create-ej-app 26.0.0 → 27.0.0

package/README.md

@@ -1,6 +1,6 @@
 # create-ej-app
 
-A no-bullshit CLI to bootstrap production-ready **fucking beasts** of apps with Next.js, Better Auth, Drizzle ORM, Elysia, Workflow, shadcn/ui, React Email, OTEL, and deployment wired up so you don’t screw your shit up in production.
+CLI to bootstrap production-ready apps with Next.js, Better Auth, Drizzle ORM, Elysia, Workflow, shadcn/ui, React Email, OpenTelemetry, and deployment already wired up.
 
 ```bash
 bunx create-ej-app@latest
@@ -8,326 +8,225 @@ bunx create-ej-app@latest
 
 ---
 
-## ✨ Features (aka the good shit)
+## Features
 
-- **Next.js 16** – Powered by React 19, Server Components, App Router. Fast as hell.
-
-- **Better Auth** – Auth that doesn’t suck:
-  - Email/Password
-  - Magic link (because passwords are annoying as fuck)
-  - OAuth with GitHub and Google
+- **Next.js 16**: React 19, Server Components, App Router
+- **Better Auth**:
+  - Magic link
+  - GitHub and Google OAuth
   - Account linking
-  - Admin powers
-
-- **Drizzle ORM** – Type-safe SQL over PostgreSQL without the usual ORM garbage.
-
-- **Elysia** – Built for Bun. Minimal, fast, no nonsense.
-
-- **Workflow** – Durable jobs so your background tasks don’t randomly die like weak shit.
-
-- **React Email** – Build transactional emails using React components instead of ugly HTML nightmares.
-
-- **OTEL (OpenTelemetry)** – Production-grade observability:
-  - Distributed tracing
-  - Metrics
-  - Structured logs
-  - Works with GCP, Datadog, Honeycomb, Grafana, etc.
-
-- **shadcn/ui** – Clean, accessible components built on Radix UI.
-
-- **TailwindCSS 4** – Utility-first styling with zero CSS drama.
-
-- **TypeScript** – Strict types so you don’t ship dumb bugs.
-
-- **TanStack Query** – Server state that doesn’t implode.
-
-- **Lucide React** – Icons that don’t look like 2009 garbage.
-
-- **Docker + Terraform** – Ship this shit properly.
-
-- Terraform setup for Google Cloud Platform so you don’t YOLO infra.
+  - `user`, `admin`, and `superadmin` roles
+  - Organizations (SaaS starter)
+- **Drizzle ORM**: type-safe SQL over PostgreSQL
+- **Stripe**: subscriptions, trials, and the billing portal (SaaS starter)
+- **Elysia**: HTTP APIs on Bun
+- **Workflow**: durable background jobs
+- **React Email**: transactional emails as React components
+- **OpenTelemetry**: traces with one wide event per server action
+- **shadcn/ui**: accessible components on Radix UI
+- **Tailwind CSS 4**
+- **TypeScript**: strict mode
+- **TanStack Query**
+- **Bun tests on PGlite**: in-memory Postgres, no database server needed
+- **Docker**
 
 ---
 
-## 📋 Templates (Pick your poison)
+## Templates
+
+### Next.js full-stack app (`nextjs`)
 
-Choose your template based on what you’re building:
+Next.js 16, Better Auth, shadcn/ui, and Drizzle ORM. Use it for web apps that need sign-in, an admin panel, and server actions.
 
-### Next.js Full-Stack App
+### SaaS starter (`saas-starter`)
 
-Full-stack setup with Next.js 16, Better Auth, shadcn/ui, and Drizzle ORM. Perfect for web apps that need auth, UI, and backend APIs.
+Everything in `nextjs`, plus organizations with invitations and roles, Stripe subscriptions with trials and the billing portal, R2 uploads, support tickets, in-app feedback, and a contact form.
 
-### API Server
+### API server (`api`)
 
-Production-ready REST API built with Elysia on Bun, Drizzle ORM, PostgreSQL, and Zod validation. Perfect for headless APIs, microservices, internal tools, or that backend you actually want to scale without it exploding like fragile shit.
+REST API with Elysia on Bun, Drizzle ORM, PostgreSQL, and Zod validation. Use it for headless APIs, internal tools, and services.
 
 ---
 
-## 🚀 Quick Start (Let’s fucking go)
+## Quick start
 
 ```bash
 bunx create-ej-app@latest
 ```
 
-You’ll be prompted for:
+You will be prompted for:
 
 - Project name
 - Description
-- Template (nextjs or api)
-- Git init (because not using git in 2026 is wild)
+- Template (`nextjs`, `saas-starter`, or `api`)
+- Whether to initialize git
 
 Example:
 
-```bash
-? Enter the project name: badass-app
-? Enter a description: My savage Next.js monster
+```text
+? Enter the project name: my-app
+? Enter a description for the project: Production-ready Next.js app
 ? Select a template: nextjs
 ? Initialize a git repository? yes
 ```
 
-Boom. Done.
-
 ---
 
-## 📦 What You Actually Get
+## What you get
 
-### Next.js Full-Stack Template
+### Next.js and SaaS templates
 
-**Tech Stack (The real weapons)**
+| Layer         | Stack                                             |
+| ------------- | ------------------------------------------------- |
+| Framework     | Next.js 16, React 19, React Compiler              |
+| Runtime       | Bun                                               |
+| Database      | PostgreSQL + Drizzle ORM                          |
+| Auth          | Better Auth: magic link, GitHub, Google, roles    |
+| Actions       | next-safe-action with role-based clients          |
+| Errors        | `AppError` with customer-safe messages            |
+| Observability | OpenTelemetry, one wide event per action          |
+| Email         | React Email + Nodemailer, sent by Workflow        |
+| UI            | shadcn/ui, Tailwind CSS 4, dark mode, Geist fonts |
+| Data fetching | TanStack Query + nuqs URL state                   |
+| Forms         | react-hook-form + Zod                             |
+| Tests         | Bun tests on in-memory Postgres (PGlite)          |
+| Agent docs    | `AGENTS.md` and `CLAUDE.md` with project rules    |
 
-- **Framework**: Next.js
-- **Runtime**: Bun (fast as shit)
-- **Backend**: Elysia APIs
-- **Database**: PostgreSQL + Drizzle
-- **Auth**: Better Auth
-- **Emails**: React Email (transactional + auth templates ready)
-- **Observability**: OpenTelemetry
-- **Background Jobs**: Workflow
-- **UI**: shadcn/ui
-- **Styling**: TailwindCSS
-- **State**: TanStack Query
-- **Forms**: react-hook-form + Zod
-- **Theme**: Dark mode out of the box
+Both templates ship with:
 
-### API Server Template
+- An admin panel with user management, impersonation, and ban controls
+- Profile page, error pages, 404 page, robots.txt, and sitemap
+- A seed script, a database reset script, and focused tests
+- A test that fails when a client component imports server-only code
+- A test that fails when a foreign key has no index or delete rule
 
-**Tech Stack (The real weapons)**
+The SaaS starter adds:
 
-- **Runtime**: Bun (blazing fast as fuck)
-- **Framework**: Elysia
-- **Database**: PostgreSQL + Drizzle ORM
-- **Validation**: Zod v4
-- **API Docs**: Auto-generated OpenAPI docs
-- **Containerisation**: Docker with distroless images
-- **Type Checking**: TypeScript with strict mode
-- **Formatting**: Prettier
-- **Environment**: Validated env vars with @t3-oss/env-core
+- Organizations with owner, admin, and member roles, plus email invitations
+- Stripe Checkout, trials, the billing portal, and idempotent webhooks
+- Per-plan member limits
+- Organization logos on Cloudflare R2, with ownership checks on every upload
+- Support tickets shared by organization managers and answered from the admin panel
+- In-app feedback and a public contact form, each with an admin inbox
+
+### API server template
+
+| Layer       | Stack                                      |
+| ----------- | ------------------------------------------ |
+| Runtime     | Bun                                        |
+| Framework   | Elysia                                     |
+| Database    | PostgreSQL + Drizzle ORM                   |
+| Validation  | Zod v4                                     |
+| API docs    | Auto-generated OpenAPI                     |
+| Containers  | Docker, distroless images                  |
+| Types       | TypeScript, strict mode                    |
+| Formatting  | Prettier                                   |
+| Environment | Validated env vars with `@t3-oss/env-core` |
 
 ---
 
-## 🛠 Setup & Development
+## Setup
 
 ### Prerequisites
 
-- Node 24+ or Bun
-- PostgreSQL running
-- OAuth creds if you want GitHub/Google login (Next.js template)
-- Email provider (Resend, SES, Postmark, etc.) (Next.js template)
+- [Bun](https://bun.sh/): the template scripts, tests, and Dockerfiles run on it
+- PostgreSQL
+- OAuth credentials for GitHub and Google (Next.js and SaaS templates)
+- SMTP credentials from a provider such as Resend, SES, or Postmark (Next.js and SaaS templates)
+- A Stripe account and the Stripe CLI (SaaS template)
 
 ### Install
 
 ```bash
 cd my-app
 bun install
-# or npm / pnpm / yarn if that’s your thing
 ```
 
----
-
-### Environment Variables
+Bun is required: the templates' scripts and Dockerfiles call `bun` directly.
 
-Copy `.env.example` → `.env` and fill your secrets like a responsible adult.
+### Environment variables
 
-Don’t commit this crap. Seriously.
+The CLI creates `.env` from `.env.example` with a random `BETTER_AUTH_SECRET`. Fill in the rest, and never commit `.env`.
 
 ---
 
-## 💻 Development
+## Development
 
-### Next.js Template
+### Next.js and SaaS templates
 
 ```bash
 bun run dev
 ```
 
-Open `http://localhost:3000` and admire your badass setup.
+App: `http://localhost:3000`
 
-### API Template
+### API template
 
 ```bash
 bun run dev
 ```
 
-API runs on `http://localhost:3000`. OpenAPI docs at `http://localhost:3000/docs`.
-
-Fire it up, hit the endpoints, break things on purpose, and watch it handle your shit properly.
+API: `http://localhost:3000`
+OpenAPI docs: `http://localhost:3000/docs`
 
 ---
 
-## 🐳 Docker (Ship it like a pro)
+## Docker
 
 ```bash
 bun run build:docker
-docker run -p 3000:3000 my-awesome-project
-```
-
-No "works on my machine" bullshit anymore.
-
----
-
-## ☁️ Infrastructure (The Cloud Shit) - Next.js Template
-
-Terraform config included for:
-
-- Cloud Run
-- Cloud SQL
-- Artifact Registry
-- Cloud Build
-- Secret Manager
-- Load Balancer
-- VPC
-
-Deploy it:
-
-```bash
-cd terraform
-terraform init
-terraform apply
+docker run --env-file .env -p 3000:3000 my-app
 ```
 
-And now you’re running production infra like a grown-ass engineer.
+The Next.js and SaaS images are tagged `my-app` and the API image `my-api`; change the tag in `package.json`. The build uses `.env.example` values, so pass real ones at run time with `--env-file`. Run `bun install` first so `bun.lock` exists.
 
 ---
 
-## 🔐 Authentication - Next.js Template
-
-Better Auth gives you:
+## Next.js and SaaS templates
 
-- Email/Password login
-- Magic links (no password drama)
-- OAuth (GitHub, Google)
-- Admin panel
-- User impersonation
+Each generated project documents itself. Read these first:
 
-Secure, extensible, no duct-taped auth spaghetti.
+- `README.md`: setup steps and commands
+- `AGENTS.md`: architecture, authorization rules, and writing rules for you and for coding agents
+- `src/lib/siteConfig.ts`: product name, description, and contact email
+- `src/db/schema.ts`: database schema
 
----
-
-## 🎨 UI Components - Next.js Template
-
-Preinstalled:
-
-- Button
-- Card
-- Form
-- Input
-- Toast notifications
+Push the schema with `bun run db:push`, seed it with `bun run db:seed`, and run the tests with `bun test`.
 
-Need more?
+Add shadcn components with:
 
 ```bash
-bunx shadcn@latest add [component-name]
+bunx shadcn@latest add your_component_name
 ```
 
-Ship beautiful shit without reinventing buttons for the 900th time.
-
----
-
-## 🎯 Route Groups - Next.js Template
-
-Organized like a sane human:
-
-- `(admin)` – Admin dashboard
-- `(app)` – Main app (auth required)
-- `(auth)` – Login/signup
-- `(marketing)` – Public pages
-
-No messy folder hell.
-
----
-
-## 🔧 Customization
-
-### Next.js Template
-
-Edit:
-
-- `siteConfig.ts` – change name/description
-- `schema.ts` – change DB schema
-- `auth.ts` – tweak providers
-
-Then push schema and move on with your life.
-
-### API Template
-
-Edit:
-
-- `src/db/schema.ts` – change DB schema and model your data like a boss
-- `src/routes/` – add new API endpoints and wire your logic properly
-- `src/env.ts` – add new env vars and validate that shit
-
-Push schema with `bun run db:push` and type-check with `bun run type-check`.
-
----
-
-## 🏗️ API Template Architecture
-
-Built with a clean layered architecture (no spaghetti garbage):
-
-- **Routes** (`src/routes/`) – HTTP endpoints, validation, call data-access. Keep it sharp.
-- **Data-Access** (`src/data-access/`) – Direct DB interactions per resource. No random queries scattered like WTF.
-- **Database** (`src/db/`) – Drizzle client, schemas, reusable fields. Your source of truth.
-- **Library** (`src/lib/`) – Shared utilities and Zod schemas so you don’t duplicate crap everywhere.
-
-Includes a full CRUD API for todos with pagination, sorting, search, and OpenAPI docs so you can see your shit documented without extra effort.
-
-### API Commands
-
-- `bun run dev` – Start dev server with hot-reload
-- `bun run build` – Type-check and compile to native binary
-- `bun run type-check` – Run TypeScript checker
-- `bun run db:push` – Push schema to DB
-- `bun run db:studio` – Open Drizzle Studio
-- `bun run db:seed` – Seed database
-
 ---
 
-## 🤝 Contributing
+## API template architecture
 
-PRs welcome. Don’t submit half-broken shit.
+- **Routes** (`src/routes/`): HTTP, validation, call data-access
+- **Data-access** (`src/data-access/`): database access per resource
+- **Database** (`src/db/`): Drizzle client, schemas, shared fields
+- **Library** (`src/lib/`): shared utilities and Zod schemas
 
----
+Includes a sample todos CRUD API with pagination, sorting, search, and OpenAPI docs.
 
-## 📄 License
+### API commands
 
-MIT. Do whatever the hell you want, just don’t blame us if you screw it up.
+| Command              | Purpose                    |
+| -------------------- | -------------------------- |
+| `bun run dev`        | Dev server with hot reload |
+| `bun run build`      | Type-check and compile     |
+| `bun run type-check` | TypeScript check           |
+| `bun run db:push`    | Push schema                |
+| `bun run db:studio`  | Drizzle Studio             |
+| `bun run db:seed`    | Seed the database          |
 
 ---
 
-## 🔗 Links
+## Contributing
 
-- Repository: [https://github.com/ejekanshjain/create-ej-app](https://github.com/ejekanshjain/create-ej-app)
-- Issues: [https://github.com/ejekanshjain/create-ej-app/issues](https://github.com/ejekanshjain/create-ej-app/issues)
-- Docs:
-  - [Next.js](https://nextjs.org/docs)
-  - [Better Auth](https://better-auth.com)
-  - [Drizzle ORM](https://orm.drizzle.team)
-  - [Elysia](https://elysiajs.com)
-  - [Workflow](https://useworkflow.dev)
-  - [shadcn/ui](https://ui.shadcn.com)
-  - [React Email](https://react.email)
-  - [Logging](https://loggingsucks.com)
+Pull requests are welcome. Please keep changes focused and working.
 
----
+## License
 
-Now go build some badass production-ready shit instead of another half-baked side project. 🚀
+MIT.

package/cli.ts

@@ -2,6 +2,7 @@
 
 import { execSync } from 'child_process'
 import { program } from 'commander'
+import { randomBytes } from 'crypto'
 import enquirer from 'enquirer'
 import fs from 'fs'
 import path from 'path'
@@ -16,6 +17,25 @@ interface Response {
   git: string
 }
 
+/**
+ * Local build and install output that must never reach a new project, even
+ * when the CLI runs from a checkout where a template was built or installed.
+ */
+const SKIPPED_TEMPLATE_PATHS = new Set([
+  'node_modules',
+  '.next',
+  '.swc',
+  'out',
+  'build',
+  '.env',
+  'next-env.d.ts',
+  // Generated by the Workflow SDK on every build
+  path.join('src', 'app', '.well-known')
+])
+
+/** Template files whose `{{PROJECT_NAME}}` and `{{PROJECT_DESCRIPTION}}` get filled in. */
+const PLACEHOLDER_FILES = ['README.md', 'AGENTS.md']
+
 const detectPackageManager = () => {
   const userAgent = process.env.npm_config_user_agent
 
@@ -41,18 +61,10 @@ const getInstallCommand = (packageManager: string) => {
   }
 }
 
-const getDevCommand = (packageManager: string) => {
-  switch (packageManager) {
-    case 'pnpm':
-      return 'pnpm dev'
-    case 'yarn':
-      return 'yarn dev'
-    case 'bun':
-      return 'bun dev'
-    default:
-      return 'npm run dev'
-  }
-}
+const getRunCommand = (packageManager: string, script: string) =>
+  packageManager === 'npm'
+    ? `npm run ${script}`
+    : `${packageManager} run ${script}`
 
 program.action(async () => {
   const response: Response = await enquirer.prompt([
@@ -60,7 +72,12 @@ program.action(async () => {
       type: 'input',
       name: 'projectName',
       message: 'Enter the project name:',
-      initial: 'my-project'
+      initial: 'my-project',
+      // The name becomes a directory and the package.json name, so keep it
+      // to characters that are safe for both.
+      validate: (value: string) =>
+        /^[a-z0-9][a-z0-9._-]{0,213}$/.test(value) ||
+        'Use lowercase letters, numbers, dots, hyphens, and underscores.'
     },
     {
       type: 'input',
@@ -76,16 +93,16 @@ program.action(async () => {
         {
           name: 'nextjs',
           message:
-            'Full Stack setup with Next 16, Better Auth, shadcn and Drizzle'
+            'Full-stack Next.js 16 app with Better Auth, an admin panel, shadcn/ui, and Drizzle'
         },
         {
           name: 'saas-starter',
           message:
-            'SaaS Starter with Stripe, Next 16, Better Auth, shadcn and Drizzle'
+            'SaaS starter with organizations, Stripe, support tickets, Better Auth, shadcn/ui, and Drizzle'
         },
         {
           name: 'api',
-          message: 'API Server setup with Elysia, Drizzle, Typescript'
+          message: 'API server with Elysia, Drizzle, and TypeScript'
         }
       ]
     },
@@ -102,14 +119,26 @@ program.action(async () => {
   const projectDir = path.join(process.cwd(), projectName)
 
   if (fs.existsSync(projectDir)) {
-    console.error(`Error: Directory '${projectName}' already exists.`)
+    console.error(
+      `Directory '${projectName}' already exists. Choose another project name or remove the directory.`
+    )
     process.exit(1)
   }
 
   fs.mkdirSync(projectDir)
 
   const templateDir = path.join(__dirname, 'template', template)
-  fs.cpSync(templateDir, projectDir, { recursive: true })
+  fs.cpSync(templateDir, projectDir, {
+    recursive: true,
+    filter: source => {
+      const relative = path.relative(templateDir, source)
+      return (
+        !SKIPPED_TEMPLATE_PATHS.has(relative) &&
+        !relative.split(path.sep).includes('node_modules') &&
+        !relative.endsWith('.tsbuildinfo')
+      )
+    }
+  })
 
   const renameGitignore = (dir: string) => {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -127,20 +156,36 @@ program.action(async () => {
   const packageJson = JSON.parse(fs.readFileSync(packageJsonFile, 'utf-8'))
   packageJson.name = projectName
   packageJson.description = description
-  fs.writeFileSync(packageJsonFile, JSON.stringify(packageJson, null, 2))
+  fs.writeFileSync(packageJsonFile, `${JSON.stringify(packageJson, null, 2)}\n`)
 
+  // Better Auth warns about weak secrets, so every project gets a random one.
   const envExampleFile = path.join(projectDir, '.env.example')
   const envExample = fs.readFileSync(envExampleFile, 'utf-8')
-  fs.writeFileSync(path.join(projectDir, '.env'), envExample)
-
   fs.writeFileSync(
-    path.join(projectDir, 'README.md'),
-    `# ${projectName}
-
-${description}
-`
+    path.join(projectDir, '.env'),
+    envExample.replace(
+      /^BETTER_AUTH_SECRET=.*$/m,
+      `BETTER_AUTH_SECRET="${randomBytes(32).toString('base64')}"`
+    )
   )
 
+  for (const file of PLACEHOLDER_FILES) {
+    const filePath = path.join(projectDir, file)
+    if (!fs.existsSync(filePath)) continue
+    fs.writeFileSync(
+      filePath,
+      fs
+        .readFileSync(filePath, 'utf-8')
+        .replaceAll('{{PROJECT_NAME}}', projectName)
+        .replaceAll('{{PROJECT_DESCRIPTION}}', description)
+    )
+  }
+
+  const readmeFile = path.join(projectDir, 'README.md')
+  if (!fs.existsSync(readmeFile)) {
+    fs.writeFileSync(readmeFile, `# ${projectName}\n\n${description}\n`)
+  }
+
   if (git === 'yes') {
     try {
       execSync('git init', { cwd: projectDir, stdio: 'inherit' })
@@ -151,22 +196,27 @@ ${description}
 
   const pm = detectPackageManager()
   const installCommand = getInstallCommand(pm)
-  const devCommand = getDevCommand(pm)
+  const devCommand = getRunCommand(pm, 'dev')
+  const dbPushCommand = getRunCommand(pm, 'db:push')
 
   console.log(
     `
 Created a new app called '${projectName}' 🎉
 
-To open the project in vscode run:
+To open the project in VS Code, run:
 
 code ${projectName}
 
 
-To get started, run the following commands:
+To get started, run these commands:
 cd ${projectName}
 
 ${installCommand}
 
+Fill in the values in .env, then create the database tables:
+
+${dbPushCommand}
+
 ${devCommand}
 
 Happy coding! 🚀

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ej-app",
-  "version": "26.0.0",
+  "version": "27.0.0",
   "description": "Bootstrap a next.js app with my preferred setup",
   "main": "cli.js",
   "type": "module",
@@ -36,7 +36,7 @@
     "enquirer": "^2.4.1"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.6.2",
     "typescript": "^6.0.3"
   }
 }

package/template/api/.vscode/settings.json

@@ -1,3 +1,3 @@
 {
-  "typescript.experimental.useTsgo": true
+  "js/ts.experimental.useTsgo": true
 }

package/template/api/{.github/copilot-instructions.md → AGENTS.md}

@@ -1,5 +1,3 @@
-# Copilot Instructions
-
 ## Project Overview
 
 This project is a production-ready REST API built with **Elysia** on the **Bun** runtime. It uses **Drizzle ORM** with **PostgreSQL**, **Zod v4** for validation, and ships with auto-generated OpenAPI docs.