create-authenik8-app 2.4.14 → 2.4.15

package/dist/src/utils/output.js

@@ -1,4 +1,6 @@
 import chalk from "chalk";
+import { doctorCommand, firstSuccessGuide } from "../lib/onboarding.js";
+import { installCommand, runScriptCommand } from "../lib/packageManagerCommands.js";
 function selectedOAuthProviders(state) {
     const providers = state.oauthProviders?.filter((provider) => provider === "google" || provider === "github");
     return providers ?? ["google", "github"];
@@ -31,18 +33,23 @@ function databaseLabel(state) {
     return state.database === "postgresql" ? "PostgreSQL with Prisma" : "SQLite with Prisma";
 }
 function runCommand(state, script) {
-    return `${state.packageManager ?? "npm"} run ${script}`;
+    return runScriptCommand(state.packageManager ?? "npm", script);
 }
 export function printSummary(state, isProduction, hasDockerCompose = true, hasDockerDaemon = true) {
     const packageManager = state.packageManager ?? "npm";
+    const firstSuccess = firstSuccessGuide(state.authMode ?? "base");
+    const isFullstack = state.authMode === "fullstack";
+    const needsPostgres = !isFullstack
+        && state.usePrisma
+        && state.database === "postgresql";
     const commands = [
         `cd ${state.projectName}`,
-        ...(state.installDeps === false ? [`${packageManager} install`] : []),
-        ...(hasDockerCompose && hasDockerDaemon ? [runCommand(state, "docker:up")] : []),
-        ...(state.usePrisma
-            ? [runCommand(state, state.authMode === "fullstack" ? "db:migrate" : "prisma:migrate")]
+        ...(state.installDeps === false ? [installCommand(packageManager)] : []),
+        ...(needsPostgres && hasDockerCompose && hasDockerDaemon
+            ? [runCommand(state, "docker:up")]
             : []),
-        ...(state.authMode === "fullstack" ? [runCommand(state, "db:seed")] : []),
+        ...(!isFullstack && state.usePrisma ? [runCommand(state, "db:migrate")] : []),
+        doctorCommand(packageManager),
         runCommand(state, "dev"),
     ];
     const details = [
@@ -60,12 +67,11 @@ export function printSummary(state, isProduction, hasDockerCompose = true, hasDo
         console.log(`${chalk.green("◇")}  ${chalk.dim(label.padEnd(labelWidth))}  ${value}`);
     }
     console.log(chalk.dim("│"));
-    if (!hasDockerCompose) {
-        const services = state.database === "postgresql" ? "Redis and PostgreSQL" : "Redis";
-        console.log(`${chalk.yellow("!")}  Docker Compose was not found. Install it or start ${services} manually.`);
+    if (needsPostgres && !hasDockerCompose) {
+        console.log(`${chalk.yellow("!")}  Docker Compose was not found. Install it or provide PostgreSQL through DATABASE_URL.`);
         console.log(chalk.dim("│"));
     }
-    else if (!hasDockerDaemon) {
+    else if (needsPostgres && !hasDockerDaemon) {
         console.log(`${chalk.yellow("!")}  Docker is installed, but its daemon is not reachable. Start Docker Desktop or the Docker service.`);
         console.log(chalk.dim("│"));
     }
@@ -73,6 +79,12 @@ export function printSummary(state, isProduction, hasDockerCompose = true, hasDo
     for (const command of commands) {
         console.log(`  ${chalk.cyan(command)}`);
     }
+    console.log(chalk.dim("│"));
+    console.log(`${chalk.cyan("└")} ${chalk.bold("First success")}`);
+    console.log(`  ${chalk.bold(firstSuccess.title)}`);
+    firstSuccess.steps.forEach((step, index) => {
+        console.log(`  ${chalk.cyan(`${index + 1}.`)} ${step}`);
+    });
     if (state.authMode === "fullstack") {
         console.log(chalk.dim("\n  Web  http://localhost:5173"));
         console.log(chalk.dim("  API  http://localhost:3000/api"));
@@ -83,6 +95,6 @@ export function printSummary(state, isProduction, hasDockerCompose = true, hasDo
     if (isProduction && state.authMode !== "fullstack") {
         console.log(chalk.dim(`\n  Production process  ${runCommand(state, "pm2:start")}`));
     }
-    console.log(chalk.dim("\n  Review .env, README.md, and THREAT_MODEL.md before deployment.\n"));
+    console.log(chalk.dim("\n  Review .env, authenik8.json, README.md, and THREAT_MODEL.md before deployment.\n"));
 }
 //# sourceMappingURL=output.js.map

package/dist/src/utils/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/utils/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,SAAS,sBAAsB,CAAC,KAAe;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAC/C,CAAC;IAEF,OAAO,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACzC,OAAO,sBAAsB,CAAC,KAAK,CAAC;SACjC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,oBAAoB,CAAC;IAC3D,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,wBAAwB,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,qBAAqB,CAAC;IAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,8BAA8B,CAAC;IACrE,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,MAAc;IACjD,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,QAAQ,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAe,EACf,YAAqB,EACrB,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAAG,IAAI;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG;QACf,MAAM,KAAK,CAAC,WAAW,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACvF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC;KACzB,CAAC;IACF,MAAM,OAAO,GAA4B;QACvC,CAAC,UAAU,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,iBAAiB,EAAE,cAAc,CAAC;KACpC,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,uDAAuD,QAAQ,YAAY,CAAC,CAAC;QAC7G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;QACvI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC,CAAC;AACjG,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/utils/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGpF,SAAS,sBAAsB,CAAC,KAAe;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAC/C,CAAC;IAEF,OAAO,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACzC,OAAO,sBAAsB,CAAC,KAAK,CAAC;SACjC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,oBAAoB,CAAC;IAC3D,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,wBAAwB,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,qBAAqB,CAAC;IAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,8BAA8B,CAAC;IACrE,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,MAAc;IACjD,OAAO,gBAAgB,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAe,EACf,YAAqB,EACrB,gBAAgB,GAAG,IAAI,EACvB,eAAe,GAAG,IAAI;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC;IACrD,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,WAAW;WAC7B,KAAK,CAAC,SAAS;WACf,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrC,MAAM,QAAQ,GAAG;QACf,MAAM,KAAK,CAAC,WAAW,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,aAAa,IAAI,gBAAgB,IAAI,eAAe;YACtD,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,aAAa,CAAC,cAAc,CAAC;QAC7B,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC;KACzB,CAAC;IACF,MAAM,OAAO,GAA4B;QACvC,CAAC,UAAU,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,iBAAiB,EAAE,cAAc,CAAC;KACpC,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,wFAAwF,CAC7G,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,qGAAqG,CAC1H,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC,CAAC;AACjH,CAAC"}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "create-authenik8-app",
-  "version": "2.4.14",
+  "version": "2.4.15",
   "description": " Fast Express + TypeScript auth starter with secure JWT, refresh rotation, Redis, RBAC, OAuth & Prisma.\nPowered by the Authenik8 Identity Engine.",
   "bin": {
-    "create-authenik8-app": "dist/src/bin/index.js"
+    "create-authenik8-app": "dist/src/bin/cli.js"
   },
   "keywords": [
     "cli",
@@ -32,7 +32,7 @@
     "node": "^20.19 || ^22.12 || >=24"
   },
   "dependencies": {
-    "@inquirer/core": "^10.3.2",
+    "@inquirer/core": "^11.2.1",
     "chalk": "^5.6.2",
     "fs-extra": "^11.3.4",
     "inquirer": "^12.11.1",
@@ -62,9 +62,10 @@
     "@vitest/coverage-v8": "^4.1.8",
     "authenik8-core": "2.0.3",
     "fast-check": "^4.8.0",
+    "ioredis-mock": "^8.13.1",
     "jose": "6.2.3",
     "supertest": "^7.2.2",
-    "tsx": "^4.23.1",
+    "tsx": "^4.22.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
   },

package/templates/express-auth/README.md

@@ -6,12 +6,21 @@ Generated by `create-authenik8-app`.
 
 ```bash
 npm install
-npm run docker:up
-npm run prisma:migrate
+npm run db:migrate
 npm run dev
 ```
 
-For SQLite, Postgres in `docker-compose.yml` is optional. Redis is required for refresh-token rotation and replay protection.
+The generated local environment uses an in-process Redis-compatible store, so Redis and Docker are optional during development. If you selected PostgreSQL, start it with `npm run docker:up` or point `DATABASE_URL` to an existing instance before migrating.
+
+Validate the generated auth configuration and Redis connection at any time:
+
+```bash
+npx create-authenik8-app@latest doctor
+```
+
+`authenik8.json` records the generated architecture and Authenik8 engine version. It contains no secrets and should be committed with the project.
+
+After committing the package-manager lockfile, run `npx create-authenik8-app@latest add ci-github` to add the pinned Doctor and upgrade-policy workflow. Preview it first with `--dry-run`.
 
 ## Environment
 
@@ -27,8 +36,7 @@ AUTHENIK8_ISSUER=http://localhost:3000
 AUTHENIK8_AUDIENCE=your-app-api
 AUTHENIK8_AGENTS={}
 REFRESH_SECRET=<generated-random-secret>
-REDIS_HOST=127.0.0.1
-REDIS_PORT=6379
+REDIS_URL=memory://
 ```
 
 ## API Contract
@@ -80,8 +88,7 @@ Authorization: Bearer <accessToken>
 Start the API in one terminal:
 
 ```bash
-npm run docker:up
-npm run prisma:migrate
+npm run db:migrate
 npm run dev
 ```
 
@@ -133,8 +140,8 @@ curl -s -X POST http://localhost:3000/auth/refresh \
 - `AUTHENIK8_ISSUER` / `AUTHENIK8_AUDIENCE`: required claims checked during verification.
 - `AUTHENIK8_AGENTS`: optional JSON map of agent IDs to exact `resource:action` scopes; keep `{}` to disable agent identity. See `AGENT_IDENTITY.md`.
 - `REFRESH_SECRET`: signs refresh tokens. Use a different long random value in production.
-- `REDIS_HOST`: Redis host for refresh-token/session security.
-- `REDIS_PORT`: Redis port, usually `6379` locally.
+- `REDIS_URL`: use `memory://` for local development or `redis://` / `rediss://` for an external service. Production rejects `memory://`.
+- `REDIS_HOST` / `REDIS_PORT` / `REDIS_PASSWORD`: optional external Redis settings used when `REDIS_URL` is omitted.
 
 ## Frontend Use
 
@@ -176,9 +183,11 @@ export async function getProtected() {
 
 ## Troubleshooting
 
-`Redis connection refused`: run `npm run docker:up` or start Redis locally with `redis-server --daemonize yes`.
+`Redis connection refused`: verify `REDIS_URL`, or omit it and check `REDIS_HOST`, `REDIS_PORT`, and `REDIS_PASSWORD`.
+
+`Prisma Client did not initialize`: run `npm run db:migrate`, then restart `npm run dev`.
 
-`Prisma Client did not initialize`: run `npm run prisma:migrate`, then restart `npm run dev`.
+`REDIS_URL=memory:// is for local development only`: configure a `redis://` or `rediss://` endpoint before running in production.
 
 `AUTHENIK8_SIGNING_JWKS must be a valid JSON array`: restore the generated `.env` value or provide an ES256 P-256 key ring and matching `AUTHENIK8_ACTIVE_KID`.
 
@@ -196,4 +205,4 @@ Read `THREAT_MODEL.md` before deploying. It explains what Authenik8 protects, wh
 
 ## Deploy
 
-Use `npm run build`, run `npx prisma migrate deploy` for production databases, set real secrets in your host, and point Redis/Postgres env vars at managed services.
+Use `npm run build`, run `npx prisma migrate deploy` for production databases, set `NODE_ENV=production`, store real secrets in your host, and point Redis/Postgres environment variables at managed services.

package/templates/express-auth/package.json

@@ -7,10 +7,11 @@
     "node": "^20.19 || ^22.12 || >=24"
   },
   "scripts": {
-    "dev": "ts-node-dev --respawn --transpile-only src/server.ts",
+    "dev": "tsx watch src/server.ts",
     "build": "tsc",
     "start": "node dist/server.js",
-    "prisma:migrate": "prisma migrate dev && prisma generate",
+    "db:migrate": "prisma db push && prisma generate",
+    "prisma:migrate": "prisma db push && prisma generate",
     "docker:up": "docker compose up -d --wait",
     "docker:down": "docker compose down"
   },
@@ -18,17 +19,20 @@
     "authenik8-core": "2.0.3",
     "dotenv": "^16.0.0",
     "express": "^4.19.2",
-    "@prisma/client": "7.8.0",
+    "@prisma/client": "7.9.0",
+    "ioredis": "^5.8.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
     "@types/node": "^26.0.1",
-    "ts-node-dev": "^2.0.0",
-    "typescript": "^5.0.0",
-     "prisma": "7.8.0"
+    "ioredis-mock": "8.13.1",
+    "prisma": "7.9.0",
+    "tsx": "^4.22.4",
+    "typescript": "^5.0.0"
   },
   "overrides": {
-    "@hono/node-server": "1.19.13"
+    "find-my-way": "9.7.0",
+    "valibot": "1.4.2"
   }
 }

package/templates/express-auth/src/config/redis.ts

@@ -0,0 +1,109 @@
+import Redis, { type Redis as RedisClient } from "ioredis";
+
+const localRedisUrl = "memory://";
+const redisOptions = {
+  connectTimeout: 5_000,
+  enableReadyCheck: true,
+  maxRetriesPerRequest: 2,
+};
+
+function externalRedisUrl(source: string): string {
+  let url: URL;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new Error("REDIS_URL must be memory://, redis://, or rediss://");
+  }
+
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") {
+    throw new Error("REDIS_URL must be memory://, redis://, or rediss://");
+  }
+
+  return source;
+}
+
+function redisPort(): number {
+  const port = Number(process.env.REDIS_PORT?.trim() || "6379");
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+    throw new Error("REDIS_PORT must be an integer from 1 to 65535");
+  }
+  return port;
+}
+
+function waitForRedis(client: RedisClient): Promise<RedisClient> {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let readinessCheckStarted = false;
+    const cleanup = () => {
+      client.off("ready", handleReady);
+      client.off("error", handleError);
+    };
+    const finish = (error?: Error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (error) {
+        client.disconnect();
+        reject(error);
+      } else {
+        resolve(client);
+      }
+    };
+    const handleReady = () => {
+      if (readinessCheckStarted) return;
+      readinessCheckStarted = true;
+      void client.ping().then(() => finish(), (error: Error) => finish(error));
+    };
+    const handleError = (error: Error) => finish(error);
+
+    client.once("ready", handleReady);
+    client.once("error", handleError);
+    if (client.status === "ready") handleReady();
+  });
+}
+
+export async function createRedisClient(): Promise<RedisClient> {
+  const redisUrl = process.env.REDIS_URL?.trim();
+  const nodeEnv = process.env.NODE_ENV?.trim() || "development";
+
+  const hasExternalRedisConfig = Boolean(
+    redisUrl ||
+      process.env.REDIS_HOST?.trim() ||
+      process.env.REDIS_PORT?.trim() ||
+      process.env.REDIS_PASSWORD?.trim(),
+  );
+
+  if (redisUrl === localRedisUrl && nodeEnv === "production") {
+    throw new Error(
+      "REDIS_URL=memory:// is for local development only; use redis:// or rediss:// in production",
+    );
+  }
+
+  const shouldUseMemoryRedis =
+    redisUrl === localRedisUrl ||
+    (!hasExternalRedisConfig && nodeEnv !== "production");
+
+  if (shouldUseMemoryRedis) {
+    const { default: RedisMock } = await import("ioredis-mock");
+    return new RedisMock() as unknown as RedisClient;
+  }
+
+  if (nodeEnv === "production" && !hasExternalRedisConfig) {
+    throw new Error(
+      "REDIS_URL=memory:// is for local development only; use redis:// or rediss:// in production",
+    );
+  }
+
+  if (redisUrl) {
+    return waitForRedis(new Redis(externalRedisUrl(redisUrl), redisOptions));
+  }
+
+  return waitForRedis(new Redis({
+    ...redisOptions,
+    host: process.env.REDIS_HOST?.trim() || "127.0.0.1",
+    port: redisPort(),
+    ...(process.env.REDIS_PASSWORD?.trim()
+      ? { password: process.env.REDIS_PASSWORD.trim() }
+      : {}),
+  }));
+}

package/templates/express-auth/src/server.ts

@@ -1,6 +1,7 @@
 import  dotenv  from "dotenv";
 import { createAuthenik8 } from "authenik8-core";
 import { createApp } from "./app";
+import { createRedisClient } from "./config/redis";
 import { agentIdentityConfig, authJwkConfig, requiredPort, requiredSecret } from "./utils/security";
 
 dotenv.config();
@@ -10,6 +11,7 @@ async function start() {
     jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
     agent: agentIdentityConfig(),
+    redis: await createRedisClient(),
   });
 
   const app = createApp(auth);

package/templates/express-auth+/README.md

@@ -6,12 +6,21 @@ Generated by `create-authenik8-app`.
 
 ```bash
 npm install
-npm run docker:up
-npm run prisma:migrate
+npm run db:migrate
 npm run dev
 ```
 
-For SQLite, Postgres in `docker-compose.yml` is optional. Redis is required for refresh-token rotation and replay protection.
+The generated local environment uses an in-process Redis-compatible store, so Redis and Docker are optional during development. If you selected PostgreSQL, start it with `npm run docker:up` or point `DATABASE_URL` to an existing instance before migrating.
+
+Validate the generated auth configuration and Redis connection at any time:
+
+```bash
+npx create-authenik8-app@latest doctor
+```
+
+`authenik8.json` records the generated architecture and Authenik8 engine version. It contains no secrets and should be committed with the project.
+
+After committing the package-manager lockfile, run `npx create-authenik8-app@latest add ci-github` to add the pinned Doctor and upgrade-policy workflow. Preview it first with `--dry-run`.
 
 ## Environment
 
@@ -27,12 +36,10 @@ AUTHENIK8_ISSUER=http://localhost:3000
 AUTHENIK8_AUDIENCE=your-app-api
 AUTHENIK8_AGENTS={}
 REFRESH_SECRET=<generated-random-secret>
-REDIS_HOST=127.0.0.1
-REDIS_PORT=6379
-AUTHENIK8_OAUTH_PROVIDERS=google,github
+REDIS_URL=memory://
 ```
 
-OAuth provider config is only required for providers listed in `AUTHENIK8_OAUTH_PROVIDERS`.
+OAuth provider config is only required for providers selected during generation.
 
 ```bash
 GOOGLE_CLIENT_ID=your-google-client-id
@@ -103,8 +110,7 @@ Authorization: Bearer <accessToken>
 Start the API in one terminal:
 
 ```bash
-npm run docker:up
-npm run prisma:migrate
+npm run db:migrate
 npm run dev
 ```
 
@@ -147,7 +153,7 @@ http://localhost:3000/auth/google
 http://localhost:3000/auth/github
 ```
 
-If a provider is not listed in `AUTHENIK8_OAUTH_PROVIDERS`, that provider route returns a clear `404` JSON response.
+Only provider routes selected during generation are included in the project.
 
 ## Environment Variables
 
@@ -157,9 +163,8 @@ If a provider is not listed in `AUTHENIK8_OAUTH_PROVIDERS`, that provider route
 - `AUTHENIK8_ISSUER` / `AUTHENIK8_AUDIENCE`: required claims checked during verification.
 - `AUTHENIK8_AGENTS`: optional JSON map of agent IDs to exact `resource:action` scopes; keep `{}` to disable agent identity. See `AGENT_IDENTITY.md`.
 - `REFRESH_SECRET`: signs refresh tokens. Use a different long random value in production.
-- `REDIS_HOST`: Redis host for refresh-token/session security.
-- `REDIS_PORT`: Redis port, usually `6379` locally.
-- `AUTHENIK8_OAUTH_PROVIDERS`: comma-separated enabled providers, for example `google`, `github`, or `google,github`.
+- `REDIS_URL`: use `memory://` for local development or `redis://` / `rediss://` for an external service. Production rejects `memory://`.
+- `REDIS_HOST` / `REDIS_PORT` / `REDIS_PASSWORD`: optional external Redis settings used when `REDIS_URL` is omitted.
 - `GOOGLE_REDIRECT_URI`: must exactly match the callback URL configured in Google Cloud.
 - `GITHUB_REDIRECT_URI`: must exactly match the callback URL configured in GitHub OAuth Apps.
 
@@ -223,9 +228,11 @@ The callback URL in `.env` must match the provider dashboard exactly, including
 
 ## Troubleshooting
 
-`Redis connection refused`: run `npm run docker:up` or start Redis locally with `redis-server --daemonize yes`.
+`Redis connection refused`: verify `REDIS_URL`, or omit it and check `REDIS_HOST`, `REDIS_PORT`, and `REDIS_PASSWORD`.
+
+`Prisma Client did not initialize`: run `npm run db:migrate`, then restart `npm run dev`.
 
-`Prisma Client did not initialize`: run `npm run prisma:migrate`, then restart `npm run dev`.
+`REDIS_URL=memory:// is for local development only`: configure a `redis://` or `rediss://` endpoint before running in production.
 
 `AUTHENIK8_SIGNING_JWKS must be a valid JSON array`: restore the generated `.env` value or provide an ES256 P-256 key ring and matching `AUTHENIK8_ACTIVE_KID`.
 
@@ -233,9 +240,9 @@ The callback URL in `.env` must match the provider dashboard exactly, including
 
 `OAuth redirect_uri_mismatch`: copy the callback URL from `.env` into the provider dashboard exactly.
 
-`github OAuth is not configured`: add `github` to `AUTHENIK8_OAUTH_PROVIDERS` and set the GitHub env vars, or use only the enabled provider route.
+`GitHub OAuth is not configured`: set the GitHub client ID, secret, and callback URL in `.env`.
 
-`google OAuth is not configured`: add `google` to `AUTHENIK8_OAUTH_PROVIDERS` and set the Google env vars, or use only the enabled provider route.
+`Google OAuth is not configured`: set the Google client ID, secret, and callback URL in `.env`.
 
 `Port 3000 already in use`: stop the other process or set `PORT` in `.env`.
 
@@ -247,4 +254,4 @@ Read `THREAT_MODEL.md` before deploying. It explains what Authenik8 protects, wh
 
 ## Deploy
 
-Use `npm run build`, run `npx prisma migrate deploy` for production databases, set real secrets in your host, and point Redis/Postgres env vars at managed services.
+Use `npm run build`, run `npx prisma migrate deploy` for production databases, set `NODE_ENV=production`, store real secrets in your host, and point Redis/Postgres environment variables at managed services.

package/templates/express-auth+/package.json

@@ -7,10 +7,11 @@
     "node": "^20.19 || ^22.12 || >=24"
   },
   "scripts": {
-    "dev": "ts-node-dev --respawn --transpile-only src/server.ts",
+    "dev": "tsx watch src/server.ts",
     "build": "tsc",
     "start": "node dist/server.js",
-    "prisma:migrate": "prisma migrate dev && prisma generate",
+    "db:migrate": "prisma db push && prisma generate",
+    "prisma:migrate": "prisma db push && prisma generate",
     "docker:up": "docker compose up -d --wait",
     "docker:down": "docker compose down"
   },
@@ -18,17 +19,20 @@
     "authenik8-core": "2.0.3",
     "dotenv": "^16.0.0",
     "express": "^4.19.2",
-    "@prisma/client": "7.8.0",
+    "@prisma/client": "7.9.0",
+    "ioredis": "^5.8.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
     "@types/node": "^26.0.1",
-    "ts-node-dev": "^2.0.0",
-    "typescript": "^5.0.0",
-     "prisma": "7.8.0"
+    "ioredis-mock": "8.13.1",
+    "prisma": "7.9.0",
+    "tsx": "^4.22.4",
+    "typescript": "^5.0.0"
   },
   "overrides": {
-    "@hono/node-server": "1.19.13"
+    "find-my-way": "9.7.0",
+    "valibot": "1.4.2"
   }
 }

package/templates/express-auth+/src/auth/auth.ts

@@ -1,5 +1,6 @@
 import { createAuthenik8 } from "authenik8-core";
 import dotenv  from "dotenv";
+import { createRedisClient } from "../config/redis";
 import { agentIdentityConfig, authJwkConfig, requiredSecret } from "../utils/security";
 
 dotenv.config();
@@ -15,6 +16,7 @@ export async function initAuth() {
     jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
     agent: agentIdentityConfig(),
+    redis: await createRedisClient(),
     oauth: oauthConfig(),
   });
 

package/templates/express-auth+/src/auth/controllers/password.controller.ts

@@ -2,7 +2,7 @@ import { Request, Response } from "express";
 import { getAuth } from "../auth";
 import { prisma } from "../../prisma/client";
 import { hashPassword, comparePassword } from "../../utils/hash";
-import { parseCredentials } from "../../utils/security";
+import { parseCredentials, parseRefreshToken } from "../../utils/security";
 
 export const passwordController = {
   async register(req: Request, res: Response) {
@@ -48,4 +48,15 @@ export const passwordController = {
       res.status(401).json({ error: "Invalid credentials" });
     }
   },
+
+  async refresh(req: Request, res: Response) {
+    try {
+      const refreshToken = parseRefreshToken(req.body);
+      const tokens = await getAuth().refreshToken(refreshToken);
+
+      res.json(tokens);
+    } catch {
+      res.status(401).json({ error: "Invalid refresh token" });
+    }
+  },
 };

package/templates/express-auth+/src/auth/routes/password.route.ts

@@ -5,5 +5,6 @@ const router = express.Router();
 
 router.post("/register", passwordController.register);
 router.post("/login", passwordController.login);
+router.post("/refresh", passwordController.refresh);
 
 export default router;