@yosr-ai/template-next-fullstack 0.0.0-stage → 0.1.0-alpha.0

package/features/deploy-docker/files/Dockerfile

@@ -0,0 +1,24 @@
+# Next.js standalone image.
+# https://nextjs.org/docs/app/api-reference/config/next-config-js/output
+FROM node:24 AS build
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN corepack enable && __seed_pmInstallCi__
+COPY . .
+RUN __seed_pmRun__ build
+
+FROM node:24 AS runner
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+COPY --from=build /app/.next/standalone ./
+COPY --from=build /app/.next/static ./.next/static
+
+EXPOSE 3000
+CMD ["node", "server.js"]

package/features/deploy-docker/files/compose.yaml

@@ -0,0 +1,6 @@
+services:
+  app:
+    build: .
+    ports:
+      - "3000:3000"
+  # @seed:anchor services

package/features/deploy-docker-npm/files/Dockerfile

@@ -0,0 +1,24 @@
+# Next.js standalone image.
+# https://nextjs.org/docs/app/api-reference/config/next-config-js/output
+FROM node:24 AS build
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN __seed_pmRun__ build
+
+FROM node:24 AS runner
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+COPY --from=build /app/.next/standalone ./
+COPY --from=build /app/.next/static ./.next/static
+
+EXPOSE 3000
+CMD ["node", "server.js"]

package/features/deploy-docker-postgres/snippets/postgres-service.yaml

@@ -0,0 +1,4 @@
+postgres:
+  image: postgres:18.6-alpine
+  environment:
+    POSTGRES_PASSWORD: postgres

package/features/deploy-vercel/snippets/readme-deploy.md

@@ -0,0 +1,3 @@
+## Deploy (Vercel)
+
+Import the repository in Vercel; it detects Next.js automatically. Set the variables from `.env.example` in the Vercel project settings.

package/features/orm-drizzle/files/drizzle.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./__seed_serverDir__/db/schema.ts",
+  out: "./drizzle",
+  dbCredentials: { url: process.env.DATABASE_URL ?? "" },
+});

package/features/orm-drizzle/files/src/features/notes/notes-store.ts

@@ -0,0 +1,21 @@
+import { desc } from "drizzle-orm";
+
+import { db } from "@server/db";
+import { notes } from "@server/db/schema";
+
+import type { Note, NoteInput } from "./note-schema";
+
+export async function insertNote(input: NoteInput): Promise<Note> {
+  const [note] = await db()
+    .insert(notes)
+    .values({ title: input.title })
+    .returning();
+  if (!note) {
+    throw new Error("Insert returned no row");
+  }
+  return note;
+}
+
+export async function listNotes(): Promise<Note[]> {
+  return db().select().from(notes).orderBy(desc(notes.createdAt));
+}

package/features/orm-drizzle/files/src/server/db/index.ts

@@ -0,0 +1,20 @@
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+
+import * as schema from "./schema";
+
+function createDb() {
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is not set. Copy .env.example to .env.local.");
+  }
+  return drizzle(postgres(url), { schema });
+}
+
+let instance: ReturnType<typeof createDb> | undefined;
+
+/** Lazily creates the Drizzle client so builds and tests don't need a database. */
+export function db() {
+  instance ??= createDb();
+  return instance;
+}

package/features/orm-drizzle/files/src/server/db/schema.ts

@@ -0,0 +1,11 @@
+import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+export const notes = pgTable("notes", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  title: text("title").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+
+// @seed:anchor tables

package/features/orm-drizzle/snippets/ci-e2e-setup.yaml

@@ -0,0 +1 @@
+- run: __seed_pmRun__ db:push

package/features/orm-drizzle/snippets/ci-job.yaml

@@ -0,0 +1,11 @@
+services:
+  postgres:
+    image: postgres:18.6-alpine
+    env:
+      POSTGRES_PASSWORD: postgres
+    ports: ["5432:5432"]
+    options: >-
+      --health-cmd pg_isready --health-interval 5s --health-timeout 5s
+      --health-retries 10
+env:
+  DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres

package/features/orm-drizzle/snippets/readme-db.md

@@ -0,0 +1,4 @@
+## Database (Postgres + Drizzle)
+
+1. Start Postgres and set `DATABASE_URL` in `.env.local` (see `.env.example`).
+2. Create the tables: `__seed_pmExec__ drizzle-kit push` (or `__seed_pmRun__ db:generate` then `__seed_pmRun__ db:migrate` for migration files).

package/features/orm-prisma/files/prisma/schema.prisma

@@ -0,0 +1,18 @@
+generator client {
+  provider = "prisma-client"
+  output   = "../src/generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+model Note {
+  id        String   @id @default(uuid()) @db.Uuid
+  title     String   @db.Text
+  createdAt DateTime @default(now()) @db.Timestamptz(6)
+
+  @@map("notes")
+}
+
+// @seed:anchor models

package/features/orm-prisma/files/prisma.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig } from "prisma/config";
+
+// process.env only: prisma/config's env() throws when DATABASE_URL is unset,
+// and `prisma generate` runs at install before any database is configured.
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+  migrations: {
+    path: "prisma/migrations",
+  },
+  datasource: {
+    url: process.env.DATABASE_URL ?? "",
+  },
+});

package/features/orm-prisma/files/src/features/notes/notes-store.ts

@@ -0,0 +1,13 @@
+import { db } from "@server/db";
+
+import type { Note, NoteInput } from "./note-schema";
+
+export async function insertNote(input: NoteInput): Promise<Note> {
+  return db().note.create({
+    data: { title: input.title },
+  });
+}
+
+export async function listNotes(): Promise<Note[]> {
+  return db().note.findMany({ orderBy: { createdAt: "desc" } });
+}

package/features/orm-prisma/files/src/server/db/index.ts

@@ -0,0 +1,20 @@
+import { PrismaPg } from "@prisma/adapter-pg";
+
+import { PrismaClient } from "@/generated/prisma/client";
+
+function createDb() {
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is not set. Copy .env.example to .env.local.");
+  }
+  const adapter = new PrismaPg({ connectionString: url });
+  return new PrismaClient({ adapter });
+}
+
+let instance: ReturnType<typeof createDb> | undefined;
+
+/** Lazily creates the Prisma client so builds and tests don't need a database. */
+export function db() {
+  instance ??= createDb();
+  return instance;
+}

package/features/orm-prisma/snippets/ci-e2e-setup.yaml

@@ -0,0 +1 @@
+- run: __seed_pmRun__ db:push

package/features/orm-prisma/snippets/ci-job.yaml

@@ -0,0 +1,11 @@
+services:
+  postgres:
+    image: postgres:18.6-alpine
+    env:
+      POSTGRES_PASSWORD: postgres
+    ports: ["5432:5432"]
+    options: >-
+      --health-cmd pg_isready --health-interval 5s --health-timeout 5s
+      --health-retries 10
+env:
+  DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres

package/features/orm-prisma/snippets/readme-db.md

@@ -0,0 +1,4 @@
+## Database (Postgres + Prisma)
+
+1. Start Postgres and set `DATABASE_URL` in `.env.local` (see `.env.example`).
+2. Create the tables: `__seed_pmRun__ db:push` (or `__seed_pmRun__ db:generate` then `__seed_pmRun__ db:migrate` for migration files).

package/features/payments-stripe/files/src/app/api/checkout/route.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+
+import { sessionEmail } from "@server/auth";
+import { createCheckoutSession } from "@server/billing";
+
+const bodySchema = z.object({
+  priceId: z.string().min(1),
+});
+
+export async function POST(req: Request) {
+  const email = await sessionEmail();
+  if (email === null) {
+    return Response.json({ error: "Sign in required" }, { status: 401 });
+  }
+  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+  if (!parsed.success) {
+    return Response.json({ error: "Price is required" }, { status: 400 });
+  }
+  const origin = new URL(req.url).origin;
+  const url = await createCheckoutSession({
+    userEmail: email,
+    priceId: parsed.data.priceId,
+    successUrl: `${origin}/`,
+    cancelUrl: `${origin}/`,
+  });
+  return Response.json({ url });
+}

package/features/payments-stripe/files/src/app/api/webhooks/stripe/route.ts

@@ -0,0 +1,18 @@
+import { applyBillingEvent } from "@server/billing";
+import { stripeClient } from "@server/billing/stripe";
+
+export async function POST(req: Request) {
+  const signature = req.headers.get("stripe-signature");
+  const secret = process.env.STRIPE_WEBHOOK_SECRET;
+  if (typeof signature !== "string" || signature.length === 0 || typeof secret !== "string" || secret.length === 0) {
+    return new Response("Missing Stripe signature", { status: 400 });
+  }
+  const payload = await req.text();
+  try {
+    const event = stripeClient().webhooks.constructEvent(payload, signature, secret);
+    await applyBillingEvent(event);
+  } catch {
+    return new Response("Invalid Stripe signature", { status: 400 });
+  }
+  return new Response("ok", { status: 200 });
+}

package/features/payments-stripe/files/src/server/billing/billing.test.ts

@@ -0,0 +1,113 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { POST as checkout } from "@/app/api/checkout/route";
+import { POST as webhook } from "@/app/api/webhooks/stripe/route";
+
+const mocks = vi.hoisted(() => ({
+  constructed: 0,
+  constructEvent: vi.fn(),
+  sessionsCreate: vi.fn(),
+  customersCreate: vi.fn(),
+  findCustomerId: vi.fn(),
+  saveCustomer: vi.fn(),
+  saveSubscription: vi.fn(),
+  sessionEmail: vi.fn(),
+}));
+
+vi.mock("stripe", () => ({
+  default: class Stripe {
+    constructor() {
+      mocks.constructed += 1;
+    }
+    webhooks = { constructEvent: mocks.constructEvent };
+    checkout = { sessions: { create: mocks.sessionsCreate } };
+    customers = { create: mocks.customersCreate };
+  },
+}));
+
+vi.mock("@server/auth", () => ({
+  sessionEmail: mocks.sessionEmail,
+}));
+
+vi.mock("./store", () => ({
+  findCustomerId: mocks.findCustomerId,
+  saveCustomer: mocks.saveCustomer,
+  saveSubscription: mocks.saveSubscription,
+}));
+
+afterEach(() => {
+  delete process.env.STRIPE_SECRET_KEY;
+  delete process.env.STRIPE_WEBHOOK_SECRET;
+  mocks.constructed = 0;
+  vi.clearAllMocks();
+});
+
+describe("stripe webhook", () => {
+  it("rejects a missing signature without constructing Stripe", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const response = await webhook(
+      new Request("http://localhost/api/webhooks/stripe", {
+        method: "POST",
+        body: "{}",
+      }),
+    );
+    expect(response.status).toBe(400);
+    expect(mocks.constructed).toBe(0);
+    expect(mocks.constructEvent).not.toHaveBeenCalled();
+    expect(fetchSpy).not.toHaveBeenCalled();
+    fetchSpy.mockRestore();
+  });
+
+  it("rejects a bad signature without saving a subscription", async () => {
+    process.env.STRIPE_SECRET_KEY = "sk_test_mock";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_mock";
+    mocks.constructEvent.mockImplementation(() => {
+      throw new Error("No signatures found matching the expected signature");
+    });
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const response = await webhook(
+      new Request("http://localhost/api/webhooks/stripe", {
+        method: "POST",
+        body: "{}",
+        headers: { "stripe-signature": "t=1,v1=bad" },
+      }),
+    );
+    expect(response.status).toBe(400);
+    expect(mocks.constructEvent).toHaveBeenCalledOnce();
+    expect(mocks.saveSubscription).not.toHaveBeenCalled();
+    expect(fetchSpy).not.toHaveBeenCalled();
+    fetchSpy.mockRestore();
+  });
+});
+
+describe("checkout", () => {
+  it("opens a subscription session for the signed-in email", async () => {
+    process.env.STRIPE_SECRET_KEY = "sk_test_mock";
+    mocks.sessionEmail.mockResolvedValue("ada@example.com");
+    mocks.findCustomerId.mockResolvedValue("cus_123");
+    mocks.sessionsCreate.mockResolvedValue({
+      url: "https://checkout.stripe.test/c/pay",
+    });
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const response = await checkout(
+      new Request("http://localhost/api/checkout", {
+        method: "POST",
+        body: JSON.stringify({ priceId: "price_123" }),
+      }),
+    );
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({
+      url: "https://checkout.stripe.test/c/pay",
+    });
+    expect(mocks.customersCreate).not.toHaveBeenCalled();
+    expect(mocks.sessionsCreate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        mode: "subscription",
+        customer: "cus_123",
+        line_items: [{ price: "price_123", quantity: 1 }],
+      }),
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+    fetchSpy.mockRestore();
+  });
+});

package/features/payments-stripe/files/src/server/billing/index.ts

@@ -0,0 +1,102 @@
+import type Stripe from "stripe";
+
+import {
+  findCustomerId,
+  saveCustomer,
+  saveSubscription,
+} from "./store";
+import { stripeClient } from "./stripe";
+
+export type BillingUpdate = {
+  stripeCustomerId: string;
+  stripeSubscriptionId: string;
+  status: string;
+  priceId: string | null;
+};
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null) return null;
+  return value as Record<string, unknown>;
+}
+
+function stringField(value: unknown, key: string): string | null {
+  const record = asRecord(value);
+  if (record === null) return null;
+  const field = record[key];
+  return typeof field === "string" ? field : null;
+}
+
+/** Maps a verified subscription or checkout event onto the billing tables. */
+export function billingUpdateFromEvent(event: Stripe.Event): BillingUpdate | null {
+  const object: unknown = event.data.object;
+  if (event.type === "checkout.session.completed") {
+    const stripeCustomerId = stringField(object, "customer");
+    const stripeSubscriptionId = stringField(object, "subscription");
+    if (stripeCustomerId === null || stripeSubscriptionId === null) return null;
+    return {
+      stripeCustomerId,
+      stripeSubscriptionId,
+      status: "active",
+      priceId: null,
+    };
+  }
+  if (
+    event.type !== "customer.subscription.created" &&
+    event.type !== "customer.subscription.updated"
+  ) {
+    return null;
+  }
+  const stripeSubscriptionId = stringField(object, "id");
+  const stripeCustomerId = stringField(object, "customer");
+  const status = stringField(object, "status");
+  if (
+    stripeSubscriptionId === null ||
+    stripeCustomerId === null ||
+    status === null
+  ) {
+    return null;
+  }
+  let priceId: string | null = null;
+  const items = asRecord(asRecord(object)?.items);
+  const data = items?.data;
+  if (Array.isArray(data)) {
+    const first = asRecord(data[0]);
+    priceId = stringField(first?.price, "id");
+  }
+  return { stripeCustomerId, stripeSubscriptionId, status, priceId };
+}
+
+export async function createCheckoutSession(input: {
+  userEmail: string;
+  priceId: string;
+  successUrl: string;
+  cancelUrl: string;
+}): Promise<string> {
+  const stripe = stripeClient();
+  let customerId = await findCustomerId(input.userEmail);
+  if (customerId === null) {
+    const customer = await stripe.customers.create({ email: input.userEmail });
+    customerId = customer.id;
+    await saveCustomer({
+      userEmail: input.userEmail,
+      stripeCustomerId: customerId,
+    });
+  }
+  const session = await stripe.checkout.sessions.create({
+    mode: "subscription",
+    customer: customerId,
+    line_items: [{ price: input.priceId, quantity: 1 }],
+    success_url: input.successUrl,
+    cancel_url: input.cancelUrl,
+  });
+  if (typeof session.url !== "string") {
+    throw new Error("Checkout session has no URL");
+  }
+  return session.url;
+}
+
+export async function applyBillingEvent(event: Stripe.Event): Promise<void> {
+  const update = billingUpdateFromEvent(event);
+  if (update === null) return;
+  await saveSubscription(update);
+}

package/features/payments-stripe/files/src/server/billing/stripe.ts

@@ -0,0 +1,10 @@
+import Stripe from "stripe";
+
+/** Stripe client for one call. Nothing constructs it at import. */
+export function stripeClient(): Stripe {
+  const key = process.env.STRIPE_SECRET_KEY;
+  if (typeof key !== "string" || key.length === 0) {
+    throw new Error("STRIPE_SECRET_KEY is not set");
+  }
+  return new Stripe(key);
+}

package/features/payments-stripe-drizzle/files/src/server/billing/store.ts

@@ -0,0 +1,39 @@
+import { eq } from "drizzle-orm";
+
+import { db } from "@server/db";
+import { billingCustomers, billingSubscriptions } from "@server/db/schema";
+
+export async function findCustomerId(userEmail: string): Promise<string | null> {
+  const rows = await db()
+    .select({ stripeCustomerId: billingCustomers.stripeCustomerId })
+    .from(billingCustomers)
+    .where(eq(billingCustomers.userEmail, userEmail))
+    .limit(1);
+  return rows[0]?.stripeCustomerId ?? null;
+}
+
+export async function saveCustomer(input: {
+  userEmail: string;
+  stripeCustomerId: string;
+}): Promise<void> {
+  await db().insert(billingCustomers).values(input);
+}
+
+export async function saveSubscription(input: {
+  stripeCustomerId: string;
+  stripeSubscriptionId: string;
+  status: string;
+  priceId: string | null;
+}): Promise<void> {
+  await db()
+    .insert(billingSubscriptions)
+    .values(input)
+    .onConflictDoUpdate({
+      target: billingSubscriptions.stripeSubscriptionId,
+      set: {
+        stripeCustomerId: input.stripeCustomerId,
+        status: input.status,
+        priceId: input.priceId,
+      },
+    });
+}

package/features/payments-stripe-drizzle/snippets/billing-tables.ts

@@ -0,0 +1,13 @@
+export const billingCustomers = pgTable("billing_customer", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userEmail: text("user_email").notNull().unique(),
+  stripeCustomerId: text("stripe_customer_id").notNull().unique(),
+});
+
+export const billingSubscriptions = pgTable("billing_subscription", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  stripeCustomerId: text("stripe_customer_id").notNull(),
+  stripeSubscriptionId: text("stripe_subscription_id").notNull().unique(),
+  status: text("status").notNull(),
+  priceId: text("price_id"),
+});

package/features/payments-stripe-prisma/files/src/server/billing/store.ts

@@ -0,0 +1,30 @@
+import { db } from "@server/db";
+
+export async function findCustomerId(userEmail: string): Promise<string | null> {
+  const row = await db().billingCustomer.findUnique({ where: { userEmail } });
+  return row?.stripeCustomerId ?? null;
+}
+
+export async function saveCustomer(input: {
+  userEmail: string;
+  stripeCustomerId: string;
+}): Promise<void> {
+  await db().billingCustomer.create({ data: input });
+}
+
+export async function saveSubscription(input: {
+  stripeCustomerId: string;
+  stripeSubscriptionId: string;
+  status: string;
+  priceId: string | null;
+}): Promise<void> {
+  await db().billingSubscription.upsert({
+    where: { stripeSubscriptionId: input.stripeSubscriptionId },
+    create: input,
+    update: {
+      stripeCustomerId: input.stripeCustomerId,
+      status: input.status,
+      priceId: input.priceId,
+    },
+  });
+}

package/features/payments-stripe-prisma/snippets/billing-models.prisma

@@ -0,0 +1,17 @@
+model BillingCustomer {
+  id               String @id @default(uuid()) @db.Uuid
+  userEmail        String @unique @db.Text
+  stripeCustomerId String @unique @db.Text
+
+  @@map("billing_customer")
+}
+
+model BillingSubscription {
+  id                   String  @id @default(uuid()) @db.Uuid
+  stripeCustomerId     String  @db.Text
+  stripeSubscriptionId String  @unique @db.Text
+  status               String  @db.Text
+  priceId              String? @db.Text
+
+  @@map("billing_subscription")
+}

package/files/.env.example

@@ -0,0 +1 @@
+# Copy to .env.local and fill in. Never commit real secrets.

package/files/.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    # @seed:anchor ci-job
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - run: corepack enable
+      - run: __seed_pmInstallCi__
+      - run: __seed_pmRun__ lint
+      - run: __seed_pmRun__ typecheck
+      - run: __seed_pmRun__ build
+      - run: __seed_pmRun__ test
+      - run: __seed_pmExec__ playwright install --with-deps chromium
+      # @seed:anchor ci-e2e-setup
+      - run: __seed_pmRun__ test:e2e

package/files/.prettierignore

@@ -0,0 +1,7 @@
+.next
+node_modules
+pnpm-lock.yaml
+package-lock.json
+playwright-report
+test-results
+drizzle

package/files/.prettierrc.json

@@ -0,0 +1 @@
+{}