create-ej-app 26.0.0 → 28.0.0

package/template/api/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/api/package.json

@@ -7,25 +7,25 @@
     "dev": "bun --watch .",
     "build": "bun type-check && bun build --compile --target bun --outfile server .",
     "build:docker": "docker build -t my-api .",
-    "type-check": "tsgo --incremental false",
+    "type-check": "tsc --incremental false",
     "format": "prettier --write \"./src/**/*.{js,cjs,mjs,jsx,ts,tsx}\"",
     "db:push": "drizzle-kit push",
     "db:studio": "drizzle-kit studio",
     "db:seed": "bun ./src/scripts/seed.ts"
   },
   "dependencies": {
-    "@elysiajs/openapi": "1.4.15",
+    "@elysiajs/openapi": "1.4.16",
     "@t3-oss/env-core": "0.13.11",
-    "drizzle-orm": "0.45.2",
-    "elysia": "1.4.28",
-    "zod": "4.4.3"
+    "drizzle-orm": "0.45.3",
+    "elysia": "1.4.30",
+    "zod": "4.6.5"
   },
   "devDependencies": {
-    "@types/bun": "1.3.14",
-    "@typescript/native-preview": "7.0.0-dev.20260614.1",
-    "drizzle-kit": "0.31.10",
+    "@types/bun": "1.4.2",
+    "drizzle-kit": "0.31.11",
     "postgres": "3.4.9",
-    "prettier": "3.8.4",
-    "prettier-plugin-organize-imports": "4.3.0"
+    "prettier": "3.9.9",
+    "prettier-plugin-organize-imports": "4.3.0",
+    "typescript": "7.0.2"
   }
 }

package/template/nextjs/.dockerignore

@@ -1,3 +1,4 @@
+.git
 node_modules
 .next
 out

package/template/nextjs/AGENTS.md

@@ -0,0 +1,260 @@
+# AGENTS.md
+
+Shared guidance for agentic coding tools working in this repository.
+
+## What is this project
+
+{{PROJECT_DESCRIPTION}}
+
+It is a full-stack Next.js app built on the `nextjs` template from `create-ej-app`. People sign in with a magic link or OAuth, and platform admins manage users from an admin panel.
+
+## Coding preferences
+
+- Keep things simple. Channel "yagni" energy unless told otherwise.
+- Don't export a function or type, or define a type, that nothing uses.
+- Type safety is useful; take advantage of it.
+- Don't write code that introduces security vulnerabilities. Include authorization checks and input validation, and follow security best practices.
+- Don't be scared to propose bold ideas or breaking changes if they can meaningfully benefit our work.
+- Be careful with destructive actions I haven't explicitly requested.
+- Write performant, optimized code.
+- Don't hardcode limits, labels, or repeated values. Put them in `src/lib/constants.ts` or the matching registry, and read them from there in the UI, validation, tests and docs so one change updates every place.
+- Tests are good! Endless smoke tests and "regression tests" for feature deletions are much less good. Tests should be focused, not slop.
+- Comments are a great way to clarify functionality and how code is used. Don't comment every line. Concisely describe how functions and classes are used above their definitions, and explain only the tricky lines.
+- If you need a paragraph-long comment to justify why a workaround is OK, the code is wrong. Fix the code unless I tell you otherwise.
+- When designing or building something new, ask me about any design or flow decision you're unsure about, unless the answer is obvious. I'd rather clarify upfront than redo work built on an assumption. When you ask, give your recommendation and suggested answers so I can confirm, redirect, or decide.
+- Report any bug, problem, or security issue you notice anywhere in the codebase, even if it's unrelated to the current work. Don't silently fix or ignore it.
+
+## Writing guidelines
+
+These cover every word that ships: UI copy, dialog and page titles, toasts, validation and error messages, emails, code comments, commit messages, PR descriptions, and Markdown in the repo.
+
+**Fix the English you notice.** Typos, awkward phrasing, and copy that breaks these rules get fixed on sight, even outside the task you were given. This is the one exception to the reporting rule above. Bugs and security issues are still reported rather than silently changed; wording is not.
+
+### Casing
+
+Title Case for headings, page and section titles, dialog titles, nav labels, button labels, and table column headers: `Edit User`, `Save Changes`, not `Edit user` or `Save changes`. Sentence case for body copy, descriptions, field labels, helper text, validation messages, and Markdown headings in repo docs.
+
+### Voice
+
+- Active voice, present tense. Append "by monkeys" as a test: if the sentence still parses, rewrite it.
+- Address the reader as `you`, never "the user".
+- Imperative for actions: "Select a role", not "You will need to select a role".
+- Aim under 20 words per sentence. Paragraphs of 2 to 4 sentences, one idea each. Contractions are welcome.
+- No rhetorical questions.
+- Don't open a paragraph by recapping the previous one: "With that in place…".
+- Don't have machines perform human actions: "the browser fetches the URL", not "hand the browser a URL".
+- Commit subjects are lowercase imperative sentences.
+- Don't include `Co-authored-by` or similar attribution trailers in commit messages or descriptions.
+- Avoid repeating the same information across UI copy on a page. Give each heading, description, and helper text a distinct purpose.
+
+### Words to cut
+
+- `easy`, `simple`, `quick`: name the concrete thing instead, such as "one command" or "default settings".
+- `very`, `just`, `really`, `simply`: filler.
+- Vague quantifiers such as `many`, `often`, `typically`, `significantly`, `near-zero`, and `sub-second`: give the number or the specific claim.
+- Metaphor verbs such as `lands`, `carries`, `hits`, and `flows through`: name the literal action.
+- Spec-sheet phrasing: "provides", "is configurable", "is explicitly labeled".
+
+### Punctuation and units
+
+- No em dashes or curly quotes. Use a colon, a comma, or a period, or rewrite the sentence.
+- Ellipsis character `…`, never three dots. Loading states end with it: `Saving…`.
+- Units take a space and an uppercase symbol: `64 KB`, `200 ms`. Seconds stay bare: `30s`.
+
+### Emphasis and code
+
+- Bold marks a UI element or a critical fact, never emphasis.
+- Inline code for paths, identifiers, file extensions, and short snippets.
+- Code blocks carry a language tag, stay under 25 lines, and are explained in prose.
+- Placeholders are descriptive `snake_case`: `your_access_token_here`, never `<TOKEN>` or `xxx`.
+
+### Lists
+
+- Introduce every list with a colon.
+- Three or more list-shaped items in a paragraph become a list.
+- No trailing period on a fragment; keep it on a full sentence.
+- Bold term then colon for definitions: `- **Term**: description`.
+
+### Error and toast messages
+
+Name the subject, the action, and the consequence. No apologies. For customer-facing copy, say what happened and what to do next: "Another account already uses this email address. Sign in with it instead." Never "Error" or "Something went wrong" on its own. Keep internals out of anything a customer reads: no table names, stack traces, or raw IDs.
+
+## Commands
+
+```bash
+bun run dev          # Start Next.js dev server
+bun run build        # Production build
+bun run lint         # ESLint
+bun run type-check   # TypeScript check (tsgo)
+bun run format       # Prettier
+
+bun run db:push      # Apply the schema
+bun run db:studio    # Open Drizzle Studio
+bun run db:seed      # Seed a superadmin and a user
+bun run db:reset     # Drop every table (refuses in production)
+
+bun test             # Bun tests against in-memory PGlite
+bun run test:real    # Same suite against real Postgres (TEST_DATABASE=postgres)
+bun run email:dev    # React Email preview server (src/emails/)
+bun run email:test you@example.com  # Send one test email
+```
+
+Do not start the dev server or any other long-running process unless asked.
+
+After editing code, run `bunx prettier --write` on the files you touched, or `bun run format` after a broad refactor.
+
+## Environment variables
+
+All app env is defined and validated in [src/env.ts](src/env.ts) via `@t3-oss/env-nextjs`. Add a variable there and to `.env.example` in the same change.
+
+## Architecture
+
+**Stack:** Next.js 16 App Router, React 19, TypeScript, Drizzle ORM (PostgreSQL), Better Auth (admin plugin), shadcn/ui, Tailwind CSS 4, Zod, next-safe-action, TanStack Query, Workflow, React Email.
+
+**Path alias:** `~/` maps to `src/`.
+
+### Route groups
+
+| Group         | URL prefix           | Purpose                 |
+| ------------- | -------------------- | ----------------------- |
+| `(marketing)` | `/`                  | Landing and legal pages |
+| `(auth)`      | `/login`, `/profile` | Sign-in and profile     |
+| `(app)`       | `/app/...`           | Signed-in product       |
+| `(admin)`     | `/admin/...`         | Platform admin panel    |
+
+### Server actions
+
+All server actions use `next-safe-action` with layered clients defined in [src/lib/safe-action.ts](src/lib/safe-action.ts):
+
+- `actionClient`: injects the auth session into `ctx`; no authentication required
+- `authActionClient`: requires an authenticated user
+- `adminActionClient`: requires the `admin` or `superadmin` system role
+- `superAdminActionClient`: requires the `superadmin` system role
+
+Actions live beside their routes in `actions/` directories; put actions shared across route groups in `src/app/actions/`. Keep Zod schemas for actions in a separate validation file (such as `admin/settings/users/validation.ts`) so client forms can import them.
+
+No page or layout under `src/app` imports `~/db` directly. Fetch through an action whose client enforces the right role, then call `notFound()` when it returns no data. An ancestor layout check is not enough: the `/admin` layout checks only `isAdmin`, so any page trusting it stays open to a plain admin.
+
+### Errors (`AppError`)
+
+[src/lib/errors.ts](src/lib/errors.ts). Throw `AppError` for expected failures (auth, not-found, conflicts, business rules). `message` is customer-facing (what happened + next step); no internals. Use `rethrowUniqueViolation` to turn a unique-index failure into a readable conflict.
+
+`handleServerError` in [src/lib/safe-action.ts](src/lib/safe-action.ts): `AppError` → client gets `message`; anything else → generic mask + `recordError`. Do not catch-and-rethrow as plain `Error` or return `null` on failure; let errors bubble. Try/catch only for non-fatal side effects.
+
+### Observability
+
+One structured span per action, with its input, duration, and outcome as attributes. Setup is in [src/instrumentation.ts](src/instrumentation.ts) and [src/lib/otel.ts](src/lib/otel.ts); add attributes with `recordWideEvent` and `recordError`. Only error spans and spans slower than 5s are exported.
+
+Wrap new actions with `withWideEvent` from [src/lib/safe-action.ts](src/lib/safe-action.ts): `.action(withWideEvent('myAction', async ({ parsedInput, ctx }) => { … }))`. Prefer that over ad-hoc logging in handlers. No secrets in attributes.
+
+### Client toasts
+
+[src/lib/toast-message.ts](src/lib/toast-message.ts) only (not raw Sonner):
+
+- `await action`: `if (toastIfActionFailed(result)) return` then `toastSuccessMessage`
+- hook `onError`, or a Better Auth client `error`: `toastActionError(err, 'The thing was not saved. Try again.')`
+- client-only validation: `toastErrorMessage`
+
+Query/mutation helpers: [src/lib/safe-action-client.ts](src/lib/safe-action-client.ts). Confirm destructive actions with `ConfirmDialog` ([src/components/confirm-dialog.tsx](src/components/confirm-dialog.tsx)), never `window.confirm`.
+
+### Client / server boundary
+
+`'use client'` modules must never pull server runtime, secrets, or the database into the browser bundle. Transitive imports count: a Zod schema that pulls in `drizzle-orm` still ships drizzle.
+
+**Never import from client:**
+
+- `~/db` and anything under it (including for types)
+- `~/env`
+- `drizzle-orm`
+- Any module with `import 'server-only'`, such as `~/lib/auth` and `~/lib/nodemailer`
+
+**OK from client:**
+
+- Server actions from `'use server'` modules
+- Pure modules free of SQL and secrets: `constants`, `validations`, `format-*`
+- Action validation files, as long as they only import client-safe modules
+
+**`server-only` placement:** add it to modules that open DB connections or hold secrets or must never ship to the client. Do not add it to `~/env`, `~/db/schema`, `~/db/enums`, or `~/db/common`: drizzle-kit and scripts load those without the `react-server` condition, and the real package throws there. Scripts run with `bun --conditions=react-server` so they can import server-only modules.
+
+[tests/lib/client-server-boundary.test.ts](tests/lib/client-server-boundary.test.ts) fails if a `'use client'` file imports a forbidden path. Keep it green; extend its list when you add a new server lib.
+
+### Input bounds and search
+
+Shared Zod helpers live in [src/lib/validations.ts](src/lib/validations.ts); numeric ceilings live in [src/lib/constants.ts](src/lib/constants.ts). Cap every array that reaches SQL with `MAX_FILTER_VALUES` or a named constant. Build `ILIKE` patterns with `likeContains` from [src/lib/search.ts](src/lib/search.ts) so `%` and `_` in search text stay literal.
+
+### Roles
+
+System roles come from the Better Auth admin plugin, defined in [src/lib/auth-permissions.ts](src/lib/auth-permissions.ts):
+
+- `user`: regular customer with no admin-panel access
+- `admin`: can open `/admin` and every page you add there; cannot manage users
+- `superadmin`: full control, including user management and impersonation
+
+### Database
+
+Schema is all in [src/db/schema.ts](src/db/schema.ts). When you add Postgres enums, put them in `src/db/enums.ts` and re-export them from the schema. Reusable column helpers (CUID IDs, timestamps) are in [src/db/common.ts](src/db/common.ts). IDs use CUID2 with a model-name prefix (e.g., `user_xxx`, `session_xxx`).
+
+**Changing the schema:**
+
+- Every foreign key must be the leading column of an index and must declare an explicit `onDelete`. Without an index, deleting a parent scans the child table while holding row locks. `tests/db/fk-indexes.test.ts` enforces both.
+- Invariants such as non-negative counts belong in CHECK constraints as well as Zod: the seed script, `psql`, and Drizzle Studio write around Zod. Before adding one, read what the code and the seed script write to that column.
+- Better Auth owns the `users`, `sessions`, `accounts`, and `verifications` columns. Change them with `bun run gen:auth` in mind.
+
+### Client data and forms
+
+Query results are fresh object identities on every refetch, and TanStack refetches on window focus by default. An effect that depends on one re-runs on every alt-tab and discards typed input.
+
+- Seed a dialog form once per open: depend on `[open, record?.id, reset]`, never on the record object, an options array, or a `useMemo` derived from them.
+- When the data arrives after the dialog opens, guard the prefill with a ref that is cleared on close.
+- These effects need `// eslint-disable-next-line react-hooks/exhaustive-deps` on the dependency array, with a comment saying why.
+- Writing a ref during render is a React Compiler error here. Do it inside the effect.
+
+### Email
+
+Templates are React Email components in `src/emails/`. Send via helpers in [src/lib/email-service.ts](src/lib/email-service.ts), which run as Workflow steps and use Nodemailer. Call them with `start(sendXEmail, [...])` so a slow SMTP server never blocks a request.
+
+### Tests
+
+**Test-driven development (TDD):** For new features, bugs, or behavior changes, write or update focused tests (including edge cases).
+
+Bun tests run against **in-memory Postgres via PGlite** by default. The preload ([tests/setup/preload.ts](tests/setup/preload.ts)) boots one PGlite instance per worker, applies the Drizzle schema, mocks `~/db`, and mocks auth (`getAuthSession` via AsyncLocalStorage). Bootstrap: [tests/setup/pglite-db.ts](tests/setup/pglite-db.ts).
+
+Tests read env from `.env`, like the app. `bun run test:real` runs the same suite against a real server; it requires `DATABASE_URL` and a schema applied with `db:push`.
+
+**PGlite constraint:** PGlite has a single connection, so calling the outer `db` client (or any helper that uses it) inside `db.transaction(...)` deadlocks. Run checks before opening the transaction, or pass `tx` into loaders.
+
+**Verify a test can fail:** after writing one, break the code it covers, confirm it goes red, then restore. A test that cannot fail reads as coverage and hides bugs.
+
+**Tests must not depend on the machine clock.** Pin the current time with `setSystemTime` from `bun:test` rather than computing offsets from the real clock.
+
+**`db.execute` result shape differs by driver:** postgres-js returns a row array, PGlite returns `{ rows }`. Normalise before reading, as `toRows` in `tests/db/fk-indexes.test.ts` does.
+
+**Fixtures** (full API in [tests/helpers/fixtures.ts](tests/helpers/fixtures.ts)):
+
+```ts
+const fx = new Fixtures()
+afterEach(() => fx.cleanup())
+
+const admin = await fx.platformUser('superadmin')
+await asUser(admin, () => someAction(...))
+```
+
+Use `asUser` / `asAnonymous` to set the action actor. Suites live under `tests/admin/`, `tests/db/`, and `tests/lib/`; add a folder per feature.
+
+### Legal pages
+
+The privacy policy and terms of service live in `src/app/(marketing)`. They are starting points: read both when you change how the product behaves. If a change makes either page inaccurate or incomplete, update it and `siteConfig.legal.lastUpdated` in the same change. Describe what an end user experiences, never internal architecture.
+
+### Branding
+
+Never hardcode the product name. Read `siteConfig.name` from [src/lib/siteConfig.ts](src/lib/siteConfig.ts). Replace `public/logo.svg` and `public/logo-dark.svg` with the real mark, and set the brand color in `src/app/globals.css` (`--primary`) and `BRAND` in `src/emails/components/email-layout.tsx`.
+
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/template/nextjs/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/nextjs/README.md

@@ -0,0 +1,109 @@
+# {{PROJECT_NAME}}
+
+{{PROJECT_DESCRIPTION}}
+
+## Technology
+
+The application uses:
+
+- **Application**: Next.js, React, and TypeScript
+- **Interface**: Tailwind CSS, shadcn/ui, and TanStack Query
+- **Data**: PostgreSQL and Drizzle ORM
+- **Authentication**: Better Auth with magic links, OAuth, and system roles
+- **Validation and actions**: Zod and next-safe-action
+- **Runtime and tests**: Bun and PGlite
+- **Email**: Nodemailer and React Email
+
+## Architecture
+
+Next.js route groups separate each product surface:
+
+| Directory             | Route                | Purpose                 |
+| --------------------- | -------------------- | ----------------------- |
+| `src/app/(marketing)` | `/`                  | Landing and legal pages |
+| `src/app/(auth)`      | `/login`, `/profile` | Sign-in and profile     |
+| `src/app/(app)`       | `/app/*`             | Signed-in product       |
+| `src/app/(admin)`     | `/admin/*`           | Platform administration |
+
+Shared code has clear responsibilities:
+
+- `src/components`: shared interface components
+- `src/lib`: access checks, validation, formatting, and integrations
+- `src/db`: schema, relations, and database connection
+- `src/emails`: React Email templates
+- `tests`: focused integration and unit tests
+
+Server actions sit beside their routes in `actions` directories. Each protected action validates input, enforces the correct role, and records one structured event. Page and layout files fetch data through actions instead of importing the database.
+
+## Local setup
+
+Install these prerequisites:
+
+- [Bun](https://bun.sh/)
+- [PostgreSQL](https://www.postgresql.org/) with an empty local database
+- OAuth credentials for GitHub and Google
+- SMTP credentials
+
+Then prepare the application:
+
+```bash
+bun install
+```
+
+`create-ej-app` already wrote `.env` from `.env.example`. Fill in working credentials, then apply the database schema and add starter data:
+
+```bash
+bun run db:push
+bun run db:seed
+```
+
+Start the development server:
+
+```bash
+bun run dev
+```
+
+Open [http://localhost:3000](http://localhost:3000). The seed creates `superadmin@example.com` and `user@example.com`; change them in `src/scripts/seed.ts` to addresses whose inbox you can read.
+
+## Commands
+
+Use these commands during development:
+
+| Command              | Purpose                             |
+| -------------------- | ----------------------------------- |
+| `bun run dev`        | Start the development server        |
+| `bun test`           | Run tests with in-memory PostgreSQL |
+| `bun run test:real`  | Run tests against `DATABASE_URL`    |
+| `bun run lint`       | Run ESLint                          |
+| `bun run type-check` | Check TypeScript                    |
+| `bun run format`     | Format source and test files        |
+| `bun run build`      | Create a production build           |
+| `bun run db:push`    | Apply the Drizzle schema            |
+| `bun run db:studio`  | Open Drizzle Studio                 |
+| `bun run db:seed`    | Add starter data                    |
+| `bun run db:reset`   | Drop every table                    |
+| `bun run email:dev`  | Preview email templates             |
+| `bun run email:test` | Send a test email to an address     |
+
+Before opening a pull request, run:
+
+```bash
+bun test
+bun run lint
+bun run type-check
+bun run build
+```
+
+## Implement a change
+
+Follow this path for product changes:
+
+1. Find the matching route under `src/app` and read its nearby actions and components.
+2. Add or update a focused test before changing behavior.
+3. Put shared limits and repeated values in `src/lib/constants.ts`.
+4. Validate action input with Zod and select the narrowest action client in `src/lib/safe-action.ts`.
+5. Throw `AppError` for expected failures and give customers a clear next step.
+6. Wrap new actions with `withWideEvent` and exclude secrets from event attributes.
+7. Format the files you touched, then run the relevant checks.
+
+Read [AGENTS.md](AGENTS.md) before making a substantial change. It documents authorization, testing, and writing rules.

package/template/nextjs/bunfig.toml

@@ -0,0 +1,3 @@
+[test]
+preload = ["./tests/setup/preload.ts"]
+retry = 1

package/template/nextjs/eslint.config.mjs

@@ -1,21 +1,22 @@
-// @ts-ignore
 import nextVitals from 'eslint-config-next/core-web-vitals'
-// import nextTs from 'eslint-config-next/typescript'
+import nextTs from 'eslint-config-next/typescript'
 import { defineConfig, globalIgnores } from 'eslint/config'
 
 const eslintConfig = defineConfig([
   ...nextVitals,
-  // ...nextTs,
+  ...nextTs,
   globalIgnores([
     'node_modules/**',
     '.next/**',
     'out/**',
     'build/**',
-    'next-env.d.ts'
+    'next-env.d.ts',
+    // workflow-sdk autogenerated files
+    'src/app/.well-known/**'
   ]),
   {
     rules: {
-      'react/no-unescaped-entities': 'off'
+      '@typescript-eslint/no-explicit-any': 'off'
     }
   }
 ])

package/template/nextjs/gitignore

@@ -3,6 +3,11 @@ node_modules
 out
 build
 next-env.d.ts
-.swc
 .DS_Store
 .env
+*.tsbuildinfo
+.swc
+
+.claude
+.codex
+.commandcode

package/template/nextjs/next.config.ts

@@ -4,7 +4,14 @@ import { withWorkflow } from 'workflow/next'
 import { env } from '~/env'
 
 const nextConfig: NextConfig = {
-  reactCompiler: true
+  reactCompiler: true,
+  devIndicators: false,
+  images: {
+    remotePatterns: [
+      { hostname: 'avatars.githubusercontent.com' },
+      { hostname: 'lh3.googleusercontent.com' }
+    ]
+  }
 }
 
 const withBundleAnalyzer = bundleAnalyzer({

package/template/nextjs/package.json

@@ -1,12 +1,12 @@
 {
-  "name": "my-app",
-  "description": "A Legendary Next.js App",
+  "name": "my-project",
+  "description": "A Legendary Project",
   "version": "1.0.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
     "email:dev": "email dev --dir src/emails",
-    "email:test": "bun ./src/scripts/test-mail.ts",
+    "email:test": "bun --conditions=react-server ./src/scripts/test-mail.ts",
     "workflow:inspect": "workflow inspect runs --web",
     "build": "bun --bun next build",
     "build:docker": "docker build -t my-app .",
@@ -14,62 +14,70 @@
     "start": "bun --bun next start",
     "lint": "eslint",
     "type-check": "tsgo --incremental false",
-    "format": "prettier --write \"./src/**/*.{js,cjs,mjs,jsx,ts,tsx}\"",
+    "format": "prettier --log-level warn --write \"./src/**/*.{js,cjs,mjs,jsx,ts,tsx}\" --write \"./tests/**/*.{js,cjs,mjs,jsx,ts,tsx}\"",
+    "test": "bun test",
+    "test:real": "TEST_DATABASE=postgres bun test",
     "db:push": "drizzle-kit push",
-    "db:seed": "bun ./src/scripts/seed.ts",
+    "db:seed": "bun --conditions=react-server ./src/scripts/seed.ts",
+    "db:reset": "bun --conditions=react-server ./src/scripts/reset-db.ts",
     "db:studio": "drizzle-kit studio",
-    "gen:auth": "bunx @better-auth/cli generate"
+    "gen:auth": "bunx auth@latest generate"
   },
   "dependencies": {
     "@ejekanshjain/simple-email-validator": "1.0.4",
-    "@hookform/resolvers": "5.4.0",
-    "@next/third-parties": "16.2.9",
+    "@hookform/resolvers": "5.9.1",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/sdk-trace-base": "2.8.0",
+    "@opentelemetry/sdk-trace-base": "2.11.0",
     "@paralleldrive/cuid2": "3.3.0",
-    "@react-email/render": "2.0.8",
+    "@react-email/render": "2.1.0",
     "@t3-oss/env-nextjs": "0.13.11",
-    "@tanstack/react-query": "5.101.0",
+    "@tanstack/react-query": "5.103.2",
+    "@tanstack/react-table": "9.2.4",
     "@vercel/otel": "2.1.3",
-    "better-auth": "1.6.18",
+    "better-auth": "1.7.6",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
-    "drizzle-orm": "0.45.2",
-    "lucide-react": "1.18.0",
-    "next": "16.2.9",
-    "next-safe-action": "8.5.4",
-    "next-themes": "^0.4.6",
+    "cmdk": "1.1.1",
+    "drizzle-orm": "0.45.3",
+    "lucide-react": "1.48.0",
+    "next": "16.3.6",
+    "next-safe-action": "8.7.3",
+    "next-themes": "0.4.6",
     "nextjs-toploader": "3.9.17",
-    "nodemailer": "9.0.0",
+    "nodemailer": "10.0.10",
+    "nuqs": "2.10.1",
     "postgres": "3.4.9",
-    "radix-ui": "1.5.0",
-    "react": "19.2.7",
-    "react-dom": "19.2.7",
-    "react-hook-form": "7.79.0",
-    "sonner": "^2.0.7",
-    "tailwind-merge": "3.6.0",
+    "radix-ui": "1.6.7",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
+    "react-email": "6.11.0",
+    "react-hook-form": "7.88.0",
+    "server-only": "0.0.1",
+    "sonner": "2.0.8",
+    "tailwind-merge": "3.7.0",
     "tw-animate-css": "1.4.0",
-    "workflow": "4.4.0",
-    "zod": "4.4.3"
+    "workflow": "4.8.9",
+    "zod": "4.6.5"
   },
   "devDependencies": {
-    "@next/bundle-analyzer": "16.2.9",
+    "@electric-sql/pglite": "0.5.8",
+    "@next/bundle-analyzer": "16.3.6",
     "@react-email/preview-server": "5.2.10",
-    "@tailwindcss/postcss": "4.3.1",
-    "@types/bun": "1.3.14",
-    "@types/nodemailer": "8.0.1",
-    "@types/react": "19.2.17",
-    "@types/react-dom": "19.2.3",
-    "@typescript/native-preview": "7.0.0-dev.20260614.1",
+    "@react-email/ui": "6.11.0",
+    "@tailwindcss/postcss": "4.3.3",
+    "@types/bun": "1.4.2",
+    "@types/nodemailer": "8.0.2",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "babel-plugin-react-compiler": "1.0.0",
-    "drizzle-kit": "0.31.10",
+    "drizzle-kit": "0.31.11",
     "eslint": "9.39.4",
-    "eslint-config-next": "16.2.9",
-    "prettier": "3.8.4",
+    "eslint-config-next": "16.3.6",
+    "prettier": "3.9.9",
     "prettier-plugin-organize-imports": "4.3.0",
-    "prettier-plugin-tailwindcss": "0.8.0",
-    "react-email": "6.6.0",
-    "tailwindcss": "4.3.1",
+    "prettier-plugin-tailwindcss": "0.8.1",
+    "tailwindcss": "4.3.3",
     "typescript": "6.0.3"
   },
   "trustedDependencies": [

package/template/nextjs/public/logo-dark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#fafafa"/>
+  <path d="M20 44V20h24v6H27v4h14v6H27v8z" fill="#171717"/>
+</svg>

package/template/nextjs/public/logo.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#171717"/>
+  <path d="M20 44V20h24v6H27v4h14v6H27v8z" fill="#fafafa"/>
+</svg>