create-m5kdev 0.41.0 → 0.43.0

package/templates/minimal-app/.cursor/rules/module-trpc-guide.mdc

@@ -1,71 +1,71 @@
----
-globs: apps/**/server/src/modules/**/*.trpc.ts
-alwaysApply: false
----
-
-# Module tRPC File Style Guide
-
-Conventions for tRPC router files in app modules. Routers are thin wiring:
-they attach the module DTO schemas and delegate to the service. The router is
-also the type source for the client — the webapp infers all row/list types
-from `AppRouter`, so accurate `.input()`/`.output()` here is what makes
-end-to-end types work.
-
-## File Location
-
-```
-apps/<app>/server/src/modules/<module>/<module>.trpc.ts
-```
-
-## Conventions
-
-- Export a factory function named `create<Module>TRPC`.
-- Import the module DTO object (`postSchemas`) from `./<module>.dto` — not
-  shared schemas, not hand-written types.
-- Use `handleTRPCResult` from `@m5kdev/backend/utils/trpc` to unwrap `Result`s.
-- Keep resolvers one-liners that delegate to the service; no business logic or
-  DB access here.
-- Always pass `ctx` to service methods as the second argument. The first
-  argument (`input`) can be `undefined` for optional-input queries.
-
-## Factory Pattern
-
-```typescript
-import { handleTRPCResult, type TRPCMethods } from "@m5kdev/backend/utils/trpc";
-import { postSchemas } from "./posts.dto";
-import type { PostsService } from "./posts.service";
-
-export function createPostsTRPC(
-  { router, privateProcedure: procedure }: TRPCMethods,
-  postsService: PostsService
-) {
-  return router({
-    list: procedure
-      .input(postSchemas.input.list)
-      .output(postSchemas.output.list)
-      .query(async ({ ctx, input }) => handleTRPCResult(await postsService.list(input ?? {}, ctx))),
-
-    create: procedure
-      .input(postSchemas.input.create)
-      .output(postSchemas.output.single)
-      .mutation(async ({ ctx, input }) => handleTRPCResult(await postsService.create(input, ctx))),
-
-    softDelete: procedure
-      .input(postSchemas.input.delete)
-      .output(postSchemas.output.uuid)
-      .mutation(async ({ ctx, input }) =>
-        handleTRPCResult(await postsService.softDelete(input, ctx))
-      ),
-  });
-}
-```
-
-## Procedure Selection
-
-- `privateProcedure` — authenticated user (most module routes).
-- `organizationProcedure` — requires an active organization.
-- `adminProcedure` — admin role.
-- `publicProcedure` — unauthenticated; use sparingly.
-
-The service's own `.requireAuth()`/`.access()` still run — the tRPC procedure
-choice is transport-level gating, not a replacement for service checks.
+---
+globs: apps/**/server/src/modules/**/*.trpc.ts
+alwaysApply: false
+---
+
+# Module tRPC File Style Guide
+
+Conventions for tRPC router files in app modules. Routers are thin wiring:
+they attach the module DTO schemas and delegate to the service. The router is
+also the type source for the client — the webapp infers all row/list types
+from `AppRouter`, so accurate `.input()`/`.output()` here is what makes
+end-to-end types work.
+
+## File Location
+
+```
+apps/<app>/server/src/modules/<module>/<module>.trpc.ts
+```
+
+## Conventions
+
+- Export a factory function named `create<Module>TRPC`.
+- Import the module DTO object (`postSchemas`) from `./<module>.dto` — not
+  shared schemas, not hand-written types.
+- Use `handleTRPCResult` from `@m5kdev/backend/utils/trpc` to unwrap `Result`s.
+- Keep resolvers one-liners that delegate to the service; no business logic or
+  DB access here.
+- Always pass `ctx` to service methods as the second argument. The first
+  argument (`input`) can be `undefined` for optional-input queries.
+
+## Factory Pattern
+
+```typescript
+import { handleTRPCResult, type TRPCMethods } from "@m5kdev/backend/utils/trpc";
+import { postSchemas } from "./posts.dto";
+import type { PostsService } from "./posts.service";
+
+export function createPostsTRPC(
+  { router, privateProcedure: procedure }: TRPCMethods,
+  postsService: PostsService
+) {
+  return router({
+    list: procedure
+      .input(postSchemas.input.list)
+      .output(postSchemas.output.list)
+      .query(async ({ ctx, input }) => handleTRPCResult(await postsService.list(input ?? {}, ctx))),
+
+    create: procedure
+      .input(postSchemas.input.create)
+      .output(postSchemas.output.single)
+      .mutation(async ({ ctx, input }) => handleTRPCResult(await postsService.create(input, ctx))),
+
+    softDelete: procedure
+      .input(postSchemas.input.delete)
+      .output(postSchemas.output.uuid)
+      .mutation(async ({ ctx, input }) =>
+        handleTRPCResult(await postsService.softDelete(input, ctx))
+      ),
+  });
+}
+```
+
+## Procedure Selection
+
+- `privateProcedure` — authenticated user (most module routes).
+- `organizationProcedure` — requires an active organization.
+- `adminProcedure` — admin role.
+- `publicProcedure` — unauthenticated; use sparingly.
+
+The service's own `.requireAuth()`/`.access()` still run — the tRPC procedure
+choice is transport-level gating, not a replacement for service checks.

package/templates/minimal-app/.github/workflows/check.yml.tpl

@@ -0,0 +1,21 @@
+name: check
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.13.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install
+      - run: pnpm lint
+      - run: pnpm check-types

package/templates/minimal-app/AGENTS.md.tpl

@@ -22,38 +22,29 @@
 // m5k:expo:end
 
 // m5k:server:start
-## Backend Conventions
-
-- Keep repository, service, and transport layers separate inside each module.
-- Register modules in `apps/server/src/app.ts` via `createBackendApp(config, [modules])`.
-- Import Kernel infrastructure (`BaseModule`, Grants, DTOs) from `@m5kdev/backend/base/*`. The `modules/base` path still re-exports.
-- Clay, Docx, Pdf, Social, and Video are Optional Backend Module packages (`@m5kdev/module-<name>`). They are not scaffolded; add them only when the product needs them.
-- Use `BaseModule` subclasses for app modules; the kernel wires repositories, services, and tRPC.
-- Keep tRPC files focused on input/output wiring and delegate logic to services.
-- Do not add service methods that merely call another service. Call the owning service directly unless the method adds a business rule, authorization, validation, orchestration, a transaction boundary, or meaningful domain translation.
-- Renaming a dependency method, repackaging arguments, constructing a prompt, or forwarding actor/context data alone does not justify a service wrapper.
-- Do not create Drizzle migrations by hand. Use the scaffolded config and your project migration workflow later if you need generated migrations.
-- Server event: emit through Auth from Workflow job handlers (and similar background work) when the UI must refresh a change the triggering mutation did not return. See `.cursor/rules/server-event-emit.mdc`.
-// m5k:server:end
+## Modules
+
+`posts` is the reference module. Mirror its layout when adding a feature:
 
+- `apps/shared/src/modules/posts/`
+- `apps/server/src/modules/posts/`
 // m5k:webapp:start
-## Frontend Conventions
-
-- Keep the app shell shape: `NuqsAdapter` + `BrowserRouter` + `Providers`.
-- Compose global providers only in `apps/webapp/src/Providers.tsx`.
-- Use `AppConfigProvider` and `AppTrpcQueryProvider` from `@m5kdev/frontend`; use `@m5kdev/web-ui` for web-only UI.
-- Define app roles in `apps/shared/src/modules/app/roles.constants.ts` and pass `roles: APP_ROLES_CONFIG` through `AppConfigProvider` and `createBackendApp` metadata.
-- Add role display labels in `apps/webapp/translations/app.json` using keys like `organization.role.editor` (resolved as `app:organization.role.editor`).
-- When adding custom roles, also extend module grants (for example `*.grants.ts`) so permissions match the new role keys.
-- For upgrading existing apps, see the docs site guide `apps/docs/docs/guides/custom-app-roles-migration.md`.
-- Use `nuqs` for URL state, React Router for routing, HeroUI for UI primitives, and Tailwind v4 for styling.
-- Prefer shared framework utilities from `@m5kdev/frontend` and `@m5kdev/web-ui` before adding local duplicates.
-- React 19 idioms: no `forwardRef` (pass `ref` as a prop), no `defaultProps`, use `startTransition`/`useDeferredValue` for low-priority updates.
-- Prefer HeroUI v3 components over hand-rolled HTML + Tailwind whenever an equivalent exists; Tailwind is for layout and styling on top of them.
-- Keep components display-focused: data fetching, mutations, URL state, and effect chains live in custom hooks under `modules/<feature>/hooks/` (small focused hooks composed into one screen-level hook, e.g. `usePostsRoute`). Ephemeral UI state (modal open, selected row) may stay in the component. Extract reusable tRPC actions (delete, publish) into their own hooks.
-- Fetch all server data with TanStack Query over tRPC (`useTRPC()` + `queryOptions`/`mutationOptions`); invalidate with the matching `queryFilter()` after mutations. No `fetch`/axios.
-- Forms are uncontrolled HeroUI `Form` + `TextField`/`TextArea` with native HTML validation (`isRequired`, `type`, `minLength`) and `FieldError`; read values from `FormData` on submit. Never add form libraries (react-hook-form, formik). Validation that HTML cannot express (e.g. confirm-password) happens in the submit handler.
-- All user-facing copy goes through i18next (`useTranslation`); keys live in `apps/webapp/translations/`.
-- The `posts` feature (`apps/webapp/src/modules/posts/`) is the reference implementation for these conventions; see `.cursor/rules/frontend-*.mdc` for the detailed guides.
+- `apps/webapp/src/modules/posts/`
 // m5k:webapp:end
 
+Read the matching `.cursor/rules` guide before editing a module file.
+// m5k:server:end
+
+## Agent skills
+
+### Issue tracker
+
+Issues live in GitHub Issues. Use the `gh` CLI. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Default role labels: `needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context: one root `GLOSSARY.md` and `docs/adr/`. See `docs/agents/domain.md`.

package/templates/minimal-app/CLAUDE.md.tpl

@@ -8,7 +8,7 @@ Guidance for Claude Code when working in this repository.
 
 This is a pnpm + Turborepo monorepo built on the **m5kdev framework**:
 
-- `@m5kdev/backend` — backend kernel: Express, Better Auth, Drizzle (LibSQL), and tRPC. Apps compose it via `createBackendApp(config, [modules])`.
+- `@m5kdev/backend` — backend kernel: Express, Better Auth, Drizzle (PostgreSQL), and tRPC. Apps compose it via `createBackendApp(config, [modules])`.
 - `@m5kdev/commons` — shared runtime utilities and contracts.
 - `@m5kdev/config` — configuration loading and validation.
 // m5k:server:start
@@ -68,7 +68,7 @@ First-time setup: `pnpm install`, then `drizzle:migrate` and `drizzle:seed`, the
 End-to-end tests: `pnpm --filter ./apps/e2e test:e2e` (Playwright).
 // m5k:test-harness:end
 
-The local database is a LibSQL file; local auth emails are written to `apps/server/.emails`. Demo login: `admin@{{APP_SLUG}}.local` / `password1234`.
+Runtime uses PostgreSQL through PgBouncer (`DATABASE_URL`); migrations and initialization require `DATABASE_DIRECT_URL`. Keep app, Mastra, and vector schemas separately owned. Start the local PostgreSQL/PgBouncer Compose stack and provision pgvector before applying reviewed migrations. Agents must not generate or hand-author migration SQL or metadata. Local auth emails are written to `apps/server/.emails`. Demo login: `admin@{{APP_SLUG}}.local` / `password1234`.
 // m5k:server:end
 
 // m5k:server:start
@@ -139,6 +139,20 @@ The framework's detailed conventions live in `.cursor/rules/*.mdc`. Cursor appli
 | `.cursor/rules/frontend-i18n-guide.mdc` | webapp user-facing copy |
 // m5k:webapp:end
 
-`AGENTS.md` (repo root and per-app) carries a compact summary of the same conventions for other agents; this file plus the guides above are the authoritative version for Claude.
+`AGENTS.md` (repo root and per-app) points at this file and `.cursor/rules`. This file plus the guides above are the authoritative conventions.
 // m5k:server:end
 
+## Agent skills
+
+### Issue tracker
+
+Issues live in GitHub Issues. Use the `gh` CLI. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Default role labels: `needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context: one root `GLOSSARY.md` and `docs/adr/`. See `docs/agents/domain.md`.
+

package/templates/minimal-app/GLOSSARY.md.tpl

@@ -0,0 +1,181 @@
+# {{APP_NAME}}
+
+{{APP_DESCRIPTION}}
+
+## Language
+# m5k:server:start
+
+### Tenancy
+
+**Organization**:
+The default tenancy unit. Signup creates one; a Closed Organization cannot be used.
+_Avoid_: Workspace, tenant, account, company, Team
+
+**Membership**:
+A durable seat in an Organization. Invite can create it before a User exists; leave, cancel, and expiry soft-delete it; rejoin revives the same MemberId. An Organization has exactly one Owner.
+_Avoid_: OrgUser; treating Invitation as the Membership; Seat (that is Seat billing)
+
+**Member**:
+The Membership principal used to attribute and authorize org-scoped assets, including invited Memberships that do not yet have a User.
+_Avoid_: User (when you mean the membership), Invitation
+
+**MemberId**:
+The Membership id stamped on org-scoped rows. In organization context, `"own"` grants compare this, not UserId.
+_Avoid_: UserId as the org ownership key
+
+**User**:
+The global sign-in identity. Owns personal resources that are not org tenancy. A Closed User cannot sign in.
+_Avoid_: Account, Customer, Client, Member
+
+**UserId**:
+The User id. Correct key for personal resources. Not the org-scoped ownership key.
+_Avoid_: MemberId
+
+**Owner**:
+The Organization Role `owner`. Exactly one per Organization. Invite and org self-service cannot grant or transfer it.
+_Avoid_: multiple Owners as a product feature; inviting Owner
+
+**Invitation**:
+The accept token that attaches a User to an invited Membership. Not a person and not assignable.
+_Avoid_: Waitlist code, pending Member
+
+**Closed**:
+A User or Organization in the restorable lockout state.
+_Avoid_: soft-delete (that is Membership leave), deactivated, suspended, banned
+
+**Restore**:
+Returning a Closed User or Organization to usable state before Purge. Admin panel only.
+_Avoid_: undelete, reactivate
+
+**Purge**:
+Permanent removal of a Closed User or Organization after the grace window.
+_Avoid_: hard-delete as the User-facing noun
+
+### Identity and access
+
+**Actor**:
+Who a server call is made on behalf of: User, Organization, or Admin. Organization scope requires a live Membership and an Organization that is not Closed. Invited Members are not Actors.
+_Avoid_: Session, Principal, Request, TeamActor
+
+**Grant**:
+A permission tuple: resource, level (`user` | `organization`), role, Action, Access.
+_Avoid_: Permission, Policy, ACL
+
+**Action**:
+Canonical Grant verbs: `read`, `write`, `delete`, `publish`.
+_Avoid_: update, create, patch, remove
+
+**Access**:
+How wide a Grant is: `all`, `own`, `org`, `none`.
+_Avoid_: Scope, Role
+
+**Role**:
+A named key at User or Organization scope. Defaults: User `user`/`admin`; Organization `member`/`admin`/`owner`.
+_Avoid_: Grant, Access, permission
+
+### Product surfaces
+
+**Admin panel**:
+The User-role admin UI at `/admin`. Organization Role `admin` does not see it.
+_Avoid_: org Role admin, Billing Portal
+# m5k:files:start
+
+**File**:
+An inventoried object in storage: a row plus the bytes. Personal Files stamp UserId; org-scoped Files stamp MemberId.
+_Avoid_: Upload, Asset, Attachment, Blob
+# m5k:files:end
+# m5k:billing:start
+
+**Plan**:
+Named commercial offering in app code. Not a Stripe Product.
+_Avoid_: Product, Tier, Subscription
+
+**Subscription**:
+The billed relationship for an Organization, not a User.
+_Avoid_: Plan, personal User subscription
+
+**Checkout**:
+Hosted start of a Subscription when the Organization has none.
+_Avoid_: Billing Portal
+
+**Billing Portal**:
+Hosted management of an existing Subscription.
+_Avoid_: Checkout
+
+**Seat billing**:
+When on, billable quantity is the count of Memberships. Off (default): quantity is one.
+_Avoid_: Seat as a synonym for Membership
+# m5k:billing:end
+# m5k:ai:start
+
+**Conversation**:
+Ordered UI transcript of AI turns.
+_Avoid_: Chat, Thread (that is the store)
+
+**Thread**:
+The persisted AI memory thread behind a Conversation.
+_Avoid_: using Thread for the UI surface
+
+**Agent**:
+A named AI agent the app registers. A Conversation selects which Agent answers.
+_Avoid_: Assistant, Bot, MCP client
+# m5k:ai:end
+# m5k:mcp:start
+
+**MCP client**:
+A remote Model Context Protocol client that calls the app on behalf of a User.
+_Avoid_: Agent, Connection
+
+**MCP call**:
+A tRPC procedure opted into the MCP catalog. Grant checks always run.
+_Avoid_: a second tool catalog, Workflow job
+
+**MCP allowlist**:
+The Organizations a given OAuth client may pass as organizationId for a User.
+_Avoid_: treating allowlist as permission to write
+# m5k:mcp:end
+# m5k:notifications:start
+
+**Notification**:
+A persisted inbox instance owned by a Member, classified by a Notification kind.
+_Avoid_: UserId as the ownership key
+
+**Notification kind**:
+A developer-declared class of Notifications. Mute applies to the kind.
+_Avoid_: Notification (that is the instance)
+
+**Channel**:
+A delivery means for a Notification: in-app, web push, mobile push, or email.
+_Avoid_: Server event, Device
+# m5k:notifications:end
+# m5k:workflows:start
+
+**Workflow**:
+A persisted background run. Org-scoped runs stamp MemberId.
+_Avoid_: Job, Queue, Task, Recurrence
+# m5k:workflows:end
+# m5k:tags:start
+
+**Tag**:
+A polymorphic label. Ownership is UserId, MemberId, or organizationId.
+_Avoid_: Label, Category
+# m5k:tags:end
+# m5k:connect:start
+
+**Connection**:
+A linked third-party API account. Personal; keyed by UserId. The module id is `connect`.
+_Avoid_: Connect as the product noun; login OAuth
+# m5k:connect:end
+# m5k:webhook:start
+
+**Inbound callback**:
+A one-shot inbound callback with an awaitable payload. Unattributed. The module id is `webhook`.
+_Avoid_: Webhook (when you mean this vs Stripe Subscription sync); Connection
+# m5k:webhook:end
+# m5k:recurrence:start
+
+**Recurrence**:
+A repeating calendar pattern stored as a row. Not a Workflow.
+_Avoid_: Workflow, cron
+# m5k:recurrence:end
+# m5k:server:end

package/templates/minimal-app/README.md.tpl

@@ -32,13 +32,18 @@ pnpm --filter ./apps/server drizzle:migrate
 pnpm --filter ./apps/server drizzle:seed
 ```
 
-The starter uses a local LibSQL file by default and writes local auth emails to `apps/server/.emails`.
-Database tables are registered by hand in `apps/server/src/schema.ts`; after changing any `*.db.ts`, run `drizzle:generate` and `drizzle:migrate`.
+The starter uses PostgreSQL through PgBouncer and writes local auth emails to `apps/server/.emails`. Start `docker compose -f apps/shared/compose.yaml up -d --build`, configure runtime `DATABASE_URL` and direct `DATABASE_DIRECT_URL`, and provision pgvector in `public` before migration/initialization.
+Database tables are registered in `apps/server/src/schema.ts`; `src/drizzle.schema.ts` adds schema metadata for migration generation. After changing any `*.db.ts`, the maintainer runs `drizzle:generate`, reviews the output, then runs `drizzle:migrate`.
+// m5k:ai:start
+Run `pnpm --filter ./apps/server mastra:init` after migrations and before seed or runtime startup. App migrations own `app`; Mastra owns `mastra` and the embedding adapter owns `vectors`.
+// m5k:ai:end
 
 ## Demo Credentials
 
 - Email: `admin@{{APP_SLUG}}.local`
 - Password: `password1234`
+
+After sign-in, the index route (`/`) is the Posts list.
 // m5k:server:end
 
 ## Typical Commands
@@ -81,7 +86,6 @@ cp apps/shared/.env.production.example apps/shared/.env.production
 # fill in URLs, BETTER_AUTH_SECRET, REDIS_URL, …
 
 fly apps create {{APP_SLUG}}-app
-fly volumes create libsql_data --app {{APP_SLUG}}-app --region iad --size 1
 pnpm app:secrets
 pnpm app:deploy
 // m5k:server:end
@@ -95,7 +99,11 @@ pnpm landing:deploy
 `m5kdev-fly-secrets`). A missing env file errors with a copy-the-example
 message.
 // m5k:server:start
-`app:deploy` does the same for the product image. Product data lives on the
-`libsql_data` volume at `/app/data` (`DATABASE_URL=file:/app/data/local.db`).
-Redis is a runtime secret, not an image layer.
+`app:deploy` does the same for the product image. Provision provider-neutral
+PostgreSQL with pgvector in `public` and a transaction-mode PgBouncer endpoint.
+Set `DATABASE_URL` to the runtime pool and `DATABASE_DIRECT_URL` to the direct
+database endpoint. App migrations own `app`; Mastra owns `mastra` and vectors
+use `vectors`. Run reviewed app migrations and, when AI is selected, `mastra:init`
+through direct connections before starting the server. Redis and database URLs
+are server secrets, not image layers. No local database volume is required.
 // m5k:server:end

package/templates/minimal-app/apps/.gitignore.tpl

@@ -1,13 +1,13 @@
-# runtime artifacts
-server/local.db*
-server/.e2e/
-server/.emails/
-server/uploads/
-
-# e2e output
-e2e/test-results/
-e2e/playwright-report/
-
-# expo
-expo/.expo/
-expo/dist/
+# runtime artifacts
+server/local.db*
+server/.e2e/
+server/.emails/
+server/uploads/
+
+# e2e output
+e2e/test-results/
+e2e/playwright-report/
+
+# expo
+expo/.expo/
+expo/dist/

package/templates/minimal-app/apps/e2e/package.json.tpl

@@ -1,23 +1,23 @@
-{
-  "name": "{{PACKAGE_SCOPE}}/e2e",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "build": "tsc --noEmit",
-    "lint": "biome check .",
-    "lint:fix": "biome check . --write",
-    "check-types": "tsc --noEmit",
-    "test:e2e": "playwright test",
-    "test:e2e:expo": "playwright test --config playwright.expo.config.ts --headed"
-  },
-  "devDependencies": {
-    "@m5kdev/backend": "catalog:m5kdev",
-    "@m5kdev/commons": "catalog:m5kdev",
-    "@m5kdev/config": "catalog:m5kdev",
-    "@playwright/test": "catalog:m5kdev",
-    "{{PACKAGE_SCOPE}}/shared": "workspace:*",
-    "@trpc/client": "catalog:m5kdev",
-    "@types/node": "catalog:m5kdev",
-    "typescript": "catalog:m5kdev"
-  }
-}
+{
+  "name": "{{PACKAGE_SCOPE}}/e2e",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc --noEmit",
+    "lint": "biome check .",
+    "lint:fix": "biome check . --write",
+    "check-types": "tsc --noEmit",
+    "test:e2e": "playwright test",
+    "test:e2e:expo": "playwright test --config playwright.expo.config.ts --headed"
+  },
+  "devDependencies": {
+    "@m5kdev/backend": "catalog:m5kdev",
+    "@m5kdev/commons": "catalog:m5kdev",
+    "@m5kdev/config": "catalog:m5kdev",
+    "@playwright/test": "catalog:m5kdev",
+    "{{PACKAGE_SCOPE}}/shared": "workspace:*",
+    "@trpc/client": "catalog:m5kdev",
+    "@types/node": "catalog:m5kdev",
+    "typescript": "catalog:m5kdev"
+  }
+}

package/templates/minimal-app/apps/e2e/servers.ts.tpl

@@ -1,6 +1,6 @@
 /**
  * Shared webServer definitions for the Playwright configs. Each profile runs
- * an isolated stack: own port pair, own SQLite file, own email output dir, and
+ * an isolated stack: own port pair, own PostgreSQL database, own email output dir, and
  * own Redis DB index (queue names are identical across profiles — sharing a
  * Redis DB would let one profile's workers consume the other's jobs).
  */
@@ -48,11 +48,27 @@ function serverEnv(profile: E2EProfile, expo: boolean): Record<string, string> {
   const serverPort = expo ? ports.expoServer : ports.server;
   const webPort = expo ? ports.expoWeb : ports.web;
   const suffix = expo ? `${profile}-expo` : profile;
+  const databaseConnection = (key: string): string => {
+    const value = process.env[key];
+    if (!value) throw new Error(`${key} is required for PostgreSQL E2E tests`);
+    const url = new URL(value);
+    url.pathname = `${url.pathname}_e2e_${suffix.replaceAll("-", "_")}`;
+    return url.toString();
+  };
   return {
     PORT: String(serverPort),
     VITE_SERVER_URL: `http://127.0.0.1:${serverPort}`,
     VITE_APP_URL: `http://127.0.0.1:${webPort}`,
-    DATABASE_URL: `file:./.e2e/${suffix}.db`,
+    DATABASE_URL: databaseConnection("E2E_DATABASE_URL"),
+    DATABASE_DIRECT_URL: databaseConnection("E2E_DATABASE_DIRECT_URL"),
+    DATABASE_SCHEMA: "app",
+    DATABASE_DISPOSABLE: process.env.E2E_DATABASE_DISPOSABLE ?? "false",
+    MASTRA_DATABASE_URL: "",
+    MASTRA_DATABASE_DIRECT_URL: "",
+    VECTOR_DATABASE_URL: "",
+    VECTOR_DATABASE_DIRECT_URL: "",
+    MASTRA_DATABASE_SCHEMA: "mastra",
+    VECTOR_DATABASE_SCHEMA: "vectors",
     EMAIL_OUTPUT_DIRECTORY: `.e2e/emails-${suffix}`,
     PROVISIONED_EMAIL_DOMAIN: "provisioned.auth-e2e.local",
     REDIS_URL: `redis://127.0.0.1:6379/${expo ? PORTS[profile].expoRedisDb : PORTS[profile].redisDb}`,
@@ -62,9 +78,6 @@ function serverEnv(profile: E2EProfile, expo: boolean): Record<string, string> {
     BETTER_AUTH_SECRET: "auth-e2e-local-secret-auth-e2e-local-secret",
     SYSTEM_NOTIFICATION_EMAIL: "ops@auth-e2e.local",
     NODE_ENV: "development",
-    // hermetic: shared/.env Turso credentials must not leak into drizzle-kit
-    TURSO_DATABASE_URL: "",
-    TURSO_AUTH_TOKEN: "",
     // hermetic: a real key in the invoking shell would flip email mode to
     // "send" and the stored-email assertions would find nothing
     RESEND_API_KEY: "",
@@ -84,7 +97,10 @@ export function serverWebServer(profile: E2EProfile, { expo = false } = {}) {
   return {
     command: [
       `${SERVER_FILTER} tsx db.ts reset`,
-      `${SERVER_FILTER} drizzle-kit migrate`,
+      `${SERVER_FILTER} tsx db.ts migrate`,
+      // m5k:ai:start
+      `${SERVER_FILTER} tsx mastra.ts`,
+      // m5k:ai:end
       `${SERVER_FILTER} tsx db.e2e.ts seed`,
       `${SERVER_FILTER} tsx src/index.ts`,
     ].join(" && "),