@webjsdev/cli 0.10.17 → 0.10.19

package/lib/saas-template.js

@@ -14,17 +14,19 @@ const UI_REGISTRY_ROOT = resolve(
 );
 
 /**
- * Read a registry component and rewrite its `'../lib/utils.ts'` import for
- * the scaffolded app's `components/ui/<name>.ts` layout (two-up to lib/).
- * Mirrors the helper in `create.js`, kept private here to avoid coupling.
+ * Read a registry component and rewrite its `'#lib/utils.ts'` import for
+ * the scaffolded app's `components/ui/<name>.ts` layout (the `#lib/utils/cn.ts`
+ * alias). Mirrors the helper in `create.js`, kept private here to avoid coupling.
  */
 async function readUiComponent(name) {
   const src = join(UI_REGISTRY_ROOT, 'components', `${name}.ts`);
   if (!existsSync(src)) return null;
   const raw = await readFile(src, 'utf8');
+  // The registry component imports cn() via a relative `../lib/utils.ts`; rewrite
+  // it to the scaffolded app's aliased path (cn lives at lib/utils/cn.ts).
   return raw
-    .replaceAll("'../lib/utils.ts'", "'../../lib/utils.ts'")
-    .replaceAll('"../lib/utils.ts"', '"../../lib/utils.ts"');
+    .replaceAll("'../lib/utils.ts'", "'#lib/utils/cn.ts'")
+    .replaceAll('"../lib/utils.ts"', '"#lib/utils/cn.ts"');
 }
 
 /** Copy named registry components into `<appDir>/components/ui/`. */
@@ -50,16 +52,10 @@ export async function writeSaasFiles(appDir) {
   // the saas auth pages use raw <form> + label/input class helpers instead.
   await copyUiComponents(appDir, ['dialog', 'switch', 'checkbox']);
 
-  // lib/prisma.server.ts
+  // The db/ layer (columns/connection) is written by the full-stack scaffold
+  // already; this template overwrites db/schema.server.ts below to add the
+  // User.passwordHash column auth needs.
   await mkdir(join(appDir, 'lib'), { recursive: true });
-  await writeFile(join(appDir, 'lib', 'prisma.server.ts'), [
-    "import { PrismaClient } from '@prisma/client';",
-    "",
-    "const globalForPrisma = globalThis as unknown as { prisma: PrismaClient };",
-    "export const prisma = globalForPrisma.prisma || new PrismaClient();",
-    "if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;",
-    "",
-  ].join('\n'));
 
   // lib/password.server.ts
   await writeFile(join(appDir, 'lib', 'password.server.ts'), [
@@ -85,14 +81,14 @@ export async function writeSaasFiles(appDir) {
   // lib/auth.server.ts
   await writeFile(join(appDir, 'lib', 'auth.server.ts'), [
     "import { createAuth, Credentials } from '@webjsdev/server';",
-    "import { prisma } from './prisma.server.ts';",
+    "import { db } from '#db/connection.server.ts';",
     "import { compare } from './password.server.ts';",
     "",
     "export const { auth, signIn, signOut, handlers } = createAuth({",
     "  providers: [",
     "    Credentials({",
     "      async authorize(credentials: { email: string; password: string }) {",
-    "        const user = await prisma.user.findUnique({ where: { email: credentials.email } });",
+    "        const user = await db.query.users.findFirst({ where: { email: credentials.email } });",
     "        if (!user || !await compare(credentials.password, user.passwordHash)) return null;",
     "        return { id: String(user.id), name: user.name, email: user.email };",
     "      },",
@@ -103,26 +99,24 @@ export async function writeSaasFiles(appDir) {
     "",
   ].join('\n'));
 
-  // prisma/schema.prisma
-  await mkdir(join(appDir, 'prisma'), { recursive: true });
-  await writeFile(join(appDir, 'prisma', 'schema.prisma'), [
-    'datasource db {',
-    '  provider = "sqlite"',
-    '  url      = env("DATABASE_URL")',
-    '}',
-    '',
-    'generator client {',
-    '  provider = "prisma-client-js"',
-    '}',
-    '',
-    'model User {',
-    '  id           Int      @id @default(autoincrement())',
-    '  email        String   @unique',
-    '  name         String?',
-    '  passwordHash String',
-    '  createdAt    DateTime @default(now())',
-    '}',
-    '',
+  // db/schema.server.ts: overwrite the full-stack scaffold's example User to
+  // add passwordHash (the column auth needs). Drizzle, dialect-agnostic.
+  await writeFile(join(appDir, 'db', 'schema.server.ts'), [
+    "import { defineRelations } from 'drizzle-orm';",
+    "import { table, pk, text, createdAt } from './columns.server.ts';",
+    "",
+    "export const users = table('users', {",
+    "  id: pk(),",
+    "  email: text().notNull().unique(),",
+    "  name: text(),",
+    "  passwordHash: text().notNull(),",
+    "  createdAt: createdAt(),",
+    "});",
+    "",
+    "export const relations = defineRelations({ users }, () => ({}));",
+    "",
+    "export type User = typeof users.$inferSelect;",
+    "",
   ].join('\n'));
 
   // modules/auth/actions/signup.server.ts
@@ -132,15 +126,14 @@ export async function writeSaasFiles(appDir) {
   await writeFile(join(appDir, 'modules', 'auth', 'actions', 'signup.server.ts'), [
     "'use server';",
     "",
-    "import { prisma } from '../../../lib/prisma.server.ts';",
-    "import { hash } from '../../../lib/password.server.ts';",
+    "import { db } from '#db/connection.server.ts';",
+    "import { users } from '#db/schema.server.ts';",
+    "import { hash } from '#lib/password.server.ts';",
     "",
     "export async function signup(input: { name: string; email: string; password: string }) {",
-    "  const exists = await prisma.user.findUnique({ where: { email: input.email } });",
+    "  const exists = await db.query.users.findFirst({ where: { email: input.email }, columns: { id: true } });",
     "  if (exists) return { success: false as const, error: 'Email already registered', status: 409 };",
-    "  const user = await prisma.user.create({",
-    "    data: { name: input.name, email: input.email, passwordHash: await hash(input.password) },",
-    "  });",
+    "  const [user] = await db.insert(users).values({ name: input.name, email: input.email, passwordHash: await hash(input.password) }).returning();",
     "  return { success: true as const, data: { id: user.id, name: user.name, email: user.email } };",
     "}",
     "",
@@ -150,7 +143,7 @@ export async function writeSaasFiles(appDir) {
   await writeFile(join(appDir, 'modules', 'auth', 'queries', 'current-user.server.ts'), [
     "'use server';",
     "",
-    "import { auth } from '../../../lib/auth.server.ts';",
+    "import { auth } from '#lib/auth.server.ts';",
     "",
     "export async function currentUser() {",
     "  const session = await auth();",
@@ -183,11 +176,10 @@ export async function writeSaasFiles(appDir) {
   //   - The protected-route gate (unauthenticated /dashboard -> 302 /login) runs
   //     ALWAYS once the app modules import: auth() only reads a cookie, no DB
   //     query. This is the headline security assertion and it is REAL.
-  //   - The signup -> login -> protected-route flow writes + reads a user, so it
-  //     needs Prisma generated AND migrated (`npm run db:generate` +
-  //     `npm run db:migrate`). When the Prisma client is not yet generated the
-  //     app modules can't import at all, so the whole suite skips with a clear
-  //     message instead of crashing. After you set up the DB it runs for real.
+  //   The signup, login, and protected-route flow writes + reads a user, so it
+  //   needs the DB migrated (`npm run db:generate` then `npm run db:migrate`).
+  //   Until the users table exists those flows error, so the suite skips with a
+  //   clear message instead of crashing. After DB setup it runs for real.
   await mkdir(join(appDir, 'test', 'auth'), { recursive: true });
   await writeFile(join(appDir, 'test', 'auth', 'auth.test.ts'), [
     "import { test } from 'node:test';",
@@ -200,20 +192,20 @@ export async function writeSaasFiles(appDir) {
     "",
     "const appDir = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');",
     "",
-    "// The auth pages + dashboard middleware import lib/prisma.server.ts, which",
-    "// imports @prisma/client. Until `npm run db:generate` (prisma generate) has",
-    "// run, that import is missing, so a request hitting those modules 500s. We",
-    "// detect that at the RESPONSE level (a 5xx on the dashboard) and SKIP with a",
-    "// clear message rather than reporting a misleading failure. After you run",
+    "// The auth pages + dashboard middleware query the users table via Drizzle.",
+    "// Until `npm run db:generate` + `npm run db:migrate` have created it, a",
+    "// request hitting those modules 500s. We detect that at the RESPONSE level",
+    "// (a 5xx on the dashboard) and SKIP with a clear message rather than report",
+    "// a misleading failure. After you run",
     "//   npm install && npm run db:generate && npm run db:migrate",
     "// every assertion below runs for real.",
     "process.env.DATABASE_URL ||= 'file:./dev.db';",
     "process.env.AUTH_SECRET ||= 'test-secret-at-least-32-characters-long!!';",
     "",
     "function makeHandler() {",
-    "  // createRequestHandler builds lazily, so it succeeds even before prisma is",
-    "  // generated; the missing dependency only surfaces when a request reaches",
-    "  // the prisma-importing module. That is why readiness is probed per-response.",
+    "  // createRequestHandler builds lazily, so it succeeds even before the DB",
+    "  // is migrated; the missing table only surfaces when a request reaches a",
+    "  // module that queries it. That is why readiness is probed per-response.",
     "  return createRequestHandler({ appDir, dev: true });",
     "}",
     "",
@@ -273,7 +265,7 @@ export async function writeSaasFiles(appDir) {
   // app/api/auth/[...path]/route.ts
   await mkdir(join(appDir, 'app', 'api', 'auth', '[...path]'), { recursive: true });
   await writeFile(join(appDir, 'app', 'api', 'auth', '[...path]', 'route.ts'), [
-    "import { handlers } from '../../../../lib/auth.server.ts';",
+    "import { handlers } from '#lib/auth.server.ts';",
     "export const GET = handlers.GET;",
     "export const POST = handlers.POST;",
     "",
@@ -283,10 +275,10 @@ export async function writeSaasFiles(appDir) {
   await mkdir(join(appDir, 'app', 'login'), { recursive: true });
   await writeFile(join(appDir, 'app', 'login', 'page.ts'), [
     "import { html } from '@webjsdev/core';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '../../components/ui/card.ts';",
-    "import { buttonClass } from '../../components/ui/button.ts';",
-    "import { inputClass } from '../../components/ui/input.ts';",
-    "import { labelClass } from '../../components/ui/label.ts';",
+    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",
+    "import { buttonClass } from '#components/ui/button.ts';",
+    "import { inputClass } from '#components/ui/input.ts';",
+    "import { labelClass } from '#components/ui/label.ts';",
     "",
     "export const metadata = { title: 'Login' };",
     "",
@@ -325,11 +317,11 @@ export async function writeSaasFiles(appDir) {
   await mkdir(join(appDir, 'app', 'signup'), { recursive: true });
   await writeFile(join(appDir, 'app', 'signup', 'page.ts'), [
     "import { html } from '@webjsdev/core';",
-    "import { signup } from '../../modules/auth/actions/signup.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '../../components/ui/card.ts';",
-    "import { buttonClass } from '../../components/ui/button.ts';",
-    "import { inputClass } from '../../components/ui/input.ts';",
-    "import { labelClass } from '../../components/ui/label.ts';",
+    "import { signup } from '#modules/auth/actions/signup.server.ts';",
+    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",
+    "import { buttonClass } from '#components/ui/button.ts';",
+    "import { inputClass } from '#components/ui/input.ts';",
+    "import { labelClass } from '#components/ui/label.ts';",
     "",
     "export const metadata = { title: 'Sign up' };",
     "",
@@ -397,7 +389,7 @@ export async function writeSaasFiles(appDir) {
   // app/dashboard/middleware.ts
   await mkdir(join(appDir, 'app', 'dashboard', 'settings'), { recursive: true });
   await writeFile(join(appDir, 'app', 'dashboard', 'middleware.ts'), [
-    "import { auth } from '../../lib/auth.server.ts';",
+    "import { auth } from '#lib/auth.server.ts';",
     "",
     "export default async function requireAuth(req: Request, next: () => Promise<Response>) {",
     "  const session = await auth();",
@@ -412,10 +404,10 @@ export async function writeSaasFiles(appDir) {
   // app/dashboard/page.ts
   await writeFile(join(appDir, 'app', 'dashboard', 'page.ts'), [
     "import { html } from '@webjsdev/core';",
-    "import { currentUser } from '../../modules/auth/queries/current-user.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass } from '../../components/ui/card.ts';",
-    "import { buttonClass } from '../../components/ui/button.ts';",
-    "import { badgeClass } from '../../components/ui/badge.ts';",
+    "import { currentUser } from '#modules/auth/queries/current-user.server.ts';",
+    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass } from '#components/ui/card.ts';",
+    "import { buttonClass } from '#components/ui/button.ts';",
+    "import { badgeClass } from '#components/ui/badge.ts';",
     "",
     "export const metadata = { title: 'Dashboard' };",
     "",
@@ -443,8 +435,8 @@ export async function writeSaasFiles(appDir) {
   // app/dashboard/settings/page.ts
   await writeFile(join(appDir, 'app', 'dashboard', 'settings', 'page.ts'), [
     "import { html } from '@webjsdev/core';",
-    "import { currentUser } from '../../../modules/auth/queries/current-user.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass } from '../../../components/ui/card.ts';",
+    "import { currentUser } from '#modules/auth/queries/current-user.server.ts';",
+    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass } from '#components/ui/card.ts';",
     "",
     "export const metadata = { title: 'Settings' };",
     "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.17",
+  "version": "0.10.19",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

package/templates/.agents/rules/workflow.md

@@ -7,10 +7,10 @@ cover what you need, the full hosted docs are at **https://docs.webjs.com**.
 
 ## Persistence + scaffold rules (non-negotiable)
 
-- **Use Prisma + SQLite for data, never JSON files.** It is already wired up
-  (`prisma/schema.prisma`, `lib/prisma.server.ts`, `npm run db:migrate`). For
+- **Use Drizzle + SQLite for data, never JSON files.** It is already wired up
+  (`db/schema.server.ts`, `db/connection.server.ts`, `npm run db:generate` + `npm run db:migrate`). For
   ANY data the app stores (todos, posts, messages, products, comments), define
-  a Prisma model. NEVER create `data/*.json`, `db.json`, or any JSON file as a
+  a Drizzle table. NEVER create `data/*.json`, `db.json`, or any JSON file as a
   fake database. NEVER use module-scope arrays / Maps as a substitute. NEVER
   use localStorage for app data. These are project conventions in
   CONVENTIONS.md (a JSON file used as a database resets on reload and
@@ -131,12 +131,12 @@ self-review loop.
 - Custom-element tag names are passed to `.register('tag-name')`. They are NOT
   a static field on the class.
 - One function per server action file (`*.server.ts`).
-- Server-only code (`@prisma/client`, `node:*`, anything that needs Node APIs)
+- Server-only code (a DB driver like `better-sqlite3`/`pg`, `node:*`, anything that needs Node APIs)
   goes only in `.server.{js,ts}` files, `route.ts` handlers, or
   `middleware.ts`. Never in pages, layouts, or components. Wrap the access in
   a `.server.{js,ts}` file; the framework rewrites that import into an RPC
   stub for the browser. `lib/` holds both server-only infra
-  (`lib/prisma.server.ts`) and browser-safe utilities (`lib/utils/cn.ts` with
+  (the DB in `db/*.server.ts`) and browser-safe utilities (`lib/utils/cn.ts` with
   `cn`); follow the same rule per file.
 - Directives are deliberately minimal: only `unsafeHTML`, `live`, and `repeat`
   ship. Use plain template-literal expressions

package/templates/.env.example

@@ -23,5 +23,5 @@ AUTH_SECRET=
 # REDIS_URL=redis://localhost:6379
 
 # ── Database ────────────────────────────────────────────────────────
-# Used by Prisma. SQLite for dev, PostgreSQL/MySQL for production.
-DATABASE_URL=file:./dev.db
+# Used by Drizzle. SQLite for dev, PostgreSQL for production (--db postgres).
+DATABASE_URL=file:./db/dev.db

package/templates/.github/copilot-instructions.md

@@ -7,10 +7,10 @@ the full hosted docs are at **https://docs.webjs.com**.
 
 ## Persistence + scaffold rules (non-negotiable)
 
-- **Use Prisma + SQLite for data, never JSON files.** It's already wired up
-  (`prisma/schema.prisma`, `lib/prisma.server.ts`, `npm run db:migrate`). For ANY
+- **Use Drizzle + SQLite for data, never JSON files.** It's already wired up
+  (`db/schema.server.ts`, `db/connection.server.ts`, `npm run db:generate` + `npm run db:migrate`). For ANY
   data the app stores (todos, posts, messages, products, comments…),
-  define a Prisma model. NEVER create `data/*.json`, `db.json`, or any
+  define a Drizzle table. NEVER create `data/*.json`, `db.json`, or any
   JSON file as a fake database. NEVER use module-scope arrays / Maps as
   a substitute. NEVER use localStorage for app data. It resets on reload and cannot scale. This is a project convention
   (CONVENTIONS.md).
@@ -104,7 +104,7 @@ each change must include.
 - Components: extend WebComponent, declare `static properties` (and `static styles` for shadow-DOM components), call `Class.register('tag-name')` at the bottom of the file. The tag name is the argument to `.register()`, not a static field.
 - Async data in a component: prefer an `async render()` (`const u = await getUser(this.uid)`), which SSR awaits so the data is in the first paint, over prop-drilling from the page or fetching in `connectedCallback`. `renderFallback()` is the optional re-fetch loading state (never first paint); error isolation is automatic (`renderError()` customizes it); a `Task` is for genuinely client-only data.
 - Server actions: *.server.ts files with one exported async function each.
-- Server-only code (@prisma/client, node:*, anything needing Node APIs) goes only in .server.{js,ts} files, route.ts handlers, or middleware.ts. Never in pages, layouts, or components. Wrap in a .server.{js,ts} file; the framework rewrites that import to an RPC stub for the browser. lib/ holds both server-only infra (lib/prisma.server.ts) and browser-safe utilities (lib/utils/cn.ts with cn); apply the same rule per file.
+- Server-only code (a DB driver like better-sqlite3/pg, node:*, anything needing Node APIs) goes only in .server.{js,ts} files, route.ts handlers, or middleware.ts. Never in pages, layouts, or components. Wrap in a .server.{js,ts} file; the framework rewrites that import to an RPC stub for the browser. The DB lives in db/*.server.ts; lib/ holds other server-only infra and browser-safe utilities (lib/utils/cn.ts with cn); apply the same rule per file.
 - Directives: webjs ships only `unsafeHTML`, `live`, and `repeat`. Lit's `classMap` / `styleMap` / `ref` / `when` / `choose` / `guard` are NOT exported. Use plain template-literal expressions and lifecycle hooks instead.
 - Context: import { createContext, ContextProvider, ContextConsumer } from '@webjsdev/core/context'
 - Task: import { Task, TaskStatus } from '@webjsdev/core/task'

package/templates/.github/workflows/ci.yml

@@ -45,9 +45,8 @@ jobs:
           node-version: '24'
           cache: npm
       - run: npm ci
-      - run: npx prisma generate
-      - name: Apply migrations to the test database
-        run: npx prisma migrate deploy
+      - name: Set up the database (generate + apply migrations)
+        run: npm run db:generate && npm run db:migrate
         env:
           DATABASE_URL: file:./ci.db
       # --server keeps this job to node:test (the browser layer is its own
@@ -66,7 +65,6 @@ jobs:
           node-version: '24'
           cache: npm
       - run: npm ci
-      - run: npx prisma generate
       - name: Install Playwright Chromium
         run: npx playwright install --with-deps chromium
       - run: npm run test:browser
@@ -81,9 +79,8 @@ jobs:
           node-version: '24'
           cache: npm
       - run: npm ci
-      - run: npx prisma generate
-      - name: Apply migrations to the test database
-        run: npx prisma migrate deploy
+      - name: Set up the database (generate + apply migrations)
+        run: npm run db:generate && npm run db:migrate
         env:
           DATABASE_URL: file:./ci.db
       # The scaffold's e2e test (test/hello/e2e/) drives a real browser