create-rebe 1.0.0 → 3.0.0

package/template/core/seeder.core.js

@@ -0,0 +1,105 @@
+'use strict'
+
+const fs = require('fs')
+const path = require('path')
+
+const logger = require('@core/logger.core')
+const Database = require('@core/database.core')
+const Modules = require('@core/modules.core')
+
+const SEEDERS_DIR = path.resolve(process.cwd(), 'database', 'seeders')
+
+// Seeder runner. Seeders are plain async functions used to populate data; unlike
+// migrations they are not tracked and are meant to be re-runnable (write them to be
+// idempotent — e.g. findOrCreate / upsert). Files live in database/seeders/ and/or a
+// module's seeders/ dir. Files starting with "_" are ignored (base classes/helpers).
+//
+//   module.exports = async ({ sequelize, Database, models }) => { ... }
+class Seeder {
+	// Build the context handed to every seeder.
+	static async _context() {
+		const sequelize = await Database.connect()
+		return { sequelize, Database, Sequelize: Database.Sequelize, models: Object.fromEntries(Database.models) }
+	}
+
+	// basename -> absolute path across the flat dir and every module seeders dir.
+	static _discover() {
+		const dirs = [SEEDERS_DIR, ...Modules.dirs('seeders')]
+		const files = new Map()
+
+		for (const dir of dirs) {
+			if (!fs.existsSync(dir)) continue
+			for (const file of fs.readdirSync(dir)) {
+				if (!file.endsWith('.js') || file.startsWith('_')) continue
+				if (!files.has(file)) files.set(file, path.join(dir, file))
+			}
+		}
+
+		return new Map([...files.entries()].sort(([a], [b]) => a.localeCompare(b)))
+	}
+
+	static _run(file, ctx) {
+		const raw = require(file)
+		const fn = raw && raw.default !== undefined ? raw.default : raw
+		if (typeof fn !== 'function') {
+			throw new Error(`Seeder "${path.basename(file)}" must export an async function`)
+		}
+		return fn(ctx)
+	}
+
+	// Run every discovered seeder, in filename order.
+	static async seedAll() {
+		const ctx = await Seeder._context()
+		const all = Seeder._discover()
+
+		if (!all.size) {
+			logger.info('Seeders: nothing to seed')
+			return []
+		}
+
+		const ran = []
+		for (const [name, file] of all) {
+			logger.info(`Seeding: ${name}`)
+			await Seeder._run(file, ctx)
+			ran.push(name)
+		}
+
+		logger.info(`Seeders: ${ran.length} run`)
+		return ran
+	}
+
+	// Run a single seeder. With no name, run database/seeders/index.js (the default
+	// "DatabaseSeeder" entry) when present, otherwise fall back to seeding all.
+	static async seed(name) {
+		const ctx = await Seeder._context()
+
+		if (!name) {
+			const indexFile = path.join(SEEDERS_DIR, 'index.js')
+			if (fs.existsSync(indexFile)) {
+				logger.info('Seeding: index.js')
+				await Seeder._run(indexFile, ctx)
+				return ['index.js']
+			}
+			return Seeder.seedAll()
+		}
+
+		const all = Seeder._discover()
+		// Match leniently: exact filename, or normalized (separators/case stripped) so
+		// `--class=UserSeeder` finds `user-seeder.js`.
+		const norm = (s) =>
+			s
+				.replace(/\.js$/, '')
+				.replace(/[^a-z0-9]/gi, '')
+				.toLowerCase()
+		const wanted = norm(name)
+		const target = all.get(name) || all.get(`${name}.js`) || [...all.entries()].find(([k]) => norm(k) === wanted)?.[1]
+
+		if (!target) throw new Error(`Seeder "${name}" not found in ${[SEEDERS_DIR, ...Modules.dirs('seeders')].join(', ')}`)
+
+		logger.info(`Seeding: ${path.basename(target)}`)
+		await Seeder._run(target, ctx)
+		return [path.basename(target)]
+	}
+}
+
+module.exports = Seeder

package/template/core/socket.core.js

@@ -68,6 +68,7 @@ class Socket {
 
 	static async _loadHandlers() {
 		await Register.invoke(REGISTER_FILE, [Socket.io, Socket], { label: 'app/socket/register.socket.js' })
+		await require('@core/modules.core').invoke('socket', [Socket.io, Socket])
 	}
 
 	static broadcast(event, payload) {

package/template/docs/Database.md

@@ -1,8 +1,9 @@
 # Database API
 
 `@core/database.core` manages the Sequelize connection and model loading. It is
-skipped entirely when `DB_ENABLED=false`. Model/migration generators are
-intentionally out of scope for this framework.
+skipped entirely when `DB_ENABLED=false`. Schema is managed by the migration runner
+([Migration.md](./Migration.md)) and populated by seeders ([Seeder.md](./Seeder.md));
+generate models/migrations/seeders with the CLI (see the [project README](../README.md#cli)).
 
 ```js
 const Database = require('@core/database.core')
@@ -10,12 +11,17 @@ const Database = require('@core/database.core')
 
 ## Methods
 
-| Method         | Returns   | Notes                                                 |
-| -------------- | --------- | ----------------------------------------------------- |
-| `connect()`    | Sequelize | idempotent; `authenticate()` then `loadModels()`      |
-| `disconnect()` | Promise   | closes the pool, clears models                        |
-| `loadModels()` | `Map`     | loads `database/models/*.js`, then wires associations |
-| `model(name)`  | Model     | throws if the model is not registered                 |
+| Method         | Returns    | Notes                                               |
+| -------------- | ---------- | --------------------------------------------------- |
+| `connect()`    | Sequelize  | idempotent; `authenticate()` then `loadModels()`    |
+| `disconnect()` | Promise    | closes the pool, clears models                      |
+| `loadModels()` | `Map`      | loads flat + module models, then wires associations |
+| `modelDirs()`  | `string[]` | `database/models` plus each module's `models/` dir  |
+| `model(name)`  | Model      | throws if the model is not registered               |
+
+Models are loaded from `database/models/*.js` **and** every module's `models/` dir
+(see [Modules.md](./Modules.md)); a name collision logs a warning and the later
+definition wins.
 
 Static re-exports: `Database.Sequelize`, `Database.DataTypes`, `Database.Model`,
 `Database.Op`.

package/template/docs/Express.md

@@ -26,11 +26,14 @@ These are wired by `bootstrap.core`; `upload()` is the one you call from routes.
 3. `compression()`
 4. `express.json` / `express.urlencoded` (limit = `EXPRESS_BODY_LIMIT`)
 5. rate limit (when `EXPRESS_RATE_LIMIT_ENABLED`)
-6. user middleware — `app/http/middlewares/register.middleware.js` `(app) => {}`
+6. user middleware — `app/http/middlewares/register.middleware.js` `(app) => {}`, then module `middlewares` hooks
 7. static — `./public` at `/`, uploads at `/uploads`
-8. routes — `@routes/register.route` then `Routes.apply`
+8. routes — `@routes/register.route` + module routes, then `Routes.apply` (see [Routing.md](./Routing.md))
 9. `error.core` 404 + error handlers
 
+The router (`@core/routing.core`) is internalized into the core as of 3.0.0 — there is
+no external routing dependency.
+
 `x-powered-by` is disabled. The full `storage/` root is **not** served — only
 `/uploads` and `./public`.
 

package/template/docs/Make.md

@@ -0,0 +1,46 @@
+# Scaffolding (`make:`) commands
+
+The CLI generates code for every app layer. Run via `npm run cli -- <command>`. Names
+accept any case (`UserProfile`, `user_profile`, `user-profile`) and are normalized:
+PascalCase for classes, kebab-case for filenames, snake_case (pluralized) for tables.
+
+**Every `make:` command supports `--module=<name>`** to target `modules/<name>/…`
+instead of the flat app, and `--force` to overwrite.
+
+| Command                                          | Creates                                                    | Notes                                                           |
+| ------------------------------------------------ | ---------------------------------------------------------- | --------------------------------------------------------------- |
+| `make:model <Name> [--table=t] [--no-migration]` | `database/models/<name>.model.js` + create-table migration | `--no-migration` skips the migration                            |
+| `make:migration <name>`                          | `database/migrations/<ts>_<name>.js`                       | blank up/down                                                   |
+| `make:seed <Name>`                               | `database/seeders/<name>.js`                               | re-runnable seeder                                              |
+| `make:controller <Name> [--resource] [--api]`    | `app/http/controllers/<name>.controller.js`                | `--resource` = 7 RESTful actions; `--api` = without create/edit |
+| `make:middleware <Name>`                         | `app/http/middlewares/<name>.middleware.js`                | `handle({ req, res, next })` class                              |
+| `make:validator <Name>`                          | `app/http/validators/<name>.validator.js`                  | `create…Schema` / `update…Schema` (zod)                         |
+| `make:route <name>`                              | `app/routes/<name>.route.js`                               | `Routes.group(...)` file                                        |
+| `make:job <Name>`                                | `app/jobs/<name>.job.js`                                   | `(Cron) => Cron.define(...)`                                    |
+| `make:queue <Name>`                              | `app/queue/<name>.queue.js`                                | `(Queue) => Queue.define(...)`                                  |
+| `make:socket <Name>`                             | `app/socket/<name>.socket.js`                              | `(io, Socket) => {}`                                            |
+| `make:hook [name]`                               | `app/hooks/<name>.hook.js` (or `register.hook.js`)         | `{ before, after, shutdown }`                                   |
+| `make:resource <Name> [--api]`                   | controller + model + migration + validator + route         | a wired vertical slice                                          |
+| `make:module <name>`                             | a full mini-app under `modules/<name>/`                    | see [Modules.md](./Modules.md)                                  |
+
+## Wiring notes
+
+Some layers load through a single register file, so the CLI prints a one-line hint:
+
+- **Routes** — flat `app/routes/<name>.route.js` must be required from
+  `app/routes/register.route.js`. Inside a **module**, route files in `routes/` are
+  **auto-loaded** (drop one in and it works).
+- **Jobs / queue / socket** — flat files are invoked from the matching
+  `app/.../register.*.js`; module files are wired by the module entry.
+
+## Examples
+
+```bash
+npm run cli -- make:resource Post                 # full CRUD slice (web)
+npm run cli -- make:resource Post --api           # JSON-only CRUD
+npm run cli -- make:controller Billing --resource
+npm run cli -- make:middleware EnsureAdmin
+npm run cli -- make:module blog                   # full mini-app module
+npm run cli -- make:resource Article --module=blog --api
+npm run cli -- db:migrate                          # apply the generated migrations
+```

package/template/docs/Migration.md

@@ -0,0 +1,56 @@
+# Migration API
+
+`@core/migrator.core` is a lightweight schema-migration runner built on Sequelize's
+`QueryInterface` — no extra dependencies. It replaces relying on `sync({ force, alter })`
+for managing schema. Applied migrations are tracked in the `_migrations` table.
+
+```js
+const Migrator = require('@core/migrator.core')
+```
+
+Migrations live in `database/migrations/*.js` and/or any module's `migrations/` dir.
+Files are ordered **globally by filename**, so the `YYYYMMDDHHmmss_` timestamp prefix
+the CLI generates gives deterministic order across the flat dir and every module.
+Files whose name starts with `_` are ignored (helpers/partials).
+
+## Writing a migration
+
+```js
+// database/migrations/20260619101540_create_articles.js
+module.exports = {
+	async up(queryInterface, Sequelize) {
+		await queryInterface.createTable('articles', {
+			id: { type: Sequelize.BIGINT.UNSIGNED, primaryKey: true, autoIncrement: true },
+			title: { type: Sequelize.STRING(190), allowNull: false, unique: true },
+			created_at: { type: Sequelize.DATE, allowNull: false, defaultValue: Sequelize.fn('NOW') },
+			updated_at: { type: Sequelize.DATE, allowNull: false, defaultValue: Sequelize.fn('NOW') },
+		})
+	},
+	async down(queryInterface) {
+		await queryInterface.dropTable('articles')
+	},
+}
+```
+
+Generate one with `make:model <Name>` (model + create-table migration) or
+`make:migration <name>` (blank up/down) — see the CLI table in the
+[project README](../README.md#cli).
+
+## Methods
+
+| Method               | Returns    | Notes                                                        |
+| -------------------- | ---------- | ------------------------------------------------------------ |
+| `up()`               | `string[]` | run every pending migration under the next batch number      |
+| `down({ step = 1 })` | `string[]` | roll back the most recent batch (or the last `step` batches) |
+| `rollbackAll()`      | `Promise`  | roll back every batch, one at a time                         |
+| `status()`           | `object[]` | `[{ name, applied, batch }]` for all discovered migrations   |
+| `dropAllTables()`    | `string[]` | drop every table (FK checks toggled per dialect)             |
+
+## Batches
+
+Each `up()` run records its migrations under a single incrementing `batch`. `down()`
+rolls back the latest batch as a unit, so a group migrated together rolls back together.
+`--step=N` on `db:rollback` extends this to the last `N` batches.
+
+> Once migrations are the source of truth, keep `DB_FORCE` / `DB_ALTER` **off** in
+> production — let migrations own the schema.

package/template/docs/Modules.md

@@ -0,0 +1,96 @@
+# Modules API
+
+`@core/modules.core` is an **opt-in** layer that groups one feature's pieces — models,
+routes, migrations, seeders, jobs, queue workers, socket handlers — under
+`modules/<name>/` behind a single entry file. It is fully additive: the flat layout
+(`database/models`, `app/routes`, …) keeps working untouched, and a project with no
+`modules/` directory pays nothing.
+
+```js
+const Modules = require('@core/modules.core')
+```
+
+## Anatomy of a module
+
+`make:module <name>` scaffolds a **full mini-app** mirroring the app layout:
+
+```
+modules/
+└── blog/
+    ├── blog.module.js              # entry (also accepts module.js / index.js)
+    ├── http/
+    │   ├── controllers/            # static-class controllers
+    │   ├── middlewares/register.middleware.js   # (app) => {}
+    │   └── validators/             # zod schemas
+    ├── routes/                     # *.js auto-loaded (drop in <name>.route.js)
+    ├── jobs/register.job.js        # (Cron) => {}
+    ├── queue/register.queue.js     # (Queue) => {}
+    ├── socket/register.socket.js   # (io, Socket) => {}
+    ├── hooks/register.hook.js      # { before, after, shutdown }
+    ├── models/                     # (sequelize, DataTypes) factories
+    ├── migrations/                 # up/down migration files
+    └── seeders/                    # seeder files
+```
+
+Target a module with `--module=<name>` on any `make:` command (e.g.
+`make:resource Article --module=blog`); files land in the right subfolder. Route files
+in `routes/` are auto-loaded, so a generated `<name>.route.js` works with no wiring.
+
+## Entry file
+
+Every field is optional. Directory fields resolve against the module folder; the
+function/object fields mirror the flat `app/.../register.*.js` shapes.
+
+```js
+// modules/blog/blog.module.js
+module.exports = {
+	name: 'blog', // optional, defaults to the folder name
+
+	// scanned directories
+	models: './models', // dir scanned by database.core
+	migrations: './migrations', // dir scanned by migrator.core
+	seeders: './seeders', // dir scanned by seeder.core
+	routes: './routes', // file → required; dir → every *.js auto-loaded
+
+	// register hooks
+	middlewares: require('./http/middlewares/register.middleware'), // (app) => {}
+	jobs: require('./jobs/register.job'), // (Cron) => {}
+	queue: require('./queue/register.queue'), // (Queue) => {}
+	socket: require('./socket/register.socket'), // (io, Socket) => {}
+	hooks: require('./hooks/register.hook'), // { before, after, shutdown }
+}
+```
+
+The function hooks and `hooks` lifecycle object receive the exact same facades/context as
+the flat `app/.../register.*.js` files and run **after** them during boot.
+
+## How discovery wires in
+
+| Contribution  | Loaded by                              | When                  |
+| ------------- | -------------------------------------- | --------------------- |
+| `models`      | `database.core.loadModels()`           | DB connect            |
+| `migrations`  | `migrator.core`                        | CLI `db:*`            |
+| `seeders`     | `seeder.core`                          | CLI `db:seed*`        |
+| `routes`      | `express.core` (after flat routes)     | HTTP boot             |
+| `middlewares` | `express.core` (after flat middleware) | HTTP boot             |
+| `jobs`        | `cron.core` (after flat register)      | Cron start            |
+| `queue`       | `queue.core` (after flat register)     | Queue start           |
+| `socket`      | `socket.core` (after flat register)    | Socket attach         |
+| `hooks`       | `hooks.core` (after the flat app hook) | before/after/shutdown |
+
+Folders (and modules) whose name starts with `_` are skipped. A module with no entry
+file is skipped with a warning. The core layer never imports module code statically —
+modules are app-land, discovered here at runtime, so the dependency arrow stays
+one-directional (`app → core`).
+
+## Methods
+
+| Method                 | Returns    | Notes                                                                    |
+| ---------------------- | ---------- | ------------------------------------------------------------------------ |
+| `discover()`           | `object[]` | cached `[{ name, dir, def }]` for every module                           |
+| `dirs(kind)`           | `string[]` | absolute, existing dirs for `'models' \| 'migrations' \| 'seeders'`      |
+| `requireRoutes()`      | `void`     | load each module's routes (dir → every `*.js`, file → that file)         |
+| `invoke(kind, args)`   | `Promise`  | call each module's `'middlewares' \| 'jobs' \| 'queue' \| 'socket'` hook |
+| `runHooks(stage, ctx)` | `Promise`  | run each module's `hooks[stage]` (`before` \| `after` \| `shutdown`)     |
+| `list()`               | `string[]` | module names                                                             |
+| `reset()`              | `void`     | clear the discovery cache (tooling/tests)                                |

package/template/docs/README.md

@@ -14,11 +14,16 @@ Per-core API documentation. For project setup, structure, and the boot flow, see
 | Redis (optional)           | [Redis.md](./Redis.md)         |
 | Hooks                      | [Hooks.md](./Hooks.md)         |
 | Express (HTTP)             | [Express.md](./Express.md)     |
+| Routing                    | [Routing.md](./Routing.md)     |
 | Socket.IO                  | [Socket.md](./Socket.md)       |
 | Validator                  | [Validator.md](./Validator.md) |
 | Cron                       | [Cron.md](./Cron.md)           |
 | Queue                      | [Queue.md](./Queue.md)         |
 | Database                   | [Database.md](./Database.md)   |
+| Migration                  | [Migration.md](./Migration.md) |
+| Seeder                     | [Seeder.md](./Seeder.md)       |
+| Modules (optional)         | [Modules.md](./Modules.md)     |
+| Scaffolding (`make:`)      | [Make.md](./Make.md)           |
 | Common (utils)             | [Common.md](./Common.md)       |
 | Register (app→core bridge) | [Register.md](./Register.md)   |
 | Bootstrap                  | [Bootstrap.md](./Bootstrap.md) |

package/template/docs/Routing.md

@@ -0,0 +1,116 @@
+# Routing API
+
+`@core/routing.core` is the Laravel-style router (internalized in 3.0.0 — previously the
+external `@refkinscallv/express-routing` package). Define routes against the static
+`Routes` class; `express.core` calls `Routes.apply(app, router)` during boot.
+
+```js
+const Routes = require('@core/routing.core')
+```
+
+Every handler and `handle()`-based middleware receives the context
+`{ req, res, next, error }` (`error` is only populated in the error handler).
+
+## Defining routes
+
+```js
+Routes.group('api', () => {
+	Routes.get('status', ({ res }) => res.json({ status: true, code: 200, message: 'OK', data: null, meta: null }))
+	Routes.post('users', UserController.store, [Validator.make(createUserSchema)])
+	Routes.get('users/:id', UserController.show).whereNumber('id').name('users.show')
+})
+```
+
+| Method                                                        | Notes                                              |
+| ------------------------------------------------------------- | -------------------------------------------------- |
+| `get/post/put/delete/patch/options/head(path, handler, mws?)` | register one route; returns a chainable handle     |
+| `add(methods, path, handler, mws?)`                           | one or many methods at once                        |
+| `group(prefix, callback, mws?)`                               | nest routes under a URL prefix + shared middleware |
+| `redirect(from, to, status=302)`                              | redirect route                                     |
+| `view(path, view, data?)`                                     | render via the Express view engine                 |
+
+Handlers may be an inline `({ req, res }) => …`, a `[Controller, 'method']` tuple, or a
+controller method reference (`UserController.show`).
+
+## Chainable registration
+
+```js
+Routes.get('users/:id', handler)
+	.name('users.show') // for Routes.url()/route()
+	.whereNumber('id') // constrain :id to [0-9]+
+	.where('slug', '[a-z-]+') // custom regex (string or RegExp)
+```
+
+`whereNumber`, `whereAlpha`, `whereAlphaNumeric`, `whereUuid` are shorthands. A request
+whose param fails the constraint falls through (`next('route')`) so a later route can match.
+
+## Middleware
+
+Middleware can be a plain Express function, a class/object with
+`handle({ req, res, next, error })`, or a registered **alias/group** name (string).
+
+```js
+// Named aliases & groups (Laravel-style)
+Routes.registerMiddleware('auth', AuthMiddleware)
+Routes.registerMiddleware({ admin: AdminMiddleware, guest: GuestMiddleware })
+Routes.middlewareGroup('web', [SessionMw, CsrfMw])
+
+// Scoped — accepts plain functions OR handle() classes:
+Routes.middleware([AuthMiddleware, logFn], () => {
+	Routes.get('me', UserController.me)
+})
+
+// Chaining — STRICT: only handle() classes/objects/aliases (no plain functions):
+Routes.middleware(['auth']).get('me', UserController.me)
+Routes.middleware([AuthMiddleware]).group('admin', () => {
+	/* ... */
+})
+```
+
+Per-route middleware is the optional 3rd argument: `Routes.get(path, handler, [Mw])`.
+
+## Controllers & resources
+
+```js
+// Auto-register every public method of a controller (methods starting with "_" are private):
+//   index -> /base · samplePath -> /base/sample-path · post_create -> POST /base/create
+Routes.controller('users', UserController, { index: [AuthMiddleware] })
+
+// The seven RESTful routes (only actions the controller implements are mounted):
+Routes.resource('photos', PhotoController) // index/create/store/show/edit/update/destroy
+Routes.apiResource('photos', PhotoController) // same, minus create/edit (HTML forms)
+Routes.resource('photos', PhotoController, { only: ['index', 'show'], parameter: 'photo', middleware: [AuthMiddleware] })
+```
+
+Generate these with `make:controller --resource` / `make:resource` (see [Make.md](./Make.md)).
+
+## Named routes & URL generation
+
+```js
+Routes.get('users/:id', handler).name('users.show')
+Routes.url('users.show', { id: 5 }) // → /users/5
+Routes.route('users.show', { id: 5, tab: 'a' }) // → /users/5?tab=a  (alias of url())
+```
+
+Missing required params throw; extra keys become query string; values are
+`encodeURIComponent`-escaped.
+
+## App-level handlers
+
+| Method                           | Purpose                                                                  |
+| -------------------------------- | ------------------------------------------------------------------------ |
+| `errorHandler(handler)`          | global error handler — receives `{ req, res, next, error }`              |
+| `fallback(handler)`              | runs when no route matched (before the framework 404)                    |
+| `maintenance(enabled, handler?)` | when on, every request gets 503 before routes                            |
+| `allRoutes()`                    | `[{ methods, path, name, middlewareCount, handlerType }]` for inspection |
+
+## Applying routes
+
+`express.core` already calls this — you rarely call it directly:
+
+```js
+await Routes.apply(app) // mount on app
+await Routes.apply(app, router) // mount on a router, then app.use(router)
+```
+
+Types ship at `core/routing.core.d.ts` for editor IntelliSense.

package/template/docs/Seeder.md

@@ -0,0 +1,54 @@
+# Seeder API
+
+`@core/seeder.core` runs data seeders. Unlike migrations, seeders are **not tracked**
+and are meant to be re-runnable — write them idempotently (`findOrCreate` / `upsert`).
+
+```js
+const Seeder = require('@core/seeder.core')
+```
+
+Seeders live in `database/seeders/*.js` and/or any module's `seeders/` dir. Files run
+in filename order (prefix with numbers to control sequence). Files starting with `_`
+are ignored (base classes/helpers).
+
+## Writing a seeder
+
+Each seeder exports an async function receiving a context object:
+
+```js
+// database/seeders/article-seeder.js
+module.exports = async ({ Database, sequelize, Sequelize, models }) => {
+	const Article = Database.model('Article')
+	for (const title of ['Hello World', 'Second Post']) {
+		await Article.findOrCreate({ where: { title }, defaults: { title } })
+	}
+}
+```
+
+| Context key | What it is                                        |
+| ----------- | ------------------------------------------------- |
+| `Database`  | the database core (`Database.model('Name')`)      |
+| `sequelize` | the live Sequelize instance                       |
+| `Sequelize` | the Sequelize constructor (DataTypes, `Op`, …)    |
+| `models`    | a plain object of all loaded models keyed by name |
+
+Generate one with `make:seed <Name>`.
+
+## Methods
+
+| Method       | Returns    | Notes                                                                        |
+| ------------ | ---------- | ---------------------------------------------------------------------------- |
+| `seedAll()`  | `string[]` | run every discovered seeder, in filename order                               |
+| `seed(name)` | `string[]` | run one seeder; matches filename leniently (`UserSeeder` ↔ `user-seeder.js`) |
+
+With no `name`, `seed()` runs `database/seeders/index.js` (a "DatabaseSeeder" entry that
+can call others) when present, otherwise falls back to running all seeders.
+
+## CLI
+
+```bash
+npm run cli -- db:seed                 # default seeder (index.js) or all
+npm run cli -- db:seed --class=ArticleSeeder
+npm run cli -- db:seed --all           # every seeder  (alias: seed-all)
+npm run cli -- db:reset --seed         # drop → migrate → seed
+```

package/template/eslint.config.js

@@ -0,0 +1,52 @@
+'use strict'
+
+const js = require('@eslint/js')
+const globals = require('globals')
+const security = require('eslint-plugin-security')
+const n = require('eslint-plugin-n').default
+
+// Flat config (ESLint 10). Correctness via @eslint/js recommended + node best practices
+// (eslint-plugin-n), security smells via eslint-plugin-security. Prettier owns
+// formatting, so no stylistic rules here.
+module.exports = [
+	{
+		ignores: ['node_modules/**', 'coverage/**', 'logs/**', 'storage/**', 'public/**', 'create-rebe/template/**', '**/*.d.ts'],
+	},
+
+	js.configs.recommended,
+	n.configs['flat/recommended-script'],
+	security.configs.recommended,
+
+	{
+		languageOptions: {
+			ecmaVersion: 2023,
+			sourceType: 'commonjs',
+			globals: { ...globals.node },
+		},
+		rules: {
+			// Register/handler callbacks routinely receive facade args they may not use
+			// (e.g. (io, Socket) => {}); don't flag unused args, only unused vars/imports.
+			'no-unused-vars': ['warn', { args: 'none', varsIgnorePattern: '^_' }],
+			'no-extend-native': 'error',
+
+			// The framework is a loader/scaffolder by design: it requires modules and
+			// reads files from computed paths, and shells out from the setup CLI. These
+			// security rules fire on that intentional behavior, so they are disabled to
+			// keep the genuine findings (eval, unsafe regex, timing, weak crypto) signal-rich.
+			'security/detect-non-literal-require': 'off',
+			'security/detect-non-literal-fs-filename': 'off',
+			'security/detect-child-process': 'off',
+			'security/detect-object-injection': 'off',
+
+			// module-alias (@core/*, @config/*) is resolved at runtime, not by eslint-plugin-n.
+			'n/no-missing-require': 'off',
+			'n/no-unpublished-require': 'off',
+			'n/no-process-exit': 'off',
+		},
+	},
+
+	{
+		files: ['tests/**/*.js'],
+		languageOptions: { globals: { ...globals.jest } },
+	},
+]