create-projx 1.7.0 → 1.7.2

package/dist/{utils-BZGSJ7XZ.js → utils-MC7VKL2U.js}

@@ -35,7 +35,7 @@ import {
   upsertComponentMarker,
   writeComponentMarker,
   writeProjxConfig
-} from "./chunk-HAT7D4G2.js";
+} from "./chunk-FQPOK3QZ.js";
 export {
   COMPONENTS,
   COMPONENT_MARKER,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-projx",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Scaffold production-grade fullstack projects in seconds. FastAPI, Fastify, Express, React, Flutter, Terraform — with auth, database, CI/CD, E2E tests, and Docker. One command, ready to deploy.",
   "type": "module",
   "bin": {
@@ -8,8 +8,7 @@
   },
   "files": [
     "dist",
-    "src/templates",
-    "src/addons"
+    "src/templates"
   ],
   "keywords": [
     "projx",

package/src/templates/README.md.ejs

@@ -13,7 +13,7 @@ Scaffolded with [Projx](https://github.com/ukanhaupa/projx).
 | **<%= paths.fastify %>/** | Fastify, <%= orm === 'drizzle' ? 'Drizzle' : 'Prisma' %>, TypeBox, TypeScript |
 <% } %>
 <% if (components.includes('express')) { %>
-| **<%= paths.express %>/** | Express 5, TypeScript, <%= orm === 'drizzle' ? 'Drizzle' : 'Prisma, auto-entity CRUD' %> |
+| **<%= paths.express %>/** | Express 5, TypeScript, <%= orm === 'drizzle' ? 'Drizzle' : 'Prisma' %> |
 <% } %>
 <% if (components.includes('frontend')) { %>
 | **<%= paths.frontend %>/** | React 19, TypeScript, Vite, React Router |

package/src/templates/ci.yml.ejs

@@ -123,7 +123,7 @@ jobs:
         run: |
           run_pip_audit() {
             for attempt in 1 2 3; do
-              if uv run pip-audit --ignore-vuln CVE-2026-3219; then
+              if uv run pip-audit --ignore-vuln CVE-2026-3219 --ignore-vuln PYSEC-2025-183; then
                 return 0
               fi
               if [ "$attempt" -eq 3 ]; then
@@ -163,15 +163,15 @@ jobs:
       JWT_SECRET: ci-test-secret # gitleaks:allow
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -196,7 +196,7 @@ jobs:
 <% for (const inst of expressInstances) { %>
 
   <%= inst.path %>:
-    name: <%= inst.display %> (format + lint + typecheck + build + test + audit)
+    name: <%= inst.display %> (format + lint + typecheck + build + audit)
     needs: changes
     if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.<%= inst.path %> == 'true'
     runs-on: ubuntu-latest
@@ -221,15 +221,15 @@ jobs:
       DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ci_test
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -249,7 +249,6 @@ jobs:
       - run: <%= pm.exec %> eslint .
       - run: <%= pm.exec %> tsc --noEmit
       - run: <%= pm.run %> build
-      - run: <%= pm.exec %> vitest run --coverage.enabled=false
       - run: <%= pm.audit %>
 <% } %>
 <% for (const inst of frontendInstances) { %>
@@ -264,15 +263,15 @@ jobs:
         working-directory: <%= inst.path %>
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -321,15 +320,15 @@ jobs:
         working-directory: <%= inst.path %>
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22

package/src/templates/pre-commit.ejs

@@ -135,9 +135,21 @@ fi
 <%= inst.upper %>_TF=$(echo "$STAGED_FILES" | grep '^<%= inst.path %>/.*\.tf$' || true)
 if [ -n "$<%= inst.upper %>_TF" ]; then
   if command -v terraform &> /dev/null; then
-    echo "Formatting <%= inst.path %>..."
+    echo "Checking <%= inst.path %>..."
     cd <%= inst.path %>/stack
     echo "$<%= inst.upper %>_TF" | sed 's|^<%= inst.path %>/stack/||' | xargs terraform fmt
+    [ -d .terraform ] || terraform init -backend=false -input=false >/dev/null
+    terraform validate
+    if command -v tflint &> /dev/null; then
+      tflint --recursive
+    else
+      echo "Skipping tflint (not installed)"
+    fi
+    if command -v trivy &> /dev/null; then
+      trivy config --exit-code 1 --severity HIGH,CRITICAL .
+    else
+      echo "Skipping trivy config scan (not installed)"
+    fi
     cd ../..
     echo "$<%= inst.upper %>_TF" | xargs git add
   else

package/src/addons/orms/drizzle/express/src/app.ts

@@ -1,81 +0,0 @@
-import crypto from 'node:crypto';
-import compression from 'compression';
-import cors from 'cors';
-import express, { type RequestHandler } from 'express';
-import rateLimit from 'express-rate-limit';
-import helmet from 'helmet';
-import pinoHttp from 'pino-http';
-import { allowedOrigins, config } from './config.js';
-import { ApiError, errorHandler, notFoundHandler } from './errors.js';
-import { checkDatabase, db } from './db/client.js';
-import { listEntities } from './modules/_base/index.js';
-// projx-anchor: entity-imports
-
-const requestId: RequestHandler = (req, res, next) => {
-  const incoming = req.headers['x-request-id'];
-  const value =
-    typeof incoming === 'string' && incoming.trim()
-      ? incoming
-      : crypto.randomUUID();
-  res.locals.requestId = value;
-  res.setHeader('x-request-id', value);
-  next();
-};
-
-function corsOrigin(
-  origin: string | undefined,
-  callback: (err: Error | null, allow?: boolean) => void,
-): void {
-  const origins = allowedOrigins();
-  if (!origin || origins.includes('*') || origins.includes(origin)) {
-    callback(null, true);
-    return;
-  }
-  callback(new ApiError(403, 'Origin not allowed', 'origin_not_allowed'));
-}
-
-export function buildApp(): express.Express {
-  const app = express();
-
-  app.disable('x-powered-by');
-  app.locals.db = db;
-  app.use(requestId);
-  app.use(pinoHttp({ level: config.LOG_LEVEL }));
-  app.use(helmet());
-  app.use(cors({ origin: corsOrigin, credentials: true }));
-  app.use(compression());
-  app.use(express.json({ limit: '1mb' }));
-  app.use(express.urlencoded({ extended: false, limit: '1mb' }));
-  app.use(
-    rateLimit({
-      windowMs: config.RATE_LIMIT_WINDOW_MS,
-      limit: config.RATE_LIMIT_MAX,
-      standardHeaders: 'draft-8',
-      legacyHeaders: false,
-    }),
-  );
-
-  app.get('/api/health', async (_req, res) => {
-    const checks: Record<string, string> = { app: 'ok' };
-    try {
-      await checkDatabase();
-      checks.database = 'ok';
-    } catch (e) {
-      checks.database = `error: ${e instanceof Error ? e.message : String(e)}`;
-      res.status(503).json({ status: 'unhealthy', checks });
-      return;
-    }
-    res.json({ status: 'healthy', checks });
-  });
-
-  app.get('/api/v1/_meta', (_req, res) => {
-    res.json({ entities: listEntities(), orm: 'drizzle' });
-  });
-
-  // projx-anchor: entity-registrations
-
-  app.use(notFoundHandler);
-  app.use(errorHandler);
-
-  return app;
-}

package/src/addons/orms/drizzle/express/src/modules/_base/auto-routes.ts

@@ -1,278 +0,0 @@
-import express, {
-  type NextFunction,
-  type Request,
-  type Response,
-} from 'express';
-import { eq, inArray, sql } from 'drizzle-orm';
-import type { PgTable } from 'drizzle-orm/pg-core';
-import type { DbClient } from '../../db/client.js';
-import { ApiError } from '../../errors.js';
-import { registerInRegistry } from './registry.js';
-import {
-  buildOrderBy,
-  buildPagination,
-  buildSearchWhere,
-  buildWhere,
-  combineWhere,
-  parseRawQuery,
-} from './query-engine.js';
-
-export type BeforeCreateHook = (
-  request: Request,
-  data: Record<string, unknown>,
-) => void | Promise<void>;
-export type AfterCreateHook = (
-  request: Request,
-  record: Record<string, unknown>,
-) => void | Promise<void>;
-export type BeforeUpdateHook = (
-  request: Request,
-  response: Response,
-  data: Record<string, unknown>,
-) => void | Promise<void>;
-export type AfterUpdateHook = (
-  request: Request,
-  before: Record<string, unknown>,
-  after: Record<string, unknown>,
-) => void | Promise<void>;
-export type BeforeDeleteHook = (
-  request: Request,
-  recordId: string,
-) => void | Promise<void>;
-
-export interface DrizzleEntityConfig {
-  name: string;
-  apiPrefix: string;
-  tag: string;
-  table: PgTable;
-  primaryKey?: string;
-  searchableFields?: string[];
-  readonly?: boolean;
-  bulkOperations?: boolean;
-  beforeCreate?: BeforeCreateHook;
-  afterCreate?: AfterCreateHook;
-  beforeUpdate?: BeforeUpdateHook;
-  afterUpdate?: AfterUpdateHook;
-  beforeDelete?: BeforeDeleteHook;
-}
-
-type AsyncHandler = (
-  req: Request,
-  res: Response,
-  next: NextFunction,
-) => Promise<void>;
-
-function asyncHandler(handler: AsyncHandler) {
-  return (req: Request, res: Response, next: NextFunction): void => {
-    handler(req, res, next).catch(next);
-  };
-}
-
-function column(table: PgTable, key: string): unknown {
-  return (table as unknown as Record<string, unknown>)[key];
-}
-
-function pkColumn(config: DrizzleEntityConfig): unknown {
-  const key = config.primaryKey ?? 'id';
-  const col = column(config.table, key);
-  if (!col) {
-    throw new Error(
-      `Primary key column "${key}" not found on table ${config.name}`,
-    );
-  }
-  return col;
-}
-
-export function registerEntityRoutes(
-  config: DrizzleEntityConfig,
-  db: DbClient,
-): express.Router {
-  registerInRegistry({ name: config.name, apiPrefix: config.apiPrefix });
-  const router = express.Router();
-  const pk = pkColumn(config) as Parameters<typeof eq>[0];
-
-  router.get(
-    '/',
-    asyncHandler(async (req, res) => {
-      const rawQs = req.originalUrl.split('?')[1] ?? '';
-      const query = parseRawQuery(rawQs);
-      const filterWhere = buildWhere(config.table, query.filters);
-      const searchWhere = buildSearchWhere(
-        config.table,
-        config.searchableFields ?? [],
-        query.search,
-      );
-      const where = combineWhere(filterWhere, searchWhere);
-      const order = buildOrderBy(config.table, query.order_by);
-      const offset = (query.page - 1) * query.page_size;
-
-      const baseSelect = db.select().from(config.table);
-      const baseCount = db
-        .select({ count: sql<number>`count(*)::int` })
-        .from(config.table);
-
-      const rows = await (where
-        ? baseSelect
-            .where(where)
-            .orderBy(...order)
-            .limit(query.page_size)
-            .offset(offset)
-        : baseSelect
-            .orderBy(...order)
-            .limit(query.page_size)
-            .offset(offset));
-      const [{ count }] = await (where ? baseCount.where(where) : baseCount);
-
-      res.json({
-        data: rows,
-        pagination: buildPagination(query.page, query.page_size, Number(count)),
-      });
-    }),
-  );
-
-  router.get(
-    '/:id',
-    asyncHandler(async (req, res) => {
-      const [record] = await db
-        .select()
-        .from(config.table)
-        .where(eq(pk, String(req.params.id)))
-        .limit(1);
-      if (!record) throw new ApiError(404, 'Not found', 'not_found');
-      res.json(record);
-    }),
-  );
-
-  if (config.readonly) return router;
-
-  router.post(
-    '/',
-    asyncHandler(async (req, res) => {
-      const data = req.body as Record<string, unknown>;
-      await config.beforeCreate?.(req, data);
-      const [record] = await db
-        .insert(config.table)
-        .values(data as never)
-        .returning();
-      if (config.afterCreate) {
-        try {
-          await config.afterCreate(req, record as Record<string, unknown>);
-        } catch (err) {
-          req.log?.error?.(
-            {
-              err,
-              entity: config.name,
-              record_id: (record as { id?: string }).id,
-            },
-            'afterCreate hook failed (record persisted; hook is best-effort)',
-          );
-        }
-      }
-      res.status(201).json(record);
-    }),
-  );
-
-  router.patch(
-    '/:id',
-    asyncHandler(async (req, res) => {
-      const id = String(req.params.id);
-      const data = req.body as Record<string, unknown>;
-      if (!data || Object.keys(data).length === 0) {
-        throw new ApiError(400, 'Request body cannot be empty', 'empty_body');
-      }
-      if (config.beforeUpdate) {
-        await config.beforeUpdate(req, res, data);
-        if (res.headersSent) return;
-      }
-      let before: Record<string, unknown> | null = null;
-      if (config.afterUpdate) {
-        const [existing] = await db
-          .select()
-          .from(config.table)
-          .where(eq(pk, id))
-          .limit(1);
-        before = (existing as Record<string, unknown>) ?? null;
-      }
-      const [record] = await db
-        .update(config.table)
-        .set(data as never)
-        .where(eq(pk, id))
-        .returning();
-      if (!record) throw new ApiError(404, 'Not found', 'not_found');
-      if (config.afterUpdate && before) {
-        try {
-          await config.afterUpdate(
-            req,
-            before,
-            record as Record<string, unknown>,
-          );
-        } catch (err) {
-          req.log?.error?.(
-            { err, entity: config.name, record_id: id },
-            'afterUpdate hook failed (record persisted; hook is best-effort)',
-          );
-        }
-      }
-      res.json(record);
-    }),
-  );
-
-  router.delete(
-    '/:id',
-    asyncHandler(async (req, res) => {
-      const id = String(req.params.id);
-      if (config.beforeDelete) await config.beforeDelete(req, id);
-      const deleted = await db
-        .delete(config.table)
-        .where(eq(pk, id))
-        .returning();
-      if (deleted.length === 0)
-        throw new ApiError(404, 'Not found', 'not_found');
-      res.status(204).send();
-    }),
-  );
-
-  if (!config.bulkOperations) return router;
-
-  router.post(
-    '/bulk',
-    asyncHandler(async (req, res) => {
-      const { items } = req.body as { items: Record<string, unknown>[] };
-      if (!Array.isArray(items) || items.length === 0) {
-        throw new ApiError(
-          400,
-          'items must be a non-empty array',
-          'validation_error',
-        );
-      }
-      for (const item of items) {
-        await config.beforeCreate?.(req, item);
-      }
-      const rows = await db
-        .insert(config.table)
-        .values(items as never)
-        .returning();
-      res.status(201).json({ data: rows, count: rows.length });
-    }),
-  );
-
-  router.delete(
-    '/bulk',
-    asyncHandler(async (req, res) => {
-      const { ids } = req.body as { ids: string[] };
-      if (!Array.isArray(ids) || ids.length === 0) {
-        throw new ApiError(
-          400,
-          'ids must be a non-empty array',
-          'validation_error',
-        );
-      }
-      await db
-        .delete(config.table)
-        .where(inArray(pk as Parameters<typeof inArray>[0], ids));
-      res.status(204).send();
-    }),
-  );
-
-  return router;
-}

package/src/addons/orms/drizzle/express/src/modules/_base/index.ts

@@ -1,20 +0,0 @@
-export { registerEntityRoutes } from './auto-routes.js';
-export type {
-  DrizzleEntityConfig,
-  BeforeCreateHook,
-  AfterCreateHook,
-  BeforeUpdateHook,
-  AfterUpdateHook,
-  BeforeDeleteHook,
-} from './auto-routes.js';
-export { listEntities, registerInRegistry } from './registry.js';
-export type { RegisteredEntity } from './registry.js';
-export {
-  buildOrderBy,
-  buildPagination,
-  buildSearchWhere,
-  buildWhere,
-  combineWhere,
-  parseRawQuery,
-} from './query-engine.js';
-export type { ParsedQuery, PaginationMeta } from './query-engine.js';

package/src/addons/orms/drizzle/express/src/server.ts

@@ -1,32 +0,0 @@
-import { createServer } from 'node:http';
-import { buildApp } from './app.js';
-import { config } from './config.js';
-import { closeDatabase } from './db/client.js';
-
-const app = buildApp();
-const server = createServer(app);
-
-server.listen(config.PORT, config.HOST, () => {
-  console.log(`Express API listening on http://${config.HOST}:${config.PORT}`);
-});
-
-function shutdown(signal: string): void {
-  console.log(`${signal} received, closing HTTP server`);
-  server.close((err) => {
-    closeDatabase()
-      .catch((closeErr: unknown) => {
-        console.error(closeErr);
-      })
-      .finally(() => {
-        if (err) {
-          console.error(err);
-          process.exit(1);
-        }
-        process.exit(0);
-      });
-  });
-  setTimeout(() => process.exit(1), 10_000).unref();
-}
-
-process.on('SIGTERM', shutdown);
-process.on('SIGINT', shutdown);

package/src/addons/orms/drizzle/express/tests/app.test.ts

@@ -1,24 +0,0 @@
-import request from 'supertest';
-import { describe, expect, it } from 'vitest';
-import { buildApp } from '../src/app.js';
-
-describe('Express Drizzle app', () => {
-  it('exposes empty generated metadata until entities are added', async () => {
-    const res = await request(buildApp()).get('/api/v1/_meta');
-
-    expect(res.status).toBe(200);
-    expect(res.body).toEqual({ entities: [], orm: 'drizzle' });
-  });
-
-  it('returns structured errors with request id', async () => {
-    const res = await request(buildApp())
-      .get('/missing')
-      .set('x-request-id', 'req-missing');
-
-    expect(res.status).toBe(404);
-    expect(res.body.error).toMatchObject({
-      code: 'not_found',
-      request_id: 'req-missing',
-    });
-  });
-});

package/src/addons/orms/drizzle/express/vitest.config.ts

@@ -1,20 +0,0 @@
-import { defineConfig } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    globals: true,
-    environment: 'node',
-    include: ['tests/**/*.test.ts'],
-    coverage: {
-      provider: 'v8',
-      include: ['src/**/*.ts'],
-      exclude: ['src/server.ts', 'src/config.ts'],
-      thresholds: {
-        statements: 80,
-        branches: 80,
-        functions: 80,
-        lines: 80,
-      },
-    },
-  },
-});