@webjsdev/cli 0.10.43 → 0.10.45

package/lib/saas-template.js

@@ -1,568 +0,0 @@
-/**
- * SaaS template files for `webjs create --template saas`.
- * Extracted to avoid nested template literal escaping issues.
- */
-
-import { mkdir, writeFile, readFile } from 'node:fs/promises';
-import { bunifyProse } from './runtime-rewrite.js';
-import { leanComponentSource } from './lean-copy.js';
-import { existsSync } from 'node:fs';
-import { join, resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const UI_REGISTRY_ROOT = resolve(
-  __dirname, '..', '..', 'ui', 'packages', 'registry',
-);
-
-/**
- * Read a registry component and rewrite its `'#lib/utils.ts'` import for
- * the scaffolded app's `components/ui/<name>.ts` layout (the `#lib/utils/cn.ts`
- * alias). Mirrors the helper in `create.js`, kept private here to avoid coupling.
- */
-async function readUiComponent(name) {
-  const src = join(UI_REGISTRY_ROOT, 'components', `${name}.ts`);
-  if (!existsSync(src)) return null;
-  const raw = await readFile(src, 'utf8');
-  // The registry component imports cn() via a relative `../lib/utils.ts`; rewrite
-  // it to the scaffolded app's aliased path (cn lives at lib/utils/cn.ts).
-  const rewritten = raw
-    .replaceAll("'../lib/utils.ts'", "'#lib/utils/cn.ts'")
-    .replaceAll('"../lib/utils.ts"', '"#lib/utils/cn.ts"')
-    // onBeforeCache lives in its own client-only module so cn() stays pure (#819).
-    // Without this rewrite dialog.ts keeps the registry-relative `../lib/dom.ts`
-    // (which resolves to a nonexistent components/lib/dom.ts) and fails typecheck.
-    .replaceAll("'../lib/dom.ts'", "'#lib/utils/dom.ts'")
-    .replaceAll('"../lib/dom.ts"', '"#lib/utils/dom.ts"');
-  // Strip a Tier-1 helper's worked @example (same as create.js + `webjs ui add`)
-  // so switch / checkbox are lean, not just the full-stack base set (#983).
-  return leanComponentSource(rewritten, name);
-}
-
-/** Copy named registry components into `<appDir>/components/ui/`. */
-async function copyUiComponents(appDir, names) {
-  const uiDir = join(appDir, 'components', 'ui');
-  await mkdir(uiDir, { recursive: true });
-  for (const n of names) {
-    const content = await readUiComponent(n);
-    if (content == null) continue;
-    await writeFile(join(uiDir, `${n}.ts`), content);
-  }
-}
-
-/**
- * @param {string} appDir
- * @param {{ runtime?: 'node'|'bun' }} [opts]
- */
-export async function writeSaasFiles(appDir, opts = {}) {
-  const isBun = opts.runtime === 'bun';
-  // SaaS pages use auth forms, so copy the extra ui-* components on top of
-  // the standard set the full-stack scaffold already wrote. Pre-importing
-  // them in login/signup/dashboard pages below means the dev server will
-  // SSR these elements with full styling on first paint.
-  // `form` and `field` are deferred to v2 (see packages/ui/AGENTS.md) -
-  // the saas auth pages use raw <form> + label/input class helpers instead.
-  await copyUiComponents(appDir, ['dialog', 'switch', 'checkbox']);
-
-  // The db/ layer (columns/connection) is written by the full-stack scaffold
-  // already; this template overwrites db/schema.server.ts below to add the
-  // User.passwordHash column auth needs.
-  await mkdir(join(appDir, 'lib'), { recursive: true });
-
-  // lib/password.server.ts
-  await writeFile(join(appDir, 'lib', 'password.server.ts'), [
-    "import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';",
-    "import { promisify } from 'node:util';",
-    "",
-    "const scryptAsync = promisify(scrypt);",
-    "",
-    "export async function hash(password: string): Promise<string> {",
-    "  const salt = randomBytes(16).toString('hex');",
-    "  const buf = (await scryptAsync(password, salt, 64)) as Buffer;",
-    "  return salt + ':' + buf.toString('hex');",
-    "}",
-    "",
-    "export async function compare(password: string, stored: string): Promise<boolean> {",
-    "  const [salt, key] = stored.split(':');",
-    "  const buf = (await scryptAsync(password, salt, 64)) as Buffer;",
-    "  return timingSafeEqual(buf, Buffer.from(key, 'hex'));",
-    "}",
-    "",
-  ].join('\n'));
-
-  // lib/auth.server.ts
-  await writeFile(join(appDir, 'lib', 'auth.server.ts'), [
-    "import { createAuth, Credentials, GitHub, Google } from '@webjsdev/server';",
-    "import { db } from '#db/connection.server.ts';",
-    "import { compare } from './password.server.ts';",
-    "",
-    "// AUTH_SECRET signs session tokens. Set a strong value in .env for any real",
-    "// deployment. The dev fallback keeps a fresh scaffold booting, but is NOT",
-    "// safe for production, so we fail fast if it is missing or blank there.",
-    "const trimmedSecret = process.env.AUTH_SECRET?.trim();",
-    "if (process.env.NODE_ENV === 'production' && !trimmedSecret) {",
-    "  throw new Error('AUTH_SECRET must be set in production');",
-    "}",
-    "const authSecret = trimmedSecret || 'dev-insecure-secret-change-me';",
-    "",
-    "export const { auth, signIn, signOut, handlers } = createAuth({",
-    "  providers: [",
-    "    Credentials({",
-    "      async authorize(credentials: { email: string; password: string }) {",
-    "        const user = await db.query.users.findFirst({ where: { email: credentials.email } });",
-    "        if (!user || !await compare(credentials.password, user.passwordHash)) return null;",
-    "        return { id: String(user.id), name: user.name, email: user.email };",
-    "      },",
-    "    }),",
-    "    // OAuth providers: add GitHub / Google sign-in by setting the matching",
-    "    // env vars. Each preset (GitHub(), Google()) reads AUTH_<PROVIDER>_ID /",
-    "    // _SECRET, so they only activate once configured and a fresh scaffold",
-    "    // still boots with just Credentials.",
-    "    ...(process.env.AUTH_GITHUB_ID ? [GitHub({ clientId: process.env.AUTH_GITHUB_ID, clientSecret: process.env.AUTH_GITHUB_SECRET })] : []),",
-    "    ...(process.env.AUTH_GOOGLE_ID ? [Google({ clientId: process.env.AUTH_GOOGLE_ID, clientSecret: process.env.AUTH_GOOGLE_SECRET })] : []),",
-    "  ],",
-    "  secret: authSecret,",
-    "  // A failed credentials sign-in 302s to `${pages.error}?error=CredentialsSignin`.",
-    "  // Point it at /login so app/login/page.ts reads searchParams.error and shows a",
-    "  // message, instead of the createAuth default (the home page) swallowing the error.",
-    "  pages: { error: '/login' },",
-    "});",
-    "",
-  ].join('\n'));
-
-  // db/schema.server.ts: overwrite the full-stack scaffold's example User to
-  // add passwordHash (the column auth needs). Drizzle, dialect-agnostic.
-  await writeFile(join(appDir, 'db', 'schema.server.ts'), [
-    "import { defineRelations } from 'drizzle-orm';",
-    "import { table, pk, uuidPk, text, bool, createdAt } from './columns.server.ts';",
-    "",
-    "export const users = table('users', {",
-    "  id: pk(),",
-    "  email: text().notNull().unique(),",
-    "  name: text(),",
-    "  passwordHash: text().notNull(),",
-    "  createdAt: createdAt(),",
-    "});",
-    "",
-    "// Backs the example-gallery /examples/todo route (modules/todo). Delete it",
-    "// with the gallery when you prune the examples you do not use.",
-    "export const todos = table('todos', {",
-    "  id: uuidPk(),",
-    "  title: text().notNull(),",
-    "  completed: bool().notNull().default(false),",
-    "  createdAt: createdAt(),",
-    "});",
-    "",
-    "export const relations = defineRelations({ users, todos }, () => ({}));",
-    "",
-    "export type User = typeof users.$inferSelect;",
-    "",
-  ].join('\n'));
-
-  // modules/auth/actions/signup.server.ts
-  await mkdir(join(appDir, 'modules', 'auth', 'actions'), { recursive: true });
-  await mkdir(join(appDir, 'modules', 'auth', 'queries'), { recursive: true });
-
-  await writeFile(join(appDir, 'modules', 'auth', 'actions', 'signup.server.ts'), [
-    "'use server';",
-    "",
-    "import { db } from '#db/connection.server.ts';",
-    "import { users } from '#db/schema.server.ts';",
-    "import { hash } from '#lib/password.server.ts';",
-    "import { signIn } from '#lib/auth.server.ts';",
-    "",
-    "// Creates the account, then signs the new user in and lands on the",
-    "// dashboard. signIn returns a 302 Response carrying the session cookie; the",
-    "// signup page action returns that Response as-is (a page action may return a",
-    "// Response). signIn lives in the server-only auth module, imported here",
-    "// server-to-server, so it never reaches the browser (the signup page only",
-    "// imports this action's RPC stub).",
-    "export async function signup(input: { name: string; email: string; password: string }) {",
-    "  const exists = await db.query.users.findFirst({ where: { email: input.email }, columns: { id: true } });",
-    "  if (exists) return { success: false as const, error: 'Email already registered', status: 409 };",
-    "  await db.insert(users).values({ name: input.name, email: input.email, passwordHash: await hash(input.password) });",
-    "  return signIn('credentials', { email: input.email, password: input.password }, { redirectTo: '/dashboard' });",
-    "}",
-    "",
-  ].join('\n'));
-
-  // modules/auth/queries/current-user.server.ts
-  await writeFile(join(appDir, 'modules', 'auth', 'queries', 'current-user.server.ts'), [
-    "'use server';",
-    "",
-    "import { auth } from '#lib/auth.server.ts';",
-    "",
-    "// This read deliberately stays POST-default (no 'method' export). A GET",
-    "// server action (#488) is cacheable and SSR-seeded, which is wrong for a",
-    "// per-session read: the result differs per user and changes on sign-in /",
-    "// sign-out, so it must never be browser-cached or shared. Reserve GET +",
-    "// cache + tags for data identical for every visitor (see",
-    "// modules/users/queries/list-users.server.ts in the full-stack template).",
-    "export async function currentUser() {",
-    "  const session = await auth();",
-    "  return session?.user ?? null;",
-    "}",
-    "",
-  ].join('\n'));
-
-  // modules/auth/types.ts
-  await writeFile(join(appDir, 'modules', 'auth', 'types.ts'), [
-    "export interface User {",
-    "  id: number;",
-    "  name: string | null;",
-    "  email: string;",
-    "}",
-    "",
-    "export type ActionResult<T> =",
-    "  | { success: true; data: T }",
-    "  | { success: false; error: string; status: number };",
-    "",
-  ].join('\n'));
-
-  // test/auth/auth.test.ts: a REAL auth-flow test driven through the framework
-  // request pipeline with the @webjsdev/server test harness (createRequestHandler
-  // + the handle() helpers from @webjsdev/server/testing). It lives under the
-  // documented test/<feature>/ convention (test/auth/), not the old test/unit/
-  // path.
-  //
-  // Two layers, by DB availability:
-  //   - The protected-route gate (unauthenticated /dashboard -> 302 /login) runs
-  //     ALWAYS once the app modules import: auth() only reads a cookie, no DB
-  //     query. This is the headline security assertion and it is REAL.
-  //   The signup, login, and protected-route flow writes + reads a user, so it
-  //   needs the migrated users table (`npm run db:generate`, then `npm run dev`
-  //   applies it via webjs.dev.before). Until then those flows error, so the
-  //   suite probes readiness and skips with a clear message instead of crashing,
-  //   then runs for real once the db is set up.
-  await mkdir(join(appDir, 'test', 'auth'), { recursive: true });
-  // The generated comments reference `npm run db:*` setup; bun-ify them so a
-  // bun-flavored saas app reads `bun run db:*` (#541; db is Node tooling, so a
-  // plain `bun run`, not the --bun server form). The transform is a no-op on Node.
-  const authTest = [
-    "import { test } from 'node:test';",
-    "import assert from 'node:assert/strict';",
-    "import { fileURLToPath } from 'node:url';",
-    "import { dirname, resolve } from 'node:path';",
-    "",
-    "import { createRequestHandler } from '@webjsdev/server';",
-    "import { testRequest, loginAndGetCookies, withSessionCookie } from '@webjsdev/server/testing';",
-    "",
-    "const appDir = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');",
-    "",
-    "// The auth pages + dashboard middleware query the users table via Drizzle.",
-    "// Until `npm run db:generate` has authored the migration (then `npm run dev`",
-    "// applies it via webjs.dev.before, or `npm run db:migrate` directly), a",
-    "// request hitting those modules 500s; we detect that at the RESPONSE level",
-    "// (a 5xx on the dashboard) and SKIP with a clear message rather than report",
-    "// a misleading failure. After the db is set up every assertion runs for real.",
-    "process.env.DATABASE_URL ||= 'file:./dev.db';",
-    "process.env.AUTH_SECRET ||= 'test-secret-at-least-32-characters-long!!';",
-    "",
-    "function makeHandler() {",
-    "  // createRequestHandler builds lazily, so it succeeds even before the DB",
-    "  // is migrated; the missing table only surfaces when a request reaches a",
-    "  // module that queries it. That is why readiness is probed per-response.",
-    "  return createRequestHandler({ appDir, dev: true });",
-    "}",
-    "",
-    "test('protected route redirects to /login when unauthenticated', async (t) => {",
-    "  const app = await makeHandler();",
-    "  const res = await testRequest(app.handle, '/dashboard');",
-    "  if (res.status >= 500) {",
-    "    t.skip('app deps not ready (run `npm run db:generate` + `npm run db:migrate`)');",
-    "    return;",
-    "  }",
-    "  // The dashboard middleware calls auth(); with no session cookie it 302s to",
-    "  // /login. This needs no DB row, only a cookie read, so it is always real",
-    "  // once the modules import.",
-    "  assert.equal(res.status, 302, 'unauthenticated dashboard is gated');",
-    "  assert.equal(res.headers.get('location'), '/login');",
-    "});",
-    "",
-    "test('signup -> login -> dashboard renders for the authenticated user', async (t) => {",
-    "  const app = await makeHandler();",
-    "  // Probe readiness: a 5xx on the dashboard means deps/DB are not set up.",
-    "  const probe = await testRequest(app.handle, '/dashboard');",
-    "  if (probe.status >= 500) { t.skip('app deps not ready; run `npm run db:generate` + `npm run db:migrate`'); return; }",
-    "",
-    "  const email = `harness+${Date.now()}@example.com`;",
-    "  const password = 'password123';",
-    "",
-    "  // Real signup through the page server action (the no-JS form write-path).",
-    "  let canSignup = true;",
-    "  try {",
-    "    const signupRes = await testRequest(app.handle, '/signup', {",
-    "      method: 'POST',",
-    "      headers: { 'content-type': 'application/x-www-form-urlencoded' },",
-    "      body: new URLSearchParams({ name: 'Harness', email, password }).toString(),",
-    "    });",
-    "    // Success auto-logs-in and 302s to /dashboard (carrying the session",
-    "    // cookie); a 422 means validation failed. Either way the action ran.",
-    "    assert.ok([302, 422].includes(signupRes.status), 'signup action ran');",
-    "    if (signupRes.status === 302) assert.equal(signupRes.headers.get('location'), '/dashboard', 'signup lands on the dashboard');",
-    "    if (signupRes.status !== 302) canSignup = false;",
-    "  } catch {",
-    "    // No migrated DB table -> the action throws. Skip the DB-backed assertions.",
-    "    canSignup = false;",
-    "  }",
-    "  if (!canSignup) { t.skip('no migrated DB; run `npm run db:migrate` to enable the full flow'); return; }",
-    "",
-    "  // Real login captures the genuine signed session cookie.",
-    "  const { cookies } = await loginAndGetCookies(app.handle, { email, password });",
-    "",
-    "  // With the session cookie the protected route now renders (200).",
-    "  const dash = await testRequest(app.handle, '/dashboard', withSessionCookie({}, cookies));",
-    "  assert.equal(dash.status, 200, 'the session cookie unlocks the dashboard');",
-    "  const body = await dash.text();",
-    "  assert.match(body, /Dashboard/, 'the dashboard content rendered');",
-    "  // The greeting interpolates the real user, so the name renders and the",
-    "  // literal template source never leaks (a counterfactual for the escaping bug).",
-    "  assert.match(body, /Harness/, 'the dashboard greets the signed-in user by name');",
-    "  assert.ok(!body.includes('${user'), 'the greeting interpolation is not a literal string');",
-    "});",
-    "",
-  ].join('\n');
-  await writeFile(
-    join(appDir, 'test', 'auth', 'auth.test.ts'),
-    isBun ? bunifyProse(authTest) : authTest,
-  );
-
-  // app/api/auth/[...path]/route.ts
-  await mkdir(join(appDir, 'app', 'api', 'auth', '[...path]'), { recursive: true });
-  await writeFile(join(appDir, 'app', 'api', 'auth', '[...path]', 'route.ts'), [
-    "import { handlers } from '#lib/auth.server.ts';",
-    "export const GET = handlers.GET;",
-    "export const POST = handlers.POST;",
-    "",
-  ].join('\n'));
-
-  // app/login/page.ts
-  await mkdir(join(appDir, 'app', 'login'), { recursive: true });
-  await writeFile(join(appDir, 'app', 'login', 'page.ts'), [
-    "import { html } from '@webjsdev/core';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",
-    "import { buttonClass } from '#components/ui/button.ts';",
-    "import { inputClass } from '#components/ui/input.ts';",
-    "import { labelClass } from '#components/ui/label.ts';",
-    "",
-    "export const metadata = { title: 'Login' };",
-    "",
-    "// A failed sign-in 302s back here with ?error=... (createAuth is configured",
-    "// with pages.error: '/login' in lib/auth.server.ts). Map the code to a plain",
-    "// message so a bad password gets visible feedback instead of a silent bounce.",
-    "function errorMessage(code: string | undefined): string | null {",
-    "  if (!code) return null;",
-    "  if (code === 'CredentialsSignin') return 'Invalid email or password.';",
-    "  return 'Could not sign you in. Please try again.';",
-    "}",
-    "",
-    "export default function LoginPage({ searchParams }: { searchParams: { error?: string } }) {",
-    "  const error = errorMessage(searchParams.error);",
-    "  return html`",
-    "    <div class=\"max-w-sm mx-auto mt-12\">",
-    "      <div class=${cardClass()}>",
-    "        <div class=${cardHeaderClass()}>",
-    "          <h1 class=${cardTitleClass()}>Sign in</h1>",
-    "          <p class=${cardDescriptionClass()}>Welcome back: log in to continue.</p>",
-    "        </div>",
-    "        <div class=${cardContentClass()}>",
-    "          ${error ? html`<p role=\"alert\" class=\"mb-4 text-sm text-destructive\">${error}</p>` : ''}",
-    "          <form method=\"POST\" action=\"/api/auth/signin/credentials\" class=\"flex flex-col gap-4\">",
-    "            <!-- createAuth reads redirectTo from the posted form and 302s there after a successful signin. -->",
-    "            <input type=\"hidden\" name=\"redirectTo\" value=\"/dashboard\">",
-    "            <div class=\"flex flex-col gap-1.5\">",
-    "              <label class=${labelClass()} for=\"email\">Email</label>",
-    "              <input class=${inputClass()} id=\"email\" name=\"email\" type=\"email\" required>",
-    "            </div>",
-    "            <div class=\"flex flex-col gap-1.5\">",
-    "              <label class=${labelClass()} for=\"password\">Password</label>",
-    "              <input class=${inputClass()} id=\"password\" name=\"password\" type=\"password\" required>",
-    "            </div>",
-    "            <button class=${buttonClass()} type=\"submit\">Sign in</button>",
-    "          </form>",
-    "        </div>",
-    "        <div class=${cardFooterClass()}>",
-    "          <p class=\"text-sm text-muted-foreground\">Don't have an account? <a href=\"/signup\" class=\"underline\">Sign up</a></p>",
-    "        </div>",
-    "      </div>",
-    "    </div>",
-    "  `;",
-    "}",
-    "",
-  ].join('\n'));
-
-  // app/signup/page.ts
-  await mkdir(join(appDir, 'app', 'signup'), { recursive: true });
-  await writeFile(join(appDir, 'app', 'signup', 'page.ts'), [
-    "import { html } from '@webjsdev/core';",
-    "import { signup } from '#modules/auth/actions/signup.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",
-    "import { buttonClass } from '#components/ui/button.ts';",
-    "import { inputClass } from '#components/ui/input.ts';",
-    "import { labelClass } from '#components/ui/label.ts';",
-    "",
-    "export const metadata = { title: 'Sign up' };",
-    "",
-    "// Page server action: handles the POST from the form below. With JS",
-    "// disabled this is a plain <form> round-trip; with JS the client router",
-    "// swaps the 422 re-render (errors) or follows the 303 (success) in place.",
-    "// A validation failure returns fieldErrors + values so the page re-renders",
-    "// with messages and the user's typed input preserved (#244).",
-    "export async function action({ formData }: { formData: FormData }) {",
-    "  const name = String(formData.get('name') || '').trim();",
-    "  const email = String(formData.get('email') || '').trim();",
-    "  const password = String(formData.get('password') || '');",
-    "  const values = { name, email };",
-    "  const fieldErrors: Record<string, string> = {};",
-    "  if (!name) fieldErrors.name = 'Name is required';",
-    "  if (!email.includes('@')) fieldErrors.email = 'Enter a valid email';",
-    "  if (password.length < 8) fieldErrors.password = 'At least 8 characters';",
-    "  if (Object.keys(fieldErrors).length) return { success: false, fieldErrors, values, status: 422 };",
-    "  const result = await signup({ name, email, password });",
-    "  // On success signup returns signIn's 302 Response (auto-login -> /dashboard);",
-    "  // a page action may return a Response, so pass it straight through.",
-    "  if (result instanceof Response) return result;",
-    "  return { success: false, fieldErrors: { email: result.error }, values, status: result.status };",
-    "}",
-    "",
-    "export default function SignupPage({ actionData }: { actionData?: { fieldErrors?: Record<string, string>; values?: Record<string, string> } }) {",
-    "  const errors = actionData?.fieldErrors || {};",
-    "  const values = actionData?.values || {};",
-    "  return html`",
-    "    <div class=\"max-w-sm mx-auto mt-12\">",
-    "      <div class=${cardClass()}>",
-    "        <div class=${cardHeaderClass()}>",
-    "          <h1 class=${cardTitleClass()}>Create an account</h1>",
-    "          <p class=${cardDescriptionClass()}>Get started with your new workspace.</p>",
-    "        </div>",
-    "        <div class=${cardContentClass()}>",
-    "          <form method=\"POST\" class=\"flex flex-col gap-4\">",
-    "            <div class=\"flex flex-col gap-1.5\">",
-    "              <label class=${labelClass()} for=\"name\">Name</label>",
-    "              <input class=${inputClass()} id=\"name\" name=\"name\" type=\"text\" value=${values.name || ''} required>",
-    "              ${errors.name ? html`<p class=\"text-sm text-destructive\">${errors.name}</p>` : ''}",
-    "            </div>",
-    "            <div class=\"flex flex-col gap-1.5\">",
-    "              <label class=${labelClass()} for=\"email\">Email</label>",
-    "              <input class=${inputClass()} id=\"email\" name=\"email\" type=\"email\" value=${values.email || ''} required>",
-    "              ${errors.email ? html`<p class=\"text-sm text-destructive\">${errors.email}</p>` : ''}",
-    "            </div>",
-    "            <div class=\"flex flex-col gap-1.5\">",
-    "              <label class=${labelClass()} for=\"password\">Password</label>",
-    "              <input class=${inputClass()} id=\"password\" name=\"password\" type=\"password\" minlength=\"8\" required>",
-    "              ${errors.password ? html`<p class=\"text-sm text-destructive\">${errors.password}</p>` : ''}",
-    "            </div>",
-    "            <button class=${buttonClass()} type=\"submit\">Create account</button>",
-    "          </form>",
-    "        </div>",
-    "        <div class=${cardFooterClass()}>",
-    "          <p class=\"text-sm text-muted-foreground\">Already have an account? <a href=\"/login\" class=\"underline\">Log in</a></p>",
-    "        </div>",
-    "      </div>",
-    "    </div>",
-    "  `;",
-    "}",
-    "",
-  ].join('\n'));
-
-  // app/dashboard/middleware.ts
-  await mkdir(join(appDir, 'app', 'dashboard', 'settings'), { recursive: true });
-  await writeFile(join(appDir, 'app', 'dashboard', 'middleware.ts'), [
-    "import { auth } from '#lib/auth.server.ts';",
-    "",
-    "export default async function requireAuth(req: Request, next: () => Promise<Response>) {",
-    "  const session = await auth();",
-    "  if (!session?.user) {",
-    "    return new Response(null, { status: 302, headers: { location: '/login' } });",
-    "  }",
-    "  return next();",
-    "}",
-    "",
-  ].join('\n'));
-
-  // app/dashboard/layout.ts: a thin sub-nav shared by every /dashboard page
-  // (page.ts and settings/page.ts). It carries the logout control so a signed-in
-  // user can end the session from anywhere under /dashboard.
-  await writeFile(join(appDir, 'app', 'dashboard', 'layout.ts'), [
-    "import { html } from '@webjsdev/core';",
-    "import { buttonClass } from '#components/ui/button.ts';",
-    "",
-    "// Nested layout for the protected /dashboard subtree. Logout is a plain",
-    "// <form method=\"POST\"> posting to the createAuth signout route: it clears the",
-    "// session cookie and 302s home, and works with JS off (progressive-enhancement",
-    "// default). signOut is server-only (lib/auth.server.ts), so we POST to its route",
-    "// rather than import it into a browser-shipping page. After signout the dashboard",
-    "// middleware bounces any later /dashboard visit to /login.",
-    "export default function DashboardLayout({ children }: { children: unknown }) {",
-    "  return html`",
-    "    <nav class=\"flex items-center gap-4 mb-6 pb-4 border-b border-border\">",
-    "      <a href=\"/dashboard\" class=\"text-sm font-medium hover:underline\">Dashboard</a>",
-    "      <a href=\"/dashboard/settings\" class=\"text-sm font-medium hover:underline\">Settings</a>",
-    "      <form method=\"POST\" action=\"/api/auth/signout\" class=\"ml-auto\">",
-    "        <button class=${buttonClass({ variant: 'outline', size: 'sm' })} type=\"submit\">Log out</button>",
-    "      </form>",
-    "    </nav>",
-    "    ${children}",
-    "  `;",
-    "}",
-    "",
-  ].join('\n'));
-
-  // app/dashboard/page.ts
-  await writeFile(join(appDir, 'app', 'dashboard', 'page.ts'), [
-    "import { html } from '@webjsdev/core';",
-    "import { currentUser } from '#modules/auth/queries/current-user.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass } from '#components/ui/card.ts';",
-    "import { badgeClass } from '#components/ui/badge.ts';",
-    "",
-    "export const metadata = { title: 'Dashboard' };",
-    "",
-    "export default async function Dashboard() {",
-    "  const user = await currentUser();",
-    "  return html`",
-    "    <div class=\"flex items-center justify-between mb-6\">",
-    "      <h1 class=\"text-2xl font-semibold\">Dashboard</h1>",
-    "      <span class=${badgeClass({ variant: 'secondary' })}>Signed in</span>",
-    "    </div>",
-    "    <div class=${cardClass()}>",
-    "      <div class=${cardHeaderClass()}>",
-    "        <h2 class=${cardTitleClass()}>Welcome, ${user?.name || user?.email}!</h2>",
-    "        <p class=${cardDescriptionClass()}>You're authenticated. Replace this scaffold with your real app.</p>",
-    "      </div>",
-    "    </div>",
-    "  `;",
-    "}",
-    "",
-  ].join('\n'));
-
-  // app/dashboard/settings/page.ts
-  await writeFile(join(appDir, 'app', 'dashboard', 'settings', 'page.ts'), [
-    "import { html } from '@webjsdev/core';",
-    "import { currentUser } from '#modules/auth/queries/current-user.server.ts';",
-    "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass } from '#components/ui/card.ts';",
-    "",
-    "export const metadata = { title: 'Settings' };",
-    "",
-    "export default async function Settings() {",
-    "  const user = await currentUser();",
-    "  return html`",
-    "    <h1 class=\"text-2xl font-semibold mb-6\">Settings</h1>",
-    "    <div class=${cardClass()}>",
-    "      <div class=${cardHeaderClass()}>",
-    "        <h2 class=${cardTitleClass()}>Account</h2>",
-    "        <p class=${cardDescriptionClass()}>Your basic profile information.</p>",
-    "      </div>",
-    "      <div class=${cardContentClass()}>",
-    "        <dl class=\"grid grid-cols-[max-content_1fr] gap-x-6 gap-y-2 text-sm\">",
-    "          <dt class=\"text-muted-foreground\">Email</dt>",
-    "          <dd>${user?.email}</dd>",
-    "          <dt class=\"text-muted-foreground\">Name</dt>",
-    "          <dd>${user?.name || 'Not set'}</dd>",
-    "        </dl>",
-    "      </div>",
-    "    </div>",
-    "  `;",
-    "}",
-    "",
-  ].join('\n'));
-}