better-ts-stack 2.0.1 → 2.1.0

package/dist/prompts/stack.js

@@ -1,10 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPackageManager = detectPackageManager;
 exports.ask = ask;
 exports.collectStackChoices = collectStackChoices;
 const core_1 = require("@clack/core");
 const types_1 = require("../types");
 const ui_1 = require("../ui");
+// The package manager that started the CLI (pnpm dlx, bunx, npx), from the
+// user agent it passes to the process; npm when it cannot be told
+function detectPackageManager() {
+    const userAgent = process.env.npm_config_user_agent ?? "";
+    const name = userAgent.split("/")[0];
+    return types_1.packageManagerOptions.some((option) => option.value === name)
+        ? name
+        : "npm";
+}
 // Returns the preset value when there is one, otherwise asks the user
 async function ask(preset, prompt) {
     if (preset !== undefined)
@@ -16,7 +26,8 @@ async function ask(preset, prompt) {
     const answer = await prompt();
     if ((0, core_1.isCancel)(answer)) {
         (0, ui_1.info)("Cancelled. Nothing was created.");
-        process.exit(0);
+        // 130 is the usual exit code for a run stopped with Ctrl+C
+        process.exit(130);
     }
     return answer;
 }
@@ -62,7 +73,7 @@ async function collectStackChoices(preset) {
     const packageManager = await ask(preset.packageManager, () => (0, ui_1.select)({
         message: "Package manager",
         options: types_1.packageManagerOptions,
-        initialValue: "npm",
+        initialValue: detectPackageManager(),
     }));
     const useDocker = await ask(preset.useDocker, () => (0, ui_1.confirm)({ message: "Add Docker?", initialValue: false }));
     // Better Auth stores users and sessions, so full-stack auth needs a database
@@ -77,6 +88,13 @@ async function collectStackChoices(preset) {
             initialValue: false,
         }))
         : false;
+    // Better Auth limits its own endpoints, so only the backends offer this
+    if (preset.useRateLimit && isFullstack) {
+        throw (0, types_1.buildError)(`Rate limiting is available for Express and NestJS. Better Auth in ${framework} already limits its own endpoints`, "INVALID_ARGUMENT");
+    }
+    const useRateLimit = isFullstack
+        ? false
+        : await ask(preset.useRateLimit, () => (0, ui_1.confirm)({ message: "Add rate limiting?", initialValue: false }));
     const initGit = await ask(preset.initGit, () => (0, ui_1.confirm)({ message: "Initialize a git repository?", initialValue: true }));
     const installDeps = await ask(preset.installDeps, () => (0, ui_1.confirm)({ message: "Install dependencies now?", initialValue: false }));
     return {
@@ -85,6 +103,7 @@ async function collectStackChoices(preset) {
         packageManager,
         useDocker,
         useAuth,
+        useRateLimit,
         initGit,
         installDeps,
     };

package/dist/types/index.js

@@ -11,6 +11,7 @@ exports.DEFAULT_CHOICES = {
     database: "none",
     useDocker: false,
     useAuth: false,
+    useRateLimit: false,
     packageManager: "npm",
     initGit: true,
     installDeps: false,
@@ -52,7 +53,7 @@ exports.frontendFrameworkOptions = [
     {
         value: "tanstack",
         label: "TanStack Start",
-        hint: "React, release candidate",
+        hint: "Vite and React",
     },
 ];
 // Database system options; the ORM is chosen in a second step

package/dist/ui/messages.js

@@ -73,6 +73,7 @@ function showSummary(config, targetDir) {
         config.framework,
         config.database !== "none" && config.database,
         config.useAuth && "auth",
+        config.useRateLimit && "rate limit",
         config.useDocker && "docker",
     ];
     const setup = [
@@ -115,7 +116,7 @@ function showNextSteps(steps) {
     write();
     write(`  ${(0, theme_1.amber)((0, theme_1.bold)("Next steps"))}`);
     steps.forEach((step, index) => {
-        const isCommand = /^(cd|npm|pnpm|bun) /.test(step);
+        const isCommand = /^(cd|npm|pnpm|bun|docker) /.test(step);
         write(`  ${(0, theme_1.dim)(`${index + 1}.`)} ${isCommand ? (0, theme_1.lime)(step) : step}`);
     });
     write();

package/dist/validators/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.projectNameSchema = void 0;
+exports.PRESERVED_ENTRIES = exports.projectNameSchema = void 0;
 exports.validateProjectName = validateProjectName;
 exports.validateProjectPath = validateProjectPath;
 exports.validateDirectoryEmpty = validateDirectoryEmpty;
@@ -32,6 +32,9 @@ function validateProjectName(name) {
 function validateProjectPath(projectPath) {
     return validateProjectName(node_path_1.default.basename(node_path_1.default.resolve(projectPath)));
 }
+// Entries a project folder may already have: a repository cloned from an
+// empty remote, and files the operating system creates
+exports.PRESERVED_ENTRIES = [".git", ".DS_Store", "Thumbs.db"];
 // Ensures a directory is empty or does not exist before starting build
 async function validateDirectoryEmpty(dirPath) {
     const exists = await fs_extra_1.default.pathExists(dirPath);
@@ -42,7 +45,7 @@ async function validateDirectoryEmpty(dirPath) {
         return `Path "${dirPath}" exists but is not a directory`;
     }
     const files = await fs_extra_1.default.readdir(dirPath);
-    if (files.length === 0)
+    if (files.every((file) => exports.PRESERVED_ENTRIES.includes(file)))
         return null;
     return `Directory "${node_path_1.default.basename(dirPath)}" already exists and is not empty`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-ts-stack",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "A CLI that scaffolds Express, NestJS, Next.js, and TanStack Start projects with a database, authentication, and Docker already set up.",
   "keywords": [
     "cli",

package/templates/backend/express/config.json

@@ -1,40 +1,42 @@
-{
-  "id": "express",
-  "name": "Express Base",
-  "description": "Base Express server with TypeScript, security headers, and a health check",
-  "type": "base",
-  "scripts": {
-    "dev": "cross-env NODE_ENV=development {{#if (eq packageManager 'bun')}}bun --watch src/index.ts{{else}}tsx watch src/index.ts{{/if}}",
-    "build": "tsc",
-    "start": "cross-env NODE_ENV=production {{runner}} dist/index.js",
-    "lint": "eslint src",
-    "lint:fix": "eslint src --fix",
-    "format": "prettier --write \"src/**/*.ts\"",
-    "type:check": "tsc --noEmit"
-  },
-  "dependencies": {
-    "express": "^5.2.1",
-    "dotenv": "^17.4.2",
-    "cors": "^2.8.6",
-    "cross-env": "^10.1.0",
-    "helmet": "^8.3.0",
-    "morgan": "^1.12.0"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@trivago/prettier-plugin-sort-imports": "^6.0.2",
-    "@types/cors": "^2.8.19",
-    "@types/express": "^5.0.6",
-    "@types/morgan": "^1.9.10",
-    "@types/node": "^24.13.3",
-    "eslint": "^10.10.0",
-    "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.9.6",
-    "tsx": "^4.23.13",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.69.0"
-  },
-  "envVars": {
-    "PORT": "3000"
-  }
-}
+{
+  "id": "express",
+  "name": "Express Base",
+  "description": "Base Express server with TypeScript, security headers, and a health check",
+  "type": "base",
+  "scripts": {
+    "dev": "cross-env NODE_ENV=development {{#if (eq packageManager 'bun')}}bun --watch src/index.ts{{else}}tsx watch src/index.ts{{/if}}",
+    "build": "tsc",
+    "start": "cross-env NODE_ENV=production {{runner}} dist/index.js",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "type:check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "express": "^5.2.1",
+    "dotenv": "^17.4.2",
+    "cors": "^2.8.6",
+    "cross-env": "^10.1.0",
+    "helmet": "^8.3.0",
+    "morgan": "^1.12.0",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@trivago/prettier-plugin-sort-imports": "^6.0.2",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
+    "@types/morgan": "^1.9.10",
+    "@types/node": "^24.13.3",
+    "eslint": "^10.10.0",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.9.6",
+    "tsx": "^4.23.13",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.69.0"
+  },
+  "envVars": {
+    "PORT": "3000",
+    "CORS_ORIGIN": "*"
+  }
+}

package/templates/backend/express/src/env.ts.hbs

@@ -0,0 +1,39 @@
+import "dotenv/config";
+import { z } from "zod";
+
+// Checked once at startup, so a missing or malformed variable stops the server
+// with a clear message instead of failing on the first request that needs it
+const envSchema = z.object({
+  PORT: z.coerce.number().int().positive().default(3000),
+  // "*" allows every origin; otherwise a comma-separated list of origins
+  CORS_ORIGIN: z
+    .string()
+    .default("*")
+    .transform((value) =>
+      value === "*" ? value : value.split(",").map((origin) => origin.trim())
+    ),
+{{#if (eq database 'prisma')}}
+  DATABASE_URL: z.url(),
+{{/if}}
+{{#if (eq database 'drizzle')}}
+  DATABASE_URL: z.url(),
+{{/if}}
+{{#if (eq database 'mongoose')}}
+  MONGODB_URI: z.url(),
+{{/if}}
+{{#if useAuth}}
+  JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters"),
+  JWT_EXPIRES_IN: z.string().default("1h"),
+{{/if}}
+});
+
+const result = envSchema.safeParse(process.env);
+
+if (!result.success) {
+  console.error(
+    `Invalid environment variables:\n${z.prettifyError(result.error)}`
+  );
+  process.exit(1);
+}
+
+export const env = result.data;

package/templates/backend/express/src/index.ts.hbs

@@ -1,75 +1,111 @@
-import "dotenv/config";
-import express, { Express, Request, Response, NextFunction } from "express";
-import cors from "cors";
-import helmet from "helmet";
-import morgan from "morgan";
-{{#if (eq database 'mongoose')}}
-import { connectDB } from "./lib/db";
-{{/if}}
-import healthRouter from "./routes/health";
-{{#if useAuth}}
-import authRouter from "./routes/auth";
-{{/if}}
-
-const app: Express = express();
-const port = process.env.PORT || 3000;
-
-// Middleware
-app.use(helmet());
-app.use(cors());
-app.use(morgan("dev"));
-app.use(express.json());
-app.use(express.urlencoded({ extended: true }));
-
-// Routes
-app.use("/health", healthRouter);
-{{#if useAuth}}
-app.use("/auth", authRouter);
-{{/if}}
-
-// 404 handler
-app.use((_req: Request, res: Response) => {
-  res.status(404).json({ error: "Not Found" });
-});
-
-// Error handler
-app.use(
-  (
-    err: Error & { status?: number; statusCode?: number; expose?: boolean },
-    _req: Request,
-    res: Response,
-    _next: NextFunction,
-  ) => {
-    // Middleware such as express.json() sets 4xx statuses (bad JSON, body too large)
-    const status = err.status ?? err.statusCode ?? 500;
-
-    if (status >= 400 && status < 500) {
-      res.status(status).json({ error: err.expose ? err.message : "Bad Request" });
-      return;
-    }
-
-    console.error(err.stack);
-    res.status(500).json({ error: "Internal Server Error" });
-  },
-);
-
-function listen(): void {
-  app.listen(port, () => {
-    console.log(`Server is running on http://localhost:${port}
-    Health: http://localhost:${port}/health
-    `);
-  });
-}
-
-{{#if (eq database 'mongoose')}}
-void connectDB()
-  .then(listen)
-  .catch((error: unknown) => {
-    console.error(error);
-    process.exitCode = 1;
-  });
-{{else}}
-listen();
-{{/if}}
-
-export default app;
+import "dotenv/config";
+import express, { Express, Request, Response, NextFunction } from "express";
+import cors from "cors";
+import helmet from "helmet";
+import morgan from "morgan";
+import { env } from "./env";
+{{#if (eq database 'prisma')}}
+import { disconnectPrisma } from "./lib/prisma";
+{{/if}}
+{{#if (eq database 'drizzle')}}
+import { db } from "./lib/db";
+{{/if}}
+{{#if (eq database 'mongoose')}}
+import { connectDB, disconnectDB } from "./lib/db";
+{{/if}}
+{{#if useRateLimit}}
+import { apiLimiter } from "./middleware/rateLimit";
+{{/if}}
+import healthRouter from "./routes/health";
+{{#if useAuth}}
+import authRouter from "./routes/auth";
+{{/if}}
+
+const app: Express = express();
+const port = env.PORT;
+
+// Middleware
+app.use(helmet());
+app.use(cors({ origin: env.CORS_ORIGIN }));
+{{#if useRateLimit}}
+app.use(apiLimiter);
+{{/if}}
+app.use(morgan("dev"));
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+
+// Routes
+app.use("/health", healthRouter);
+{{#if useAuth}}
+app.use("/auth", authRouter);
+{{/if}}
+
+// 404 handler
+app.use((_req: Request, res: Response) => {
+  res.status(404).json({ error: "Not Found" });
+});
+
+// Error handler
+app.use(
+  (
+    err: Error & { status?: number; statusCode?: number; expose?: boolean },
+    _req: Request,
+    res: Response,
+    _next: NextFunction,
+  ) => {
+    // Middleware such as express.json() sets 4xx statuses (bad JSON, body too large)
+    const status = err.status ?? err.statusCode ?? 500;
+
+    if (status >= 400 && status < 500) {
+      res.status(status).json({ error: err.expose ? err.message : "Bad Request" });
+      return;
+    }
+
+    console.error(err.stack);
+    res.status(500).json({ error: "Internal Server Error" });
+  },
+);
+
+// Closes the database connection once the server has stopped
+function closeDatabase(): Promise<void> {
+{{#if (eq database 'prisma')}}
+  return disconnectPrisma();
+{{else if (eq database 'drizzle')}}
+  return db.$client.end();
+{{else if (eq database 'mongoose')}}
+  return disconnectDB();
+{{else}}
+  return Promise.resolve();
+{{/if}}
+}
+
+function listen(): void {
+  const server = app.listen(port, () => {
+    console.log(`Server is running on http://localhost:${port}
+    Health: http://localhost:${port}/health
+    `);
+  });
+
+  // Docker and most hosts stop the process with SIGTERM, and Ctrl+C sends
+  // SIGINT: finish open requests, close the database, then exit
+  const shutdown = () => {
+    server.close(() => {
+      void closeDatabase().finally(() => process.exit(0));
+    });
+  };
+  process.once("SIGTERM", shutdown);
+  process.once("SIGINT", shutdown);
+}
+
+{{#if (eq database 'mongoose')}}
+void connectDB()
+  .then(listen)
+  .catch((error: unknown) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
+{{else}}
+listen();
+{{/if}}
+
+export default app;

package/templates/backend/nestjs/config.json

@@ -1,41 +1,43 @@
-{
-  "id": "nestjs",
-  "name": "NestJS Base",
-  "description": "Base NestJS server with TypeScript, security headers, and a health check",
-  "type": "base",
-  "scripts": {
-    "dev": "cross-env NODE_ENV=development nest start --watch",
-    "build": "nest build",
-    "start": "cross-env NODE_ENV=production {{runner}} dist/main.js",
-    "lint": "eslint src",
-    "lint:fix": "eslint src --fix",
-    "format": "prettier --write \"src/**/*.ts\"",
-    "type:check": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@nestjs/common": "^12.1.2",
-    "@nestjs/core": "^12.1.2",
-    "@nestjs/platform-express": "^12.1.2",
-    "cross-env": "^10.1.0",
-    "dotenv": "^17.4.2",
-    "helmet": "^8.3.0",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.2"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@nestjs/cli": "^12.0.8",
-    "@nestjs/schematics": "^12.0.6",
-    "@trivago/prettier-plugin-sort-imports": "^6.0.2",
-    "@types/express": "^5.0.6",
-    "@types/node": "^24.13.3",
-    "eslint": "^10.10.0",
-    "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.9.6",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.69.0"
-  },
-  "envVars": {
-    "PORT": "3000"
-  }
-}
+{
+  "id": "nestjs",
+  "name": "NestJS Base",
+  "description": "Base NestJS server with TypeScript, security headers, and a health check",
+  "type": "base",
+  "scripts": {
+    "dev": "cross-env NODE_ENV=development nest start --watch",
+    "build": "nest build",
+    "start": "cross-env NODE_ENV=production {{runner}} dist/main.js",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "type:check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@nestjs/common": "^12.1.2",
+    "@nestjs/core": "^12.1.2",
+    "@nestjs/platform-express": "^12.1.2",
+    "cross-env": "^10.1.0",
+    "dotenv": "^17.4.2",
+    "helmet": "^8.3.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@nestjs/cli": "^12.0.8",
+    "@nestjs/schematics": "^12.0.6",
+    "@trivago/prettier-plugin-sort-imports": "^6.0.2",
+    "@types/express": "^5.0.6",
+    "@types/node": "^24.13.3",
+    "eslint": "^10.10.0",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.9.6",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.69.0"
+  },
+  "envVars": {
+    "PORT": "3000",
+    "CORS_ORIGIN": "*"
+  }
+}

package/templates/backend/nestjs/src/app.module.ts.hbs

@@ -1,7 +1,13 @@
 import { Module } from "@nestjs/common";
+{{#if useRateLimit}}
+import { APP_GUARD } from "@nestjs/core";
+{{/if}}
 {{#if (eq database 'mongoose')}}
 import { MongooseModule } from "@nestjs/mongoose";
 {{/if}}
+{{#if useRateLimit}}
+import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
+{{/if}}
 
 {{#if useAuth}}
 import { AuthModule } from "./auth/auth.module.js";
@@ -28,7 +34,14 @@ import { PrismaModule } from "./prisma/prisma.module.js";
     {{#if useAuth}}
     AuthModule,
     {{/if}}
+    {{#if useRateLimit}}
+    // Every route: 100 requests per client IP in 15 minutes
+    ThrottlerModule.forRoot([{ ttl: 15 * 60 * 1000, limit: 100 }]),
+    {{/if}}
   ],
   controllers: [HealthController],
+  {{#if useRateLimit}}
+  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
+  {{/if}}
 })
 export class AppModule {}

package/templates/backend/nestjs/src/env.ts.hbs

@@ -0,0 +1,39 @@
+import "dotenv/config";
+import { z } from "zod";
+
+// Checked once at startup, so a missing or malformed variable stops the server
+// with a clear message instead of failing on the first request that needs it
+const envSchema = z.object({
+  PORT: z.coerce.number().int().positive().default(3000),
+  // "*" allows every origin; otherwise a comma-separated list of origins
+  CORS_ORIGIN: z
+    .string()
+    .default("*")
+    .transform((value) =>
+      value === "*" ? value : value.split(",").map((origin) => origin.trim())
+    ),
+{{#if (eq database 'prisma')}}
+  DATABASE_URL: z.url(),
+{{/if}}
+{{#if (eq database 'drizzle')}}
+  DATABASE_URL: z.url(),
+{{/if}}
+{{#if (eq database 'mongoose')}}
+  MONGODB_URI: z.url(),
+{{/if}}
+{{#if useAuth}}
+  JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters"),
+  JWT_EXPIRES_IN: z.string().default("1h"),
+{{/if}}
+});
+
+const result = envSchema.safeParse(process.env);
+
+if (!result.success) {
+  console.error(
+    `Invalid environment variables:\n${z.prettifyError(result.error)}`
+  );
+  process.exit(1);
+}
+
+export const env = result.data;

package/templates/backend/nestjs/src/main.ts

@@ -4,13 +4,14 @@ import "dotenv/config";
 import helmet from "helmet";
 
 import { AppModule } from "./app.module.js";
+import { env } from "./env.js";
 
 async function bootstrap(): Promise<void> {
   const app = await NestFactory.create(AppModule);
-  const port = process.env.PORT ?? 3000;
+  const port = env.PORT;
 
   app.use(helmet());
-  app.enableCors();
+  app.enableCors({ origin: env.CORS_ORIGIN });
   // Lets modules close database connections when the process is stopped
   app.enableShutdownHooks();