
-      .insert(passwordResetTokens)
-      .values({
-        userId: toId(input.userId),
-        tokenHash: input.tokenHash,
-        expiresAt: new Date(input.expiresAt),
-      });
+    await this.db.insert(passwordResetTokens).values({
+      userId: toId(input.userId),
+      tokenHash: input.tokenHash,
+      expiresAt: new Date(input.expiresAt),
+    });
   }
 
-  async findValidResetToken(
-    tokenHash: string,
-  ): Promise<{
+  async findValidResetToken(tokenHash: string): Promise<{
     userId: string;
     expiresAt: string;
     consumedAt: string | null;

package/registry/combos/nestjs-drizzle/shared/src/repositories/session.repository.ts

@@ -8,10 +8,10 @@ import type {
   SessionRecord,
 } from "@/lib/auth/core/types.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import { denylistedAccessTokens, sessions } from "../schema.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 function toSessionRecord(row: typeof sessions.$inferSelect): SessionRecord {
   return {

package/registry/combos/nestjs-drizzle/shared/src/repositories/two-factor.repository.ts

@@ -1,7 +1,7 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { and, eq, isNull } from "drizzle-orm";
 import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import { twoFactorBackupCodes } from "../schema.js";
 
 // Takes bigint directly, not string: every caller already has the user row's id in hand from

package/registry/combos/nestjs-drizzle/shared/src/request-context.ts

@@ -13,7 +13,7 @@
 // authorization was decided, only what it decided — see authz.guard.ts. Importing this module
 // for its side effect installs the Express `Request` augmentation.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
-import type { AppAbility } from "./ability.js";
+import type { AppAbility } from "./ability/ability.js";
 import type { AuthzContext } from "./guards/authz.guard.js";
 
 declare module "express" {

package/registry/combos/nestjs-drizzle/test/bootstrap.ts

@@ -2,7 +2,7 @@ import "reflect-metadata";
 import { Module } from "@nestjs/common";
 import { NestFactory } from "@nestjs/core";
 import { AuthModule } from "../src/auth.module.js";
-import { InMemoryPermissionCacheStore } from "../src/permission-cache.js";
+import { InMemoryPermissionCacheStore } from "../src/cache/permission-cache.js";
 
 // No mailer is wired up for the proof, so this stands in for one — prove-cycle.ts reads the
 // raw token back out of here the same way a test inbox would, to exercise the reset flow.

package/registry/combos/nestjs-drizzle/test/prove-cycle.ts

@@ -11,7 +11,7 @@ import "dotenv/config";
 import { randomUUID } from "node:crypto";
 import { Get } from "@nestjs/common";
 import { generateTotpCode } from "@/lib/auth/core/two-factor.js";
-import { ABILITY_SUBJECT, defineAbilitiesFor } from "../src/ability.js";
+import { ABILITY_SUBJECT, defineAbilitiesFor } from "../src/ability/ability.js";
 import { AuthController } from "../src/controllers/auth.controller.js";
 import { bootstrap, capturedResetTokens } from "./bootstrap.js";
 import {

package/registry/combos/nestjs-drizzle/variants/base/src/auth.module.ts

@@ -2,28 +2,32 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_INTERCEPTOR } from "@nestjs/core";
-import { AbilityGuard } from "./guards/ability.guard.js";
+import { AbilityGuard } from "./ability/ability.guard.js";
 import { AdminController } from "./controllers/admin.controller.js";
 import { AuditLogRepository } from "./repositories/audit-log.repository.js";
 import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
-import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
+import {
+  AUTH_CONFIG,
+  AuthConfig,
+  defaultAuthConfig,
+} from "./config/auth.config.js";
 import { AuthController } from "./controllers/auth.controller.js";
 import { AuthGuard } from "./guards/auth.guard.js";
 import { AuthService } from "./services/auth.service.js";
 import { AuthzGuard } from "./guards/authz.guard.js";
-import { DRIZZLE_DB } from "./db.js";
-import { KeyProviderService } from "./key-provider.js";
+import { DRIZZLE_DB } from "./config/db.js";
+import { KeyProviderService } from "./config/key-provider.js";
 import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
 import {
   InMemoryPermissionCacheStore,
   PERMISSION_CACHE_STORE,
   PermissionCache,
-} from "./permission-cache.js";
+} from "./cache/permission-cache.js";
 import {
   InMemoryRateLimitStore,
   RATE_LIMIT_STORE,
-} from "./rate-limit.store.js";
+} from "./cache/rate-limit.store.js";
 import { RbacRepository } from "./repositories/rbac.repository.js";
 import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";

package/registry/combos/nestjs-drizzle/variants/base/src/controllers/admin.controller.ts

@@ -23,7 +23,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { AuthzGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-drizzle/variants/base/src/guards/authz.guard.ts

@@ -4,8 +4,8 @@ import {
   Inject,
   Injectable,
 } from "@nestjs/common";
-import { defineAbilitiesFor } from "../ability.js";
-import { PermissionCache } from "../permission-cache.js";
+import { defineAbilitiesFor } from "../ability/ability.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import { RbacRepository } from "../repositories/rbac.repository.js";
 
 /**

package/registry/combos/nestjs-drizzle/variants/base/src/index.ts

@@ -0,0 +1,9 @@
+export * from "./auth.module.js";
+
+export * from "./route-tiers.js";
+
+export * from "./guards/auth.guard.js";
+export * from "./guards/authz.guard.js";
+
+export * from "./ability/ability.js";
+export * from "./ability/ability.guard.js";

package/registry/combos/nestjs-drizzle/variants/base/src/rbac.defaults.ts

@@ -22,7 +22,7 @@
 // Callers: `src/seed.ts` (`npm run seed`, the only bootstrap in this variant) and
 // `variants/base/test/variant-hooks.ts`.
 import { inArray } from "drizzle-orm";
-import type { Database } from "./db.js";
+import type { Database } from "./config/db.js";
 import { permissionRole, permissions, roles } from "./schema.js";
 
 /** The display metadata a seeded permission carries. `group`/`order` exist so an admin console can render a stable matrix. */
@@ -44,40 +44,65 @@ export interface PermissionSeed {
  * evaluate.
  */
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List users", description: "GET /auth/admin/users", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock users", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List users",
+    description: "GET /auth/admin/users",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock users",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Edit and delete users",
-    description: "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    description:
+      "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
     group: "Users",
     order: 3,
   },
   "roles:manage": {
     displayName: "Define roles",
-    description: "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
+    description:
+      "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
     group: "Roles",
     order: 1,
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
+    description:
+      "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 } as const satisfies Record<string, PermissionSeed>;
 
 /**
@@ -89,10 +114,14 @@ export const PERMISSION_CATALOG = {
  */
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in the order an admin console should render them. Derived from the catalog so it cannot drift from it. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 /** The display metadata a seeded role carries, plus what it starts out granting. */
 export interface RoleSeed {
@@ -177,12 +206,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
         displayName: PERMISSION_CATALOG[slug].displayName,
         description: PERMISSION_CATALOG[slug].description,
         group: PERMISSION_CATALOG[slug].group,
-        groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+        groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+          PERMISSION_CATALOG[slug].group,
+        ),
         order: PERMISSION_CATALOG[slug].order,
       })),
     )
     .onConflictDoNothing({ target: permissions.slug });
-  const permissionRows = await db.select({ id: permissions.id, slug: permissions.slug }).from(permissions).where(inArray(permissions.slug, PERMISSION_SLUGS));
+  const permissionRows = await db
+    .select({ id: permissions.id, slug: permissions.slug })
+    .from(permissions)
+    .where(inArray(permissions.slug, PERMISSION_SLUGS));
   const permissionId = new Map(permissionRows.map((p) => [p.slug, p.id]));
 
   await db
@@ -210,9 +244,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const pairs = roleRows.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
   if (pairs.length) {
-    await db.insert(permissionRole).values(pairs).onConflictDoNothing({ target: [permissionRole.permissionId, permissionRole.roleId] });
+    await db
+      .insert(permissionRole)
+      .values(pairs)
+      .onConflictDoNothing({
+        target: [permissionRole.permissionId, permissionRole.roleId],
+      });
   }
 }

package/registry/combos/nestjs-drizzle/variants/base/src/repositories/audit-log.repository.ts

@@ -1,15 +1,15 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { and, count, desc, eq, gte, lte, type SQL } from "drizzle-orm";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 import { auditLogs } from "../schema.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/nestjs-drizzle/variants/base/src/repositories/rbac.repository.ts

@@ -15,14 +15,14 @@ import {
   type SQL,
 } from "drizzle-orm";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
-import { PermissionCache } from "../permission-cache.js";
+} from "../helpers/pagination.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import {
   permissionRole,
   permissionUser,
@@ -31,7 +31,7 @@ import {
   roles,
   users,
 } from "../schema.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface UserSummary {
   id: string;