create-nexst-monorepo 0.1.0

package/template/apps/api/kustomize/secret.keys

@@ -0,0 +1,14 @@
+# Allowlist for scripts/seal-secret.sh: only these keys from .env are sealed
+# into nexst-api-secret. Everything else is plain config and belongs in
+# kustomize/*/application.properties — the Secret is mounted after the
+# ConfigMap (envFrom), so any extra key sealed here would override it.
+DATABASE_URL
+# @if auth
+BETTER_AUTH_SECRET
+GOOGLE_CLIENT_SECRET
+RESEND_API_KEY
+# @endif
+# @if r2
+R2_ACCESS_KEY_ID
+R2_SECRET_ACCESS_KEY
+# @endif

package/template/apps/api/oxfmt.config.ts

@@ -0,0 +1,8 @@
+import { baseOxfmtConfig } from "@nexst/lint/oxfmt";
+import { baseIgnorePatterns } from "@nexst/lint/oxlint";
+import { defineConfig } from "oxfmt";
+
+export default defineConfig({
+  ...baseOxfmtConfig,
+  ignorePatterns: [...baseIgnorePatterns, "migrations/**/*", "src/generated/prisma/**"],
+});

package/template/apps/api/oxlint.config.ts

@@ -0,0 +1,107 @@
+import base, { baseIgnorePatterns } from "@nexst/lint/oxlint";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  extends: [base],
+  ignorePatterns: [...baseIgnorePatterns, "migrations/**/*", "src/generated/prisma/**"],
+  overrides: [
+    {
+      files: ["**/*.spec.ts", "**/*.e2e-spec.ts", "tests/**"],
+      rules: {
+        "no-console": "off",
+        "no-restricted-imports": "off",
+        "security/detect-non-literal-fs-filename": "off",
+        "sonarjs/no-duplicate-string": "off",
+        "typescript/no-misused-spread": "off",
+        "typescript/no-non-null-assertion": "off",
+        "typescript/unbound-method": "off",
+      },
+    },
+    {
+      files: ["scripts/**"],
+      rules: {
+        "no-console": "off",
+        "security/detect-non-literal-fs-filename": "off",
+        "security/detect-unsafe-regex": "off",
+        "sonarjs/cognitive-complexity": "off",
+      },
+    },
+    {
+      files: ["prisma/**"],
+      rules: {
+        "no-console": "off",
+      },
+    },
+    {
+      files: ["**/*-exception.filter.ts", "**/*-exception.filter.spec.ts"],
+      rules: {
+        "promise/valid-params": "off",
+      },
+    },
+  ],
+  rules: {
+    eqeqeq: ["error", "always", { null: "ignore" }],
+    "import/no-cycle": "error",
+    "import/no-duplicates": "error",
+    "import/no-self-import": "error",
+
+    "no-console": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        paths: [
+          {
+            message: "Prisma-Client immer aus #src/generated/prisma/client importieren.",
+            name: "@prisma/client",
+          },
+          {
+            importNames: [
+              "BadRequestException",
+              "ConflictException",
+              "ForbiddenException",
+              "InternalServerErrorException",
+              "NotFoundException",
+              "ServiceUnavailableException",
+              "UnauthorizedException",
+              "UnprocessableEntityException",
+            ],
+            message:
+              "Codes-only API: throw `new AppException(ErrorCode.X, HttpStatus.Y, params?)` (see src/errors/app.exception.ts) instead of a free-text HttpException.",
+            name: "@nestjs/common",
+          },
+        ],
+      },
+    ],
+
+    "oxc/no-accumulating-spread": "warn",
+    "oxc/no-map-spread": "warn",
+
+    "typescript/await-thenable": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-confusing-void-expression": ["warn", { ignoreArrowShorthand: true }],
+    "typescript/no-explicit-any": "warn",
+    "typescript/no-floating-promises": "error",
+    "typescript/no-misused-promises": "error",
+    "typescript/no-non-null-assertion": "warn",
+    "typescript/no-unnecessary-type-assertion": "warn",
+    "typescript/prefer-nullish-coalescing": "warn",
+    "typescript/prefer-optional-chain": "warn",
+    "typescript/require-await": "warn",
+    "typescript/restrict-plus-operands": "error",
+    "typescript/return-await": ["error", "error-handling-correctness-only"],
+    "typescript/switch-exhaustiveness-check": "warn",
+
+    "unicorn/error-message": "error",
+    "unicorn/prefer-node-protocol": "error",
+    "unicorn/prefer-structured-clone": "warn",
+    "unicorn/throw-new-error": "error",
+
+    "vitest/expect-expect": "warn",
+    "vitest/no-disabled-tests": "warn",
+    "vitest/no-focused-tests": "error",
+    "vitest/no-identical-title": "error",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "off",
+    "vitest/valid-expect": "error",
+  },
+});

package/template/apps/api/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "@nexst/api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "imports": {
+    "#src/*": "./src/*",
+    "#tests/*": "./tests/*"
+  },
+  "scripts": {
+    "dev": "bun --watch src/main.ts",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check",
+    "lint:ts": "tsc --noEmit",
+    "lint:error-codes": "! grep -rnE \"new (BadRequestException|NotFoundException|ConflictException|ForbiddenException|UnauthorizedException|UnprocessableEntityException|InternalServerErrorException|ServiceUnavailableException)\\(\" src --include=\"*.ts\" --exclude=\"*.spec.ts\" --exclude-dir=generated",
+    "unused": "knip --no-config-hints",
+    "auth:generate": "better-auth generate --config scripts/auth.cli.ts -y",
+    "db:generate": "bunx --bun prisma generate",
+    "db:push": "bunx --bun prisma db push",
+    "db:migrate": "bunx --bun prisma migrate dev",
+    "db:reset": "bunx --bun prisma migrate reset --force",
+    "test:unit": "vitest run",
+    "test:cov": "vitest run --coverage",
+    "test:e2e": "vitest run --config ./vitest.config.e2e.ts"
+  },
+  "dependencies": {
+    "@apollo/server": "^5.5.1",
+    "@apollo/utils.keyvaluecache": "^4.0.0",
+    "@as-integrations/fastify": "^3.1.0",
+    "@aws-sdk/client-s3": "^3.1141.0",
+    "@aws-sdk/s3-request-presigner": "^3.1141.0",
+    "@better-auth/passkey": "^1.7.6",
+    "@fastify/cors": "^11.3.0",
+    "@fastify/helmet": "^13.1.1",
+    "@fastify/static": "^10.1.5",
+    "@nestjs/apollo": "^14.0.2",
+    "@nestjs/bullmq": "^12.0.0",
+    "@nestjs/common": "^12.1.0",
+    "@nestjs/config": "^12.0.1",
+    "@nestjs/core": "^12.1.0",
+    "@nestjs/graphql": "^14.0.2",
+    "@nestjs/platform-fastify": "^12.1.0",
+    "@nestjs/swagger": "^12.0.2",
+    "@nestjs/terminus": "^12.1.0",
+    "@nestjs/throttler": "^6.7.1",
+    "@nexst/queues": "workspace:*",
+    "@prisma/adapter-pg": "^7.10.0",
+    "@prisma/client-runtime-utils": "^7.10.0",
+    "@thallesp/nestjs-better-auth": "^2.8.0",
+    "better-auth": "^1.7.6",
+    "bullmq": "^6.3.9",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "fastify": "^5.12.5",
+    "graphql": "^17.0.2",
+    "ioredis": "6.0.0",
+    "js-yaml": "^5.4.2",
+    "nestjs-pino": "^5.2.1",
+    "nodemailer": "^10.0.10",
+    "pino": "^10.3.1",
+    "pino-http": "^11.0.0",
+    "reflect-metadata": "^0.2.2",
+    "resend": "^6.30.0",
+    "rxjs": "^7.8.2",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@nestjs/testing": "^12.1.0",
+    "@prisma/client": "^7.10.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^26.6.3",
+    "@types/nodemailer": "^8.0.2",
+    "aws-sdk-client-mock": "^4.1.0",
+    "pino-pretty": "^13.1.3",
+    "prisma": "^7.10.0"
+  }
+}

package/template/apps/api/prisma/migrations/20260927000000_init/migration.sql

@@ -0,0 +1,113 @@
+-- CreateSchema
+CREATE SCHEMA IF NOT EXISTS "nexst_user";
+
+-- CreateEnum
+CREATE TYPE "nexst_user"."UserRole" AS ENUM ('USER', 'ADMIN');
+
+-- CreateTable
+CREATE TABLE "nexst_user"."users" (
+    "id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "emailVerified" BOOLEAN NOT NULL DEFAULT false,
+    "name" TEXT,
+    "image" TEXT,
+    "role" "nexst_user"."UserRole"[] DEFAULT ARRAY['USER']::"nexst_user"."UserRole"[],
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "users_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_email_key" ON "nexst_user"."users"("email");
+-- @if auth
+
+-- CreateTable
+CREATE TABLE "nexst_user"."sessions" (
+    "id" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "token" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "ipAddress" TEXT,
+    "userAgent" TEXT,
+    "userId" TEXT NOT NULL,
+
+    CONSTRAINT "sessions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "nexst_user"."accounts" (
+    "id" TEXT NOT NULL,
+    "accountId" TEXT NOT NULL,
+    "providerId" TEXT NOT NULL,
+    "accessToken" TEXT,
+    "refreshToken" TEXT,
+    "idToken" TEXT,
+    "accessTokenExpiresAt" TIMESTAMP(3),
+    "refreshTokenExpiresAt" TIMESTAMP(3),
+    "scope" TEXT,
+    "password" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "userId" TEXT NOT NULL,
+
+    CONSTRAINT "accounts_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "nexst_user"."verifications" (
+    "id" TEXT NOT NULL,
+    "identifier" TEXT NOT NULL,
+    "value" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "verifications_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "nexst_user"."passkeys" (
+    "id" TEXT NOT NULL,
+    "name" TEXT,
+    "publicKey" TEXT NOT NULL,
+    "credentialID" TEXT NOT NULL,
+    "counter" INTEGER NOT NULL,
+    "deviceType" TEXT NOT NULL,
+    "backedUp" BOOLEAN NOT NULL,
+    "transports" TEXT,
+    "aaguid" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "userId" TEXT NOT NULL,
+
+    CONSTRAINT "passkeys_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "sessions_token_key" ON "nexst_user"."sessions"("token");
+
+-- CreateIndex
+CREATE INDEX "sessions_userId_idx" ON "nexst_user"."sessions"("userId");
+
+-- CreateIndex
+CREATE INDEX "accounts_userId_idx" ON "nexst_user"."accounts"("userId");
+
+-- CreateIndex
+CREATE INDEX "verifications_identifier_idx" ON "nexst_user"."verifications"("identifier");
+
+-- CreateIndex
+CREATE INDEX "passkeys_userId_idx" ON "nexst_user"."passkeys"("userId");
+
+-- CreateIndex
+CREATE INDEX "passkeys_credentialID_idx" ON "nexst_user"."passkeys"("credentialID");
+
+-- AddForeignKey
+ALTER TABLE "nexst_user"."sessions" ADD CONSTRAINT "sessions_userId_fkey" FOREIGN KEY ("userId") REFERENCES "nexst_user"."users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "nexst_user"."accounts" ADD CONSTRAINT "accounts_userId_fkey" FOREIGN KEY ("userId") REFERENCES "nexst_user"."users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "nexst_user"."passkeys" ADD CONSTRAINT "passkeys_userId_fkey" FOREIGN KEY ("userId") REFERENCES "nexst_user"."users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+-- @endif

package/template/apps/api/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"

package/template/apps/api/prisma/schema.prisma

@@ -0,0 +1,113 @@
+generator client {
+  provider        = "prisma-client-js"
+  output          = "../src/generated/prisma"
+  previewFeatures = ["relationJoins"]
+}
+
+datasource db {
+  provider = "postgresql"
+  schemas  = ["nexst_user"]
+}
+
+model User {
+  id            String     @id
+  email         String     @unique
+  emailVerified Boolean    @default(false)
+  name          String?
+  image         String?
+  role          UserRole[] @default([USER])
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  // @if auth
+
+  sessions Session[]
+  accounts Account[]
+  passkeys Passkey[]
+  // @endif
+
+  @@map("users")
+  @@schema("nexst_user")
+}
+// @if auth
+
+model Session {
+  id        String   @id
+  expiresAt DateTime
+  token     String   @unique
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  ipAddress String?
+  userAgent String?
+
+  userId String
+  user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@map("sessions")
+  @@schema("nexst_user")
+}
+
+model Account {
+  id                    String    @id
+  accountId             String
+  providerId            String
+  accessToken           String?
+  refreshToken          String?
+  idToken               String?
+  accessTokenExpiresAt  DateTime?
+  refreshTokenExpiresAt DateTime?
+  scope                 String?
+  password              String?
+  createdAt             DateTime  @default(now())
+  updatedAt             DateTime  @updatedAt
+
+  userId String
+  user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@map("accounts")
+  @@schema("nexst_user")
+}
+
+model Passkey {
+  id           String   @id
+  name         String?
+  publicKey    String
+  credentialID String
+  counter      Int
+  deviceType   String
+  backedUp     Boolean
+  transports   String?
+  aaguid       String?
+  createdAt    DateTime @default(now())
+
+  userId String
+  user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([credentialID])
+  @@map("passkeys")
+  @@schema("nexst_user")
+}
+
+model Verification {
+  id         String   @id
+  identifier String
+  value      String
+  expiresAt  DateTime
+  createdAt  DateTime @default(now())
+  updatedAt  DateTime @updatedAt
+
+  @@index([identifier])
+  @@map("verifications")
+  @@schema("nexst_user")
+}
+// @endif
+
+enum UserRole {
+  USER
+  ADMIN
+
+  @@schema("nexst_user")
+}

package/template/apps/api/prisma.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "prisma/config";
+
+export default defineConfig({
+  datasource: {
+    url: process.env.DATABASE_URL,
+  },
+});

package/template/apps/api/scripts/auth.cli.ts

@@ -0,0 +1,19 @@
+import { PrismaPg } from "@prisma/adapter-pg";
+import { betterAuth } from "better-auth/minimal";
+import { buildBaseAuthOptions } from "#src/auth/auth.js";
+import { loadConfig } from "#src/config/app.config.js";
+import { PrismaClient } from "#src/generated/prisma/client.js";
+
+/**
+ * Standalone better-auth instance used **only** by the better-auth CLI
+ * (`bun run auth:generate`) to derive the database schema.
+ *
+ * The CLI cannot construct the NestJS PrismaService (it needs the DI container),
+ * so it gets a bare client here. `generate` only inspects the config and never
+ * connects to the database; the adapter is required because the Prisma 7
+ * driver-adapter client refuses to be constructed without one.
+ */
+const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
+const { allowedOrigins } = loadConfig().security;
+
+export const auth = betterAuth(buildBaseAuthOptions(new PrismaClient({ adapter }), allowedOrigins));

package/template/apps/api/scripts/seal-secret.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+#
+# Regenerates (or merges) the SealedSecret for nexst-api from .env and
+# writes it into kustomize/ where Flux picks it up. Only the keys listed in
+# kustomize/secret.keys are sealed; everything else is ConfigMap material.
+#
+# One command, no flags needed:
+#   ./scripts/seal-secret.sh
+#
+# On the first run it fetches the sealed-secrets controller's public cert via
+# kubectl and caches it at kustomize/sealed-secrets.pem (commit that file — it
+# is a public key). Every later run seals offline from the cached cert.
+#
+# Requires: kubectl, kubeseal   (bash >= 4 — do NOT run with `sh`)
+#
+# Usage:
+#   ./scripts/seal-secret.sh [OUT_FILE]
+#     OUT_FILE   default: kustomize/overlays/prod/sealedsecret.yaml
+#                "-" writes to stdout instead of a file
+#
+# Env vars (all optional):
+#   ENV_FILE             env file to seal from     (default: <repo>/.env)
+#   NAMESPACE            target namespace          (default: nexst)
+#   SECRET_NAME          Secret / SealedSecret name (default: nexst-api-secret)
+#   KEYS_FILE            allowlist, one key per line (default: <repo>/kustomize/secret.keys)
+#   SEALED_SECRETS_CERT  explicit cert path/URL; skips the cached pem
+#   CERT_FILE            where the cached cert lives (default: <repo>/kustomize/sealed-secrets.pem)
+#   CONTROLLER_NS        controller namespace      (default: sealed-secrets)
+#   CONTROLLER_NAME      controller service name   (default: sealed-secrets-controller)
+#   REFETCH_CERT=1       re-fetch the cert even if the cache exists
+#   MERGE=1             merge into OUT_FILE instead of regenerating it
+#
+# Staging:
+#   NAMESPACE=nexst-staging \
+#     ./scripts/seal-secret.sh kustomize/overlays/staging/sealedsecret.yaml
+
+if [ -z "${BASH_VERSINFO:-}" ] || [ "${BASH_VERSINFO:-0}" -lt 4 ]; then
+  if [ -z "${_SEAL_REEXEC:-}" ]; then
+    for _b in /opt/homebrew/bin/bash /usr/local/bin/bash; do
+      [ -x "$_b" ] && exec env _SEAL_REEXEC=1 "$_b" "$0" "$@"
+    done
+  fi
+  echo "error: this script needs bash >= 4; install one with 'brew install bash'" >&2
+  echo "       then run: ./scripts/seal-secret.sh $*" >&2
+  exit 1
+fi
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+OUT_FILE="${1:-$REPO_ROOT/kustomize/overlays/prod/sealedsecret.yaml}"
+ENV_FILE="${ENV_FILE:-$REPO_ROOT/.env}"
+NAMESPACE="${NAMESPACE:-nexst}"
+SECRET_NAME="${SECRET_NAME:-nexst-api-secret}"
+KEYS_FILE="${KEYS_FILE:-$REPO_ROOT/kustomize/secret.keys}"
+CERT_FILE="${CERT_FILE:-$REPO_ROOT/kustomize/sealedsecrets.pem}"
+CONTROLLER_NS="${CONTROLLER_NS:-sealed-secrets}"
+CONTROLLER_NAME="${CONTROLLER_NAME:-sealed-secrets-controller}"
+MERGE="${MERGE:-}"
+
+for bin in kubectl kubeseal; do
+  command -v "$bin" >/dev/null || { echo "error: $bin not found in PATH" >&2; exit 1; }
+done
+[ -f "$ENV_FILE" ] || { echo "error: env file not found: $ENV_FILE" >&2; exit 1; }
+if [ -n "$MERGE" ] && { [ "$OUT_FILE" = "-" ] || [ ! -f "$OUT_FILE" ]; }; then
+  echo "error: MERGE=1 needs an existing OUT_FILE" >&2; exit 1
+fi
+
+# --- controller cert: explicit > cached > fetch once via kubectl ----------
+if [ -n "${SEALED_SECRETS_CERT:-}" ]; then
+  CERT_FILE="$SEALED_SECRETS_CERT"
+elif [ ! -f "$CERT_FILE" ] || [ -n "${REFETCH_CERT:-}" ]; then
+  kubectl get svc -n "$CONTROLLER_NS" "$CONTROLLER_NAME" >/dev/null 2>&1 || {
+    echo "error: service $CONTROLLER_NS/$CONTROLLER_NAME not reachable via kubectl." >&2
+    echo "       set CONTROLLER_NS / CONTROLLER_NAME, or SEALED_SECRETS_CERT=<pem>." >&2
+    exit 1
+  }
+  echo "fetching public cert from $CONTROLLER_NS/$CONTROLLER_NAME ..." >&2
+  mkdir -p "$(dirname "$CERT_FILE")"
+  tmpc="$(mktemp "${CERT_FILE}.XXXXXX")"
+  trap 'rm -f "$tmpc"' EXIT
+  kubeseal --controller-namespace "$CONTROLLER_NS" --controller-name "$CONTROLLER_NAME" \
+    --fetch-cert > "$tmpc"
+  mv "$tmpc" "$CERT_FILE"
+  trap - EXIT
+  echo "cached $CERT_FILE (public key — commit it)" >&2
+fi
+
+# --- optional key allowlist -------------------------------------------------
+declare -A ALLOW=()
+use_allow=0
+if [ -f "$KEYS_FILE" ]; then
+  use_allow=1
+  while IFS= read -r k || [ -n "$k" ]; do
+    k="${k%%#*}"; k="$(printf '%s' "$k" | tr -d '[:space:]')"
+    [ -n "$k" ] && ALLOW["$k"]=1
+  done < "$KEYS_FILE"
+  echo "allowlist: $KEYS_FILE (${#ALLOW[@]} keys)" >&2
+fi
+
+# --- env parsing ------------------------------------------------------------
+declare -A VALUES=()
+
+load_env_file() {
+  local file="$1" key val
+  [ -f "$file" ] || return 0
+  while IFS= read -r line || [ -n "$line" ]; do
+    line="${line#"${line%%[![:space:]]*}"}"          # ltrim
+    [ -z "$line" ] && continue
+    case "$line" in \#*) continue ;; esac
+    line="${line#export }"
+    [ "${line%%=*}" = "$line" ] && continue          # no '=' on the line
+    key="$(printf '%s' "${line%%=*}" | tr -d '[:space:]')"
+    [ -z "$key" ] && continue
+    val="${line#*=}"
+    if [ "${val#\"}" != "$val" ] && [ "${val%\"}" != "$val" ]; then
+      val="${val#\"}"; val="${val%\"}"
+    elif [ "${val#\'}" != "$val" ] && [ "${val%\'}" != "$val" ]; then
+      val="${val#\'}"; val="${val%\'}"
+    fi
+    VALUES["$key"]="$val"
+  done < "$file"
+}
+
+load_env_file "$ENV_FILE"
+
+# --- select keys to seal ------------------------------------------------
+declare -a LITERALS=() SEALED_KEYS=()
+skipped_empty=0 skipped_filtered=0
+for key in "${!VALUES[@]}"; do
+  if [ "$use_allow" = 1 ] && [ -z "${ALLOW[$key]+x}" ]; then
+    skipped_filtered=$((skipped_filtered + 1)); continue
+  fi
+  if [ -z "${VALUES[$key]}" ]; then
+    skipped_empty=$((skipped_empty + 1)); continue
+  fi
+  LITERALS+=(--from-literal="$key=${VALUES[$key]}")
+  SEALED_KEYS+=("$key")
+done
+[ "${#SEALED_KEYS[@]}" -gt 0 ] || { echo "error: no keys to seal" >&2; exit 1; }
+
+raw_secret() {
+  kubectl create secret generic "$SECRET_NAME" \
+    --namespace "$NAMESPACE" "${LITERALS[@]}" \
+    --dry-run=client -o yaml
+}
+
+KS_ARGS=(--format yaml --scope strict --namespace "$NAMESPACE" --name "$SECRET_NAME" --cert "$CERT_FILE")
+
+echo "sealing ${#SEALED_KEYS[@]} keys for $NAMESPACE/$SECRET_NAME:" >&2
+for key in $(printf '%s\n' "${SEALED_KEYS[@]}" | sort); do
+  printf '  %s\n' "$key" >&2
+done
+[ "$skipped_filtered" -gt 0 ] && echo "  (skipped $skipped_filtered not in allowlist)" >&2
+[ "$skipped_empty" -gt 0 ]    && echo "  (skipped $skipped_empty empty values)" >&2
+
+if [ -n "$MERGE" ]; then
+  raw_secret | kubeseal "${KS_ARGS[@]}" --merge-into "$OUT_FILE"
+  echo "merged into $OUT_FILE" >&2
+elif [ "$OUT_FILE" = "-" ]; then
+  raw_secret | kubeseal "${KS_ARGS[@]}"
+else
+  mkdir -p "$(dirname "$OUT_FILE")"
+  tmp="$(mktemp "${OUT_FILE}.XXXXXX")"
+  trap 'rm -f "$tmp"' EXIT
+  raw_secret | kubeseal "${KS_ARGS[@]}" > "$tmp"
+  mv "$tmp" "$OUT_FILE"
+  trap - EXIT
+  echo "wrote $OUT_FILE" >&2
+fi

package/template/apps/api/sonar-project.properties

@@ -0,0 +1,9 @@
+sonar.projectKey=nexst-api
+
+sonar.sources=src
+sonar.exclusions=src/generated/**,**/*.spec.ts
+sonar.tests=src,tests
+sonar.test.inclusions=**/*.spec.ts,**/*.e2e-spec.ts
+
+sonar.javascript.lcov.reportPaths=coverage/lcov.info
+sonar.typescript.tsconfigPath=tsconfig.json

package/template/apps/api/src/app-info/app-info.dto.ts

@@ -0,0 +1,10 @@
+import { Field, ObjectType } from "@nestjs/graphql";
+
+@ObjectType("AppInfo")
+export class AppInfoDto {
+  @Field()
+  title: string;
+
+  @Field()
+  version: string;
+}

package/template/apps/api/src/app-info/app-info.module.ts

@@ -0,0 +1,7 @@
+import { Module } from "@nestjs/common";
+import { AppInfoResolver } from "#src/app-info/app-info.resolver.js";
+
+@Module({
+  providers: [AppInfoResolver],
+})
+export class AppInfoModule {}