@tulip-systems/create-app 0.12.4 → 0.13.0

package/dist/templates/code/src/app/auth/layout.tsx

@@ -6,7 +6,7 @@ import {
   AuthLayoutImageFooter,
   AuthLayoutImageHeader,
 } from "@tulip-systems/auth/components";
-import Link from "next/link";
+import { Link } from "@tulip-systems/core/navigation";
 import type { PropsWithChildren } from "react";
 import { config } from "@/lib/config/base";
 import { authClient } from "@/server/auth/client";

package/dist/templates/code/src/app/auth/reset-password/page.tsx

@@ -10,8 +10,8 @@ import {
   ResetPasswordTitle,
   ResetPasswordView,
 } from "@tulip-systems/auth/components/client";
+import { Link } from "@tulip-systems/core/navigation";
 import type { Metadata } from "next";
-import Link from "next/link";
 import { Suspense } from "react";
 
 export const metadata: Metadata = {

package/dist/templates/code/src/app/layout.tsx

@@ -2,26 +2,38 @@ import "./globals.css";
 import "../server/router/register";
 
 import { ColorThemeProvider, Providers } from "@tulip-systems/app/components/client";
-import {
-  ColorThemeScript,
-  generateRootLayoutMetadata,
-  RootLayout,
-} from "@tulip-systems/app/components/server";
+import { registerFonts, rootLayoutViewport } from "@tulip-systems/app/components/server";
 import { DriveViewScript } from "@tulip-systems/drive/server";
+import { cn } from "@tulip-systems/ui/cn";
+import type { Metadata } from "next";
 import type { PropsWithChildren } from "react";
 import { config } from "@/lib/config/base";
 
-export const { metadata, viewport } = generateRootLayoutMetadata(config);
+export const viewport = rootLayoutViewport;
+
+export const metadata: Metadata = {
+  description: "Developed by NewCode",
+  appleWebApp: {
+    capable: true,
+    statusBarStyle: "black-translucent",
+    title: config.general.name,
+  },
+};
+
+const colorTheme = "sage";
 
 export default function Layout({ children }: PropsWithChildren) {
   return (
-    <RootLayout>
-      <ColorThemeScript />
-      <DriveViewScript />
+    <html lang="nl" suppressHydrationWarning data-theme={colorTheme}>
+      <title>{config.general.name}</title>
+
+      <body className={cn("bg-background font-sans antialiased", registerFonts())}>
+        <DriveViewScript />
 
-      <ColorThemeProvider defaultTheme="tulip">
-        <Providers>{children}</Providers>
-      </ColorThemeProvider>
-    </RootLayout>
+        <ColorThemeProvider theme={colorTheme}>
+          <Providers>{children}</Providers>
+        </ColorThemeProvider>
+      </body>
+    </html>
   );
 }

package/dist/templates/code/src/env.ts

@@ -11,6 +11,16 @@ export const env = createEnv({
     S3_ENDPOINT: z.string().min(1),
     S3_ACCESS_KEY_ID: z.string().min(1),
     S3_SECRET_ACCESS_KEY: z.string().min(1),
+    QSTASH_URL: z.string().min(1),
+    QSTASH_TOKEN: z.string().min(1),
+    QSTASH_CURRENT_SIGNING_KEY: z.string().min(1),
+    QSTASH_NEXT_SIGNING_KEY: z.string().min(1),
+    QSTASH_DEV: z
+      .enum(["true", "false"])
+      .transform((value) => value === "true")
+      .optional(),
+    WEB_PUSH_PRIVATE_KEY: z.string().min(1).optional(),
+    WEB_PUSH_SUBJECT: z.string().min(1).optional(),
     GOOGLE_SERVICE_ACCOUNT_EMAIL: z.string().min(1),
     GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY: z
       .string()
@@ -19,8 +29,10 @@ export const env = createEnv({
   },
   client: {
     NEXT_PUBLIC_HOST: z.string().min(1),
+    NEXT_PUBLIC_WEB_PUSH_PUBLIC_KEY: z.string().min(1).optional(),
   },
   experimental__runtimeEnv: {
     NEXT_PUBLIC_HOST: process.env.NEXT_PUBLIC_HOST ?? process.env.NEXT_PUBLIC_VERCEL_BRANCH_URL,
+    NEXT_PUBLIC_WEB_PUSH_PUBLIC_KEY: process.env.NEXT_PUBLIC_WEB_PUSH_PUBLIC_KEY,
   },
 });

package/dist/templates/code/src/lib/config/paths.tsx

@@ -11,6 +11,7 @@ import {
 } from "@tulip-systems/app/components/client";
 import { Sidebar, SidebarContent, SidebarHeader, SidebarRail } from "@tulip-systems/ui/sidebar";
 import {
+  BellIcon,
   BotIcon,
   FoldersIcon,
   HomeIcon,
@@ -48,6 +49,13 @@ export function AdminSidebar() {
               </PathLink>
             </Path>
 
+            <Path segment="notifications">
+              <PathLink href="/admin/notifications">
+                <BellIcon />
+                Notifications
+              </PathLink>
+            </Path>
+
             <Path permission={{ drive: ["view"] }} segment="drive">
               <PathLink href="/admin/drive">
                 <FoldersIcon />

package/dist/templates/code/src/server/auth/constants.ts

@@ -10,7 +10,7 @@ export const OAUTH_SCOPES = ["openid", "profile", "email", "offline_access", "mc
 /**
  * This constant defines the audience URLs for the OAuth protected resource.
  */
-export const OAUTH_AUDIENCES = [url("/api/mcp")];
+export const OAUTH_AUDIENCE = url("/api/mcp");
 /**
  * This constant defines the issuer URLs for the OAuth authorization server.
  */

package/dist/templates/code/src/server/auth/init.ts

@@ -1,4 +1,6 @@
-import { oauthProvider } from "@better-auth/oauth-provider";
+import { cimd } from "@better-auth/cimd";
+import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+import { mcp } from "@better-auth/mcp";
 import { passkey } from "@better-auth/passkey";
 import { authAdditionalFields, authCookiePrefix } from "@tulip-systems/auth";
 import { ForgetPasswordEmail } from "@tulip-systems/auth/react-email";
@@ -9,7 +11,7 @@ import { admin, emailOTP, jwt } from "better-auth/plugins";
 import { config } from "@/lib/config/base";
 import { db } from "../db/init";
 import { email } from "../emails/init";
-import { OAUTH_AUDIENCES, OAUTH_SCOPES } from "./constants";
+import { OAUTH_AUDIENCE, OAUTH_SCOPES } from "./constants";
 import { ac, roles } from "./permissions";
 
 export const auth = betterAuth({
@@ -23,7 +25,8 @@ export const auth = betterAuth({
       "*.tulip.systems",
       "*.vercel.app",
       "*.localhost:*",
-      "localhost:7459",
+      "*.localhost",
+      "localhost:*",
     ],
   },
   database: drizzleAdapter(db, {
@@ -63,15 +66,19 @@ export const auth = betterAuth({
       },
     }),
     jwt(),
-    oauthProvider({
+    mcp({
       loginPage: "/auth/login",
       consentPage: "/auth/consent",
+      resource: OAUTH_AUDIENCE,
       scopes: [...OAUTH_SCOPES],
-      validAudiences: [...OAUTH_AUDIENCES],
       allowDynamicClientRegistration: true,
       allowUnauthenticatedClientRegistration: true,
       clientRegistrationDefaultScopes: [...OAUTH_SCOPES],
     }),
+    cimd({
+      fetchClientMetadataResource,
+      metadataProfile: "mcp-2026-07-28",
+    }),
   ],
 });
 

package/dist/templates/code/src/server/auth/permissions.ts

@@ -4,6 +4,7 @@ import { adminAc, createAccessControl, createStatements } from "@tulip-systems/a
  * Statements
  */
 const statement = createStatements({
+  history: ["view"],
   developer: ["debug"],
   dashboard: ["view.budget"],
   drive: ["view", "create", "update", "archive", "delete"],
@@ -27,6 +28,7 @@ export const ac = createAccessControl(statement);
  * Admin role
  */
 const developer = ac.newRole({
+  history: ["view"],
   developer: ["debug"],
   dashboard: ["view.budget"],
   drive: ["view", "create", "update", "archive", "delete"],
@@ -46,6 +48,7 @@ const developer = ac.newRole({
  * Owner role
  */
 const admin = ac.newRole({
+  history: ["view"],
   dashboard: ["view.budget"],
   drive: ["view", "create", "update", "archive", "delete"],
   prospect: ["view", "create", "update", "archive", "delete"],

package/dist/templates/code/src/server/auth/schema.ts

@@ -1,5 +1,5 @@
 import { relations, type SQL, sql } from "drizzle-orm";
-import { index, pgTable } from "drizzle-orm/pg-core";
+import { index, pgTable, uniqueIndex } from "drizzle-orm/pg-core";
 import { baseColumns } from "@/server/db/helpers";
 
 /**
@@ -130,6 +130,8 @@ const jwkss = pgTable("jwkss", (t) => ({
   publicKey: t.text().notNull(),
   privateKey: t.text().notNull(),
   expiresAt: t.timestamp(),
+  alg: t.text(),
+  crv: t.text(),
 }));
 
 /**
@@ -141,11 +143,13 @@ const oauthClients = pgTable(
     ...baseColumns,
     clientId: t.text().notNull().unique(),
     clientSecret: t.text(),
+    clientDiscoveryId: t.text(),
     disabled: t.boolean().default(false),
     skipConsent: t.boolean(),
     enableEndSession: t.boolean(),
     subjectType: t.text(),
     scopes: t.text().array(),
+    clientCredentialsScopes: t.text().array().default([]),
     userId: t.uuid().references(() => users.id, { onDelete: "cascade" }),
     createdAt: t.timestamp(),
     updatedAt: t.timestamp(),
@@ -160,12 +164,18 @@ const oauthClients = pgTable(
     softwareStatement: t.text(),
     redirectUris: t.text().array().notNull(),
     postLogoutRedirectUris: t.text().array(),
+    backchannelLogoutUri: t.text(),
+    backchannelLogoutSessionRequired: t.boolean(),
     tokenEndpointAuthMethod: t.text(),
+    applicationType: t.text(),
+    jwks: t.text(),
+    jwksUri: t.text(),
     grantTypes: t.text().array(),
     responseTypes: t.text().array(),
     public: t.boolean(),
     type: t.text(),
     requirePKCE: t.boolean(),
+    dpopBoundAccessTokens: t.boolean().default(false),
     referenceId: t.text(),
     metadata: t.jsonb(),
   }),
@@ -180,6 +190,68 @@ const oauthClientsRelations = relations(oauthClients, ({ one, many }) => ({
   oauthRefreshTokens: many(oauthRefreshTokens),
   oauthAccessTokens: many(oauthAccessTokens),
   oauthConsents: many(oauthConsents),
+  oauthClientResources: many(oauthClientResources),
+}));
+
+/**
+ * The oauthResources table stores protected resource identifiers and per-resource token policy.
+ */
+const oauthResources = pgTable("oauth_resources", (t) => ({
+  ...baseColumns,
+  identifier: t.text().notNull().unique(),
+  name: t.text().notNull(),
+  accessTokenTtl: t.integer(),
+  refreshTokenTtl: t.integer(),
+  signingAlgorithm: t.text(),
+  signingKeyId: t.text(),
+  allowedScopes: t.text().array(),
+  customClaims: t.jsonb(),
+  dpopBoundAccessTokensRequired: t.boolean().default(false),
+  disabled: t.boolean().default(false),
+  policyVersion: t.integer().default(1),
+  metadata: t.jsonb(),
+}));
+
+const oauthResourcesRelations = relations(oauthResources, ({ many }) => ({
+  oauthClientResources: many(oauthClientResources),
+}));
+
+/**
+ * The oauthClientResources table links OAuth clients to protected resources.
+ */
+const oauthClientResources = pgTable(
+  "oauth_client_resources",
+  (t) => ({
+    ...baseColumns,
+    clientId: t
+      .text()
+      .notNull()
+      .references(() => oauthClients.clientId, { onDelete: "cascade" }),
+    resourceId: t
+      .text()
+      .notNull()
+      .references(() => oauthResources.identifier, { onDelete: "cascade" }),
+    metadata: t.jsonb(),
+  }),
+  (table) => [
+    index("oauthClientResources_clientId_idx").on(table.clientId),
+    index("oauthClientResources_resourceId_idx").on(table.resourceId),
+    uniqueIndex("oauthClientResources_clientId_resourceId_idx").on(
+      table.clientId,
+      table.resourceId,
+    ),
+  ],
+);
+
+const oauthClientResourcesRelations = relations(oauthClientResources, ({ one }) => ({
+  oauthClients: one(oauthClients, {
+    fields: [oauthClientResources.clientId],
+    references: [oauthClients.clientId],
+  }),
+  oauthResources: one(oauthResources, {
+    fields: [oauthClientResources.resourceId],
+    references: [oauthResources.identifier],
+  }),
 }));
 
 /**
@@ -200,9 +272,16 @@ const oauthRefreshTokens = pgTable(
       .notNull()
       .references(() => users.id, { onDelete: "cascade" }),
     referenceId: t.text(),
+    authorizationCodeId: t.text(),
+    resources: t.text().array(),
+    requestedUserInfoClaims: t.text().array(),
     expiresAt: t.timestamp().notNull(),
     revoked: t.timestamp(),
+    rotatedAt: t.timestamp(),
+    rotationReplayResponse: t.text(),
+    rotationReplayExpiresAt: t.timestamp(),
     authTime: t.timestamp(),
+    confirmation: t.jsonb(),
     scopes: t.text().array().notNull(),
   }),
   (table) => [
@@ -243,8 +322,13 @@ const oauthAccessTokens = pgTable(
     sessionId: t.uuid().references(() => sessions.id, { onDelete: "set null" }),
     userId: t.uuid().references(() => users.id, { onDelete: "cascade" }),
     referenceId: t.text(),
+    authorizationCodeId: t.text(),
+    resources: t.text().array(),
+    requestedUserInfoClaims: t.text().array(),
     refreshId: t.uuid().references(() => oauthRefreshTokens.id, { onDelete: "cascade" }),
     expiresAt: t.timestamp().notNull(),
+    revoked: t.timestamp(),
+    confirmation: t.jsonb(),
     scopes: t.text().array().notNull(),
   }),
   (table) => [
@@ -286,6 +370,8 @@ const oauthConsents = pgTable(
       .references(() => oauthClients.clientId, { onDelete: "cascade" }),
     userId: t.uuid().references(() => users.id, { onDelete: "cascade" }),
     referenceId: t.text(),
+    resources: t.text().array(),
+    requestedUserInfoClaims: t.text().array(),
     scopes: t.text().array().notNull(),
   }),
   (table) => [
@@ -305,6 +391,14 @@ const oauthConsentsRelations = relations(oauthConsents, ({ one }) => ({
   }),
 }));
 
+/**
+ * The oauthClientAssertions table stores used client assertion identifiers until they expire.
+ */
+const oauthClientAssertions = pgTable("oauth_client_assertions", (t) => ({
+  ...baseColumns,
+  expiresAt: t.timestamp().notNull(),
+}));
+
 /**
  * Exports
  */
@@ -312,10 +406,15 @@ export {
   jwkss,
   oauthAccessTokens,
   oauthAccessTokensRelations,
+  oauthClientAssertions,
+  oauthClientResources,
+  oauthClientResourcesRelations,
   oauthClients,
   oauthClientsRelations,
   oauthConsents,
   oauthConsentsRelations,
   oauthRefreshTokens,
   oauthRefreshTokensRelations,
+  oauthResources,
+  oauthResourcesRelations,
 };

package/dist/templates/code/src/server/db/schema.ts

@@ -12,8 +12,11 @@ export * from "@/app/admin/customers/_lib/schema";
 export * from "@/app/admin/domains/_lib/schema";
 export * from "@/app/admin/employees/_lib/schema";
 export * from "@/app/admin/initiatives/_lib/schema";
+export * from "@/app/admin/notifications/_lib/schema";
 export * from "@/app/admin/projects/_lib/schema";
+export * from "@/app/admin/queue/_lib/schema";
 export * from "@/app/admin/quotations/_lib/schema";
 export * from "@/app/admin/tasks/_lib/schema";
 export * from "@/app/admin/time/_lib/schema";
 export * from "@/app/admin/prospects/_lib/schema";
+export * from "@/app/admin/history/_lib/schema";

package/dist/templates/code/src/server/events/handlers.ts

@@ -0,0 +1,17 @@
+import "server-cli-only";
+
+import { createEventDispatchHandler, defineEventDispatchTask } from "@tulip-systems/events/queue";
+import { appEventListeners } from "./listeners";
+
+/**
+ * Event dispatch task for the application.
+ */
+export const eventDispatchTask = defineEventDispatchTask("events.dispatch");
+
+/**
+ * Event dispatch task handler for the application.
+ */
+export const eventDispatchTaskHandler = eventDispatchTask.handle(
+  "dispatch-event-listener",
+  createEventDispatchHandler({ listeners: appEventListeners }),
+);

package/dist/templates/code/src/server/events/init.ts

@@ -0,0 +1,18 @@
+import "server-cli-only";
+
+import { queueEventAdapter } from "@tulip-systems/events/queue";
+import { EventBus } from "@tulip-systems/events/server";
+import { queue } from "@/server/queue/init";
+import { eventDispatchTask } from "./handlers";
+import { appEventListeners } from "./listeners";
+
+/**
+ * Initializes the event bus for the application.
+ */
+export const events = EventBus.init({
+  listeners: appEventListeners,
+  adapter: queueEventAdapter({
+    queue,
+    task: eventDispatchTask,
+  }),
+});

package/dist/templates/code/src/server/events/listeners.ts

@@ -0,0 +1,17 @@
+import "server-cli-only";
+
+import { createEventListeners } from "@tulip-systems/events";
+import { notificationEventListeners } from "@/app/admin/notifications/_lib/listeners.server";
+import { projectHistoryEventListeners } from "@/app/admin/projects/_lib/listeners.server";
+import { taskHistoryEventListeners } from "@/app/admin/tasks/_lib/listeners.server";
+
+/**
+ * Event listeners
+ */
+export const appEventListeners = createEventListeners({
+  notifications: notificationEventListeners,
+  history: {
+    ...projectHistoryEventListeners,
+    ...taskHistoryEventListeners,
+  },
+});

package/dist/templates/code/src/server/queue/handlers.ts

@@ -0,0 +1,5 @@
+import { createQueueHandlers } from "@tulip-systems/queue";
+import { queueLogTaskHandler } from "@/app/admin/queue/_lib/queue";
+import { eventDispatchTaskHandler } from "@/server/events/handlers";
+
+export const queueHandlers = createQueueHandlers([queueLogTaskHandler, eventDispatchTaskHandler]);

package/dist/templates/code/src/server/queue/init.ts

@@ -0,0 +1,16 @@
+import { url } from "@tulip-systems/core";
+import { qstashAdapter } from "@tulip-systems/queue/qstash";
+import { Queue } from "@tulip-systems/queue/server";
+import { env } from "@/env";
+
+export const queue = Queue.init({
+  adapter: qstashAdapter({
+    baseUrl: env.QSTASH_URL,
+    token: env.QSTASH_TOKEN,
+    endpoint: url("/api/queue/dispatch"),
+    currentSigningKey: env.QSTASH_CURRENT_SIGNING_KEY,
+    nextSigningKey: env.QSTASH_NEXT_SIGNING_KEY,
+    label: "tulip-demo-code",
+    devMode: env.QSTASH_DEV,
+  }),
+});

package/dist/templates/code/src/server/router/router.ts

@@ -1,6 +1,9 @@
 import { type InferRouterInputs, type InferRouterOutputs, lazy } from "@orpc/server";
 
 export const appRouter = {
+  history: lazy(() =>
+    import("@/app/admin/history/_lib/router").then((module) => ({ default: module.historyRouter })),
+  ),
   assistant: lazy(() =>
     import("@/app/admin/assistant/_lib/router").then((module) => ({
       default: module.assistantRouter,
@@ -41,6 +44,16 @@ export const appRouter = {
       default: module.projectsRouter,
     })),
   ),
+  notifications: lazy(() =>
+    import("@/app/admin/notifications/_lib/router").then((module) => ({
+      default: module.notificationsRouter,
+    })),
+  ),
+  queue: lazy(() =>
+    import("@/app/admin/queue/_lib/router").then((module) => ({
+      default: module.queueRouter,
+    })),
+  ),
   timeEntries: lazy(() =>
     import("@/app/admin/time/_lib/router").then((module) => ({
       default: module.timeEntriesRouter,