create-rebe 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Refkinscallv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,54 @@
+# create-rebe
+
+Scaffold a new [rebe](https://www.npmjs.com/package/create-rebe) backend project.
+
+```bash
+npm create rebe@latest my-api
+# or
+npx create-rebe my-api
+```
+
+## Options
+
+| Flag                               | Description                                                   |
+| ---------------------------------- | ------------------------------------------------------------- |
+| `<directory>`                      | target directory (positional; prompted if omitted)            |
+| `--name <name>`                    | project (package.json) name; defaults to the directory name   |
+| `--pm <manager>`                   | `npm` \| `pnpm` \| `yarn` \| `bun` (auto-detected by default) |
+| `--install` / `--no-install`       | install dependencies after scaffolding                        |
+| `--git` / `--no-git`               | initialise a git repository                                   |
+| `--no-env`                         | do not generate `.env` from `.env.example`                    |
+| `--force`                          | scaffold into a non-empty directory                           |
+| `-y`, `--yes`                      | accept defaults, never prompt                                 |
+| `-h`, `--help` / `-v`, `--version` | help / version                                                |
+
+Examples:
+
+```bash
+npm create rebe@latest my-api --pm pnpm --git --install
+npm create rebe@latest . --name my-api -y
+```
+
+Unless `--no-env` is given, the scaffolder writes a `.env` derived from
+`.env.example` with freshly generated `APP_KEY`, `JWT_SECRET`, and
+`JWT_REFRESH_SECRET`.
+
+## Design
+
+- Zero runtime dependencies (Node built-ins only) to keep the supply-chain surface
+  minimal.
+- create-rebe lives inside the rebe repo (`app/create-rebe`). The framework template
+  is bundled under `template/`, generated from the repo root by `npm run sync` (run
+  automatically on `prepublishOnly`), so the framework stays the single source of
+  truth.
+
+## Development
+
+```bash
+npm run sync     # regenerate template/ from the repo root (excludes create-rebe)
+node bin/create-rebe.js /tmp/demo --no-install -y
+```
+
+## License
+
+MIT

package/bin/create-rebe.js

@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+
+'use strict'
+
+// Scaffolder for the `rebe` backend framework.
+//
+//   npm create rebe@latest [dir] [options]
+//
+// Zero runtime dependencies (Node built-ins only) to keep the supply-chain
+// surface minimal. The framework template is bundled under ./template.
+
+const fs = require('fs')
+const path = require('path')
+const crypto = require('crypto')
+const readline = require('readline')
+const { spawnSync } = require('child_process')
+
+const COLORS = {
+	reset: '\x1b[0m',
+	bold: '\x1b[1m',
+	dim: '\x1b[2m',
+	red: '\x1b[31m',
+	green: '\x1b[32m',
+	yellow: '\x1b[33m',
+	cyan: '\x1b[36m',
+}
+
+function c(color, msg) {
+	return `${COLORS[color]}${msg}${COLORS.reset}`
+}
+
+const log = {
+	info: (m) => console.log(`${c('cyan', '-')} ${m}`),
+	ok: (m) => console.log(`${c('green', '✓')} ${m}`),
+	warn: (m) => console.log(`${c('yellow', '!')} ${m}`),
+	err: (m) => console.error(`${c('red', '✗')} ${m}`),
+	step: (m) => console.log(`\n${c('bold', m)}`),
+}
+
+const PKG = require('../package.json')
+
+function resolveTemplateDir() {
+	// Published package bundles ./template. During local development fall back to
+	// the framework root (create-rebe lives inside the rebe repo at app/create-rebe,
+	// so the framework is this package's parent directory).
+	const bundled = path.join(__dirname, '..', 'template')
+	if (fs.existsSync(path.join(bundled, 'package.json'))) return bundled
+
+	const repoRoot = path.join(__dirname, '..', '..')
+	if (fs.existsSync(path.join(repoRoot, 'package.json'))) return repoRoot
+
+	return null
+}
+
+// ── Argument parsing ────────────────────────────────────────────────────────
+// Tolerant parser: collects positionals, --flag, --flag=value, --no-flag, and
+// short -y. Unknown flags are kept (forward compatible) but ignored.
+function parseArgs(argv) {
+	const opts = { _: [] }
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i]
+		if (arg === '-y') {
+			opts.yes = true
+		} else if (arg === '-h') {
+			opts.help = true
+		} else if (arg === '-v') {
+			opts.version = true
+		} else if (arg.startsWith('--')) {
+			const body = arg.slice(2)
+			if (body.startsWith('no-')) {
+				opts[camel(body.slice(3))] = false
+			} else if (body.includes('=')) {
+				const [k, val] = body.split(/=(.*)/s)
+				opts[camel(k)] = val
+			} else {
+				const next = argv[i + 1]
+				if (next !== undefined && !next.startsWith('-')) {
+					opts[camel(body)] = next
+					i++
+				} else {
+					opts[camel(body)] = true
+				}
+			}
+		} else {
+			opts._.push(arg)
+		}
+	}
+	return opts
+}
+
+function camel(s) {
+	return s.replace(/-([a-z])/g, (_, ch) => ch.toUpperCase())
+}
+
+function printHelp() {
+	console.log(`
+${c('bold', 'create-rebe')} ${c('dim', `v${PKG.version}`)}
+
+Scaffold a new rebe backend project.
+
+${c('bold', 'Usage')}
+  npm create rebe@latest ${c('dim', '[directory] [options]')}
+  npx create-rebe ${c('dim', '[directory] [options]')}
+
+${c('bold', 'Options')}
+  --name <name>      Project (package.json) name. Default: directory name.
+  --pm <manager>     Package manager: npm | pnpm | yarn | bun. Default: auto.
+  --install          Install dependencies after scaffolding.
+  --no-install       Skip dependency installation.
+  --git              Initialise a git repository.
+  --no-git           Skip git initialisation.
+  --no-env           Do not generate a .env file from .env.example.
+  --force            Scaffold into a non-empty directory.
+  -y, --yes          Accept all defaults; never prompt.
+  -h, --help         Show this help.
+  -v, --version      Show version.
+
+${c('bold', 'Examples')}
+  npm create rebe@latest my-api
+  npm create rebe@latest my-api --pm pnpm --git --install
+  npm create rebe@latest . --name my-api -y
+`)
+}
+
+// ── Validation helpers ──────────────────────────────────────────────────────
+function isValidPackageName(name) {
+	// Subset of npm naming rules sufficient for scaffolding.
+	return /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(name)
+}
+
+function toPackageName(raw) {
+	return String(raw)
+		.trim()
+		.toLowerCase()
+		.replace(/[^a-z0-9-._~/@]/g, '-')
+		.replace(/^-+|-+$/g, '')
+}
+
+function isEmptyDir(dir) {
+	if (!fs.existsSync(dir)) return true
+	const entries = fs.readdirSync(dir).filter((e) => e !== '.git')
+	return entries.length === 0
+}
+
+function detectPackageManager() {
+	const ua = process.env.npm_config_user_agent || ''
+	if (ua.startsWith('pnpm')) return 'pnpm'
+	if (ua.startsWith('yarn')) return 'yarn'
+	if (ua.startsWith('bun')) return 'bun'
+	return 'npm'
+}
+
+// ── Prompt (only when interactive and not --yes) ────────────────────────────
+function ask(question, fallback) {
+	return new Promise((resolve) => {
+		const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+		const suffix = fallback ? c('dim', ` (${fallback})`) : ''
+		rl.question(`${c('cyan', '?')} ${question}${suffix} `, (answer) => {
+			rl.close()
+			resolve(answer.trim() || fallback || '')
+		})
+	})
+}
+
+// ── File operations ─────────────────────────────────────────────────────────
+const COPY_SKIP = new Set(['node_modules', '.git', '.env', 'create-rebe', 'template', 'coverage'])
+
+function copyDir(src, dest) {
+	fs.mkdirSync(dest, { recursive: true })
+	for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+		// Defence in depth: the bundled template is pre-cleaned, but when scaffolding
+		// from the repo root (dev fallback) these must never be copied.
+		if (COPY_SKIP.has(entry.name)) continue
+
+		const from = path.join(src, entry.name)
+		const to = path.join(dest, entry.name)
+		if (entry.isDirectory()) {
+			copyDir(from, to)
+		} else if (entry.isSymbolicLink()) {
+			continue
+		} else {
+			fs.copyFileSync(from, to)
+		}
+	}
+}
+
+function genKey(bytes) {
+	return crypto.randomBytes(bytes).toString('hex')
+}
+
+// Generate .env from .env.example with fresh secrets and the project name. Done
+// with plain string replacement so we never execute project code.
+function writeEnv(targetDir, name) {
+	const examplePath = path.join(targetDir, '.env.example')
+	if (!fs.existsSync(examplePath)) return false
+
+	let content = fs.readFileSync(examplePath, 'utf8')
+	const replacements = {
+		APP_NAME: name,
+		APP_KEY: genKey(32),
+		JWT_SECRET: genKey(64),
+		JWT_REFRESH_SECRET: genKey(64),
+	}
+	for (const [key, value] of Object.entries(replacements)) {
+		const re = new RegExp(`^${key}=.*$`, 'm')
+		content = re.test(content) ? content.replace(re, `${key}=${value}`) : `${content}\n${key}=${value}`
+	}
+	fs.writeFileSync(path.join(targetDir, '.env'), content)
+	return true
+}
+
+function rewritePackageName(targetDir, name) {
+	const pkgPath = path.join(targetDir, 'package.json')
+	if (!fs.existsSync(pkgPath)) return
+	const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+	pkg.name = name
+	pkg.version = '0.1.0'
+	pkg.description = ''
+	// Drop framework-specific metadata so a generated project starts clean.
+	for (const key of ['author', 'repository', 'bugs', 'homepage', 'keywords']) delete pkg[key]
+	fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, '\t') + '\n')
+}
+
+function run(cmd, args, cwd) {
+	const res = spawnSync(cmd, args, { cwd, stdio: 'inherit', shell: process.platform === 'win32' })
+	return res.status === 0
+}
+
+// ── Main ────────────────────────────────────────────────────────────────────
+async function main() {
+	const opts = parseArgs(process.argv.slice(2))
+
+	if (opts.version) return console.log(PKG.version)
+	if (opts.help) return printHelp()
+
+	const templateDir = resolveTemplateDir()
+	if (!templateDir) {
+		log.err('Template not found. The create-rebe package appears to be corrupted.')
+		process.exit(1)
+	}
+
+	const interactive = process.stdin.isTTY && !opts.yes
+
+	// Target directory
+	let targetArg = opts._[0]
+	if (!targetArg) {
+		targetArg = interactive ? await ask('Project directory:', 'rebe-app') : 'rebe-app'
+	}
+	const targetDir = path.resolve(process.cwd(), targetArg)
+	const dirName = path.basename(targetDir)
+
+	// Project name
+	let name = opts.name || (interactive ? await ask('Project name:', toPackageName(dirName)) : toPackageName(dirName))
+	name = toPackageName(name)
+	if (!isValidPackageName(name)) {
+		log.err(`Invalid project name: "${name}"`)
+		process.exit(1)
+	}
+
+	// Empty-directory guard
+	if (!isEmptyDir(targetDir) && !opts.force) {
+		log.err(`Target directory is not empty: ${targetDir}`)
+		log.info('Use --force to scaffold anyway, or choose another directory.')
+		process.exit(1)
+	}
+
+	// Decisions
+	const pm = opts.pm || detectPackageManager()
+	if (!['npm', 'pnpm', 'yarn', 'bun'].includes(pm)) {
+		log.err(`Unknown package manager: ${pm}`)
+		process.exit(1)
+	}
+	const doGit = opts.git ?? (interactive ? (await ask('Initialise git? (y/N):', 'N')).toLowerCase().startsWith('y') : false)
+	const doInstall = opts.install ?? (interactive ? (await ask('Install dependencies? (y/N):', 'N')).toLowerCase().startsWith('y') : false)
+	const doEnv = opts.env !== false
+
+	// Scaffold
+	log.step(`Creating ${c('cyan', name)} in ${c('dim', targetDir)}`)
+	copyDir(templateDir, targetDir)
+	rewritePackageName(targetDir, name)
+	log.ok('Project files copied')
+
+	if (doEnv && writeEnv(targetDir, name)) log.ok('.env created with generated secrets')
+
+	if (doGit) {
+		const ok = run('git', ['init', '-q'], targetDir)
+		ok ? log.ok('git repository initialised') : log.warn('git init failed (is git installed?)')
+	}
+
+	if (doInstall) {
+		log.step(`Installing dependencies with ${pm}`)
+		const ok = run(pm, ['install'], targetDir)
+		ok ? log.ok('Dependencies installed') : log.warn('Dependency installation failed; run it manually later')
+	}
+
+	// Next steps
+	const rel = path.relative(process.cwd(), targetDir) || '.'
+	const runCmd = pm === 'npm' ? 'npm run' : pm
+	log.step('Done. Next steps:')
+	if (rel !== '.') console.log(`  cd ${rel}`)
+	if (!doInstall) console.log(`  ${pm} install`)
+	if (!doEnv) console.log(`  cp .env.example .env  ${c('dim', '# then set APP_KEY / JWT secrets')}`)
+	console.log(`  ${runCmd} dev`)
+	console.log()
+}
+
+main().catch((err) => {
+	log.err(err && err.stack ? err.stack : String(err))
+	process.exit(1)
+})

package/package.json

@@ -0,0 +1,40 @@
+{
+	"name": "create-rebe",
+	"version": "1.0.0",
+	"description": "Scaffold a new rebe backend project: npm create rebe@latest <dir>.",
+	"license": "MIT",
+	"author": "Refkinscallv <refkinscallv@gmail.com>",
+	"type": "commonjs",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/refkinscallv/rebe.git",
+		"directory": "create-rebe"
+	},
+	"bugs": {
+		"url": "https://github.com/refkinscallv/rebe/issues"
+	},
+	"homepage": "https://github.com/refkinscallv/rebe/tree/main/create-rebe#readme",
+	"bin": {
+		"create-rebe": "bin/create-rebe.js"
+	},
+	"files": [
+		"bin",
+		"template",
+		"README.md"
+	],
+	"engines": {
+		"node": ">=20.9.0"
+	},
+	"scripts": {
+		"sync": "node scripts/sync-template.js",
+		"prepublishOnly": "node scripts/sync-template.js"
+	},
+	"keywords": [
+		"rebe",
+		"create-rebe",
+		"scaffold",
+		"boilerplate",
+		"express",
+		"backend"
+	]
+}

package/template/.env.example

@@ -0,0 +1,141 @@
+# ========== Application ==========
+APP_ENV=development
+APP_NAME=rebe
+APP_URL=http://localhost:3000
+APP_PORT=3000
+APP_TIMEZONE=UTC
+# Generate with: npm run cli -- key:generate
+APP_KEY=
+
+# ========== HTTP / Express ==========
+# Comma-separated allowlist, or * for any origin. When * is used, credentials are
+# forced off (browsers reject wildcard origin + credentials).
+CORS_ORIGIN=*
+CORS_CREDENTIALS=false
+CORS_MAX_AGE=86400
+EXPRESS_BODY_LIMIT=10mb
+# Number of trusted proxy hops (0 = direct exposure). Set to 1 behind one proxy.
+EXPRESS_TRUST_PROXY=0
+EXPRESS_RATE_LIMIT_ENABLED=true
+EXPRESS_RATE_LIMIT_WINDOW_MS=900000
+EXPRESS_RATE_LIMIT_MAX=100
+
+# ========== Database ==========
+DB_ENABLED=false
+DB_DIALECT=mysql
+DB_HOST=localhost
+DB_PORT=3306
+DB_USER=
+DB_PASS=
+DB_NAME=
+DB_TIMEZONE=+00:00
+# Logging
+DB_LOGGING=false
+DB_BENCHMARK=false
+DB_LOG_PARAMS=false
+# Model defaults
+DB_UNDERSCORED=false
+DB_FREEZE_TABLE=false
+DB_TIMESTAMPS=true
+DB_PARANOID=false
+# Schema sync — never enable in production
+DB_FORCE=false
+DB_ALTER=false
+# Pool
+DB_POOL_MAX=10
+DB_POOL_MIN=0
+DB_POOL_ACQUIRE=30000
+DB_POOL_IDLE=10000
+# Retry
+DB_RETRY_MAX=3
+# Dialect specific
+DB_CONNECT_TIMEOUT=10000
+DB_SSL=false
+DB_TRUST_CERT=true
+DB_REQUEST_TIMEOUT=30000
+
+# ========== JWT ==========
+# Generate with: npm run cli -- key:jwt   (and: npm run cli -- key:jwt --refresh)
+JWT_SECRET=
+JWT_EXPIRES_IN=1d
+JWT_REFRESH_SECRET=
+JWT_REFRESH_EXPIRES_IN=7d
+
+# ========== Bcrypt ==========
+BCRYPT_SALT_ROUNDS=10
+
+# ========== Storage ==========
+STORAGE_ROOT=storage
+STORAGE_UPLOAD_PATH=storage/uploads
+STORAGE_UPLOAD_MAX_SIZE_MB=50
+STORAGE_UPLOAD_ALLOWED_TYPES=image/jpeg,image/png,image/webp,application/pdf
+
+# ========== Logger ==========
+LOG_LEVEL=debug
+LOG_FILE=logs
+LOG_MAX_SIZE=20m
+LOG_MAX_FILES=14d
+
+# ========== Runtime ==========
+RUNTIME_MAX_LISTENERS=50
+RUNTIME_STACK_TRACE_LIMIT=50
+RUNTIME_UV_THREADPOOL_SIZE=4
+RUNTIME_BIGINT_JSON=true
+RUNTIME_DEPRECATION_WARNINGS=true
+
+# ========== Cache ==========
+CACHE_TTL=3600
+
+# ========== Redis (optional, standalone) ==========
+# Disabled by default. Each feature opts in via REDIS_USE_* (only when enabled).
+REDIS_ENABLED=false
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_USERNAME=
+REDIS_PASSWORD=
+REDIS_DB=0
+REDIS_KEY_PREFIX=
+REDIS_TLS=false
+REDIS_MAX_RETRIES=3
+REDIS_CONNECT_TIMEOUT=10000
+REDIS_USE_CACHE=false
+REDIS_USE_QUEUE=false
+REDIS_USE_SOCKET=false
+REDIS_USE_SESSION=false
+
+# ========== Cron ==========
+CRON_ENABLED=true
+CRON_TIMEZONE=Asia/Jakarta
+# Set CRON_HISTORY=false to disable execution-history recording in the database
+CRON_HISTORY=true
+
+# ========== Queue ==========
+QUEUE_ENABLED=true
+QUEUE_CONCURRENCY=5
+QUEUE_MAX_RETRIES=3
+QUEUE_RETRY_DELAY=1000
+# Set QUEUE_PERSIST=false to disable database persistence (jobs lost on restart)
+QUEUE_PERSIST=true
+
+# ========== Socket ==========
+SOCKET_ENABLED=true
+SOCKET_PATH=/socket.io/
+SOCKET_CORS_ORIGIN=*
+SOCKET_CORS_CREDENTIALS=false
+SOCKET_SERVE_CLIENT=false
+SOCKET_CONNECT_TIMEOUT=45000
+SOCKET_PING_INTERVAL=25000
+SOCKET_PING_TIMEOUT=20000
+SOCKET_TRANSPORTS=polling,websocket
+SOCKET_ALLOW_UPGRADES=true
+SOCKET_MAX_HTTP_BUFFER_SIZE=1000000
+
+# ========== Mail (Nodemailer) ==========
+MAIL_ENABLED=false
+MAIL_HOST=smtp.mailtrap.io
+MAIL_PORT=587
+MAIL_SECURE=false
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_FROM_ADDRESS=no-reply@example.com
+MAIL_FROM_NAME=

package/template/.gitattributes

@@ -0,0 +1,16 @@
+# Normalize line endings. The scaffolder bin is executed via its shebang on Unix,
+# so it must stay LF even when committed from Windows.
+* text=auto eol=lf
+
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+create-rebe/bin/create-rebe.js text eol=lf
+
+# Binary assets
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.webp binary
+*.gif binary
+*.ico binary

package/template/.nvmrc

@@ -0,0 +1 @@
+20

package/template/.prettierignore

@@ -0,0 +1,10 @@
+node_modules
+create-rebe/template
+.env
+.env.example
+.prettierrc
+ecosystem.config.js
+jsconfig.json
+nodemon.json
+package.json
+package-lock.json

package/template/.prettierrc

@@ -0,0 +1,12 @@
+{
+    "semi": false,
+    "singleQuote": true,
+    "trailingComma": "all",
+    "printWidth": 500,
+    "tabWidth": 4,
+    "useTabs": true,
+    "bracketSpacing": true,
+    "bracketSameLine": false,
+    "arrowParens": "always",
+    "endOfLine": "lf"
+}

package/template/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Refkinscallv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.