create-restack-pattern 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nicholas Chandra
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,72 @@
+# create-restack-pattern
+
+Scaffold a new Next.js + Hono + Drizzle ORM monorepo using the Restack Pattern
+(Semi-DDD / Feature-Driven) architecture — the same template built out in
+[the main repo](../../README.md), bundled as a copy-and-go generator.
+
+## Usage
+
+```bash
+npx create-restack-pattern my-app
+```
+
+Or without an argument, it'll prompt for a project name:
+
+```bash
+npx create-restack-pattern
+```
+
+This will:
+
+1. Copy the template into `./my-app`
+2. Set `my-app` as the generated project's root `package.json` name
+3. Run `pnpm install`
+4. Build `@restack/shared` (required once before `pnpm dev` works — see the
+   generated project's gotcha notes)
+5. Run `git init`
+
+## Prerequisites
+
+- Node.js 20+
+- [pnpm](https://pnpm.io) — the generated project is a pnpm workspace monorepo
+
+## After scaffolding
+
+```bash
+cd my-app
+cp backend/.env.example backend/.env   # fill in DATABASE_URL and JWT_SECRET
+pnpm --filter backend dev              # http://localhost:3001
+pnpm --filter frontend dev             # http://localhost:3000
+```
+
+## What you get
+
+- `frontend/` — Next.js 16 (App Router)
+- `backend/` — Hono + Drizzle ORM, with a working JWT + refresh-token auth
+  flow, rate limiting, and an example `user` domain already wired up
+- `packages/shared/` — Zod schemas shared between frontend and backend
+
+## Current scope (MVP)
+
+This is the first, deliberately minimal version of the CLI. It does not yet
+ask about package manager, database, or auth-provider choices — it always
+scaffolds the exact pnpm + Postgres + Drizzle stack from the template as-is.
+Those choices are tracked as follow-up work in the main repo's
+`docs/concerns.md`.
+
+## For maintainers: keeping the template in sync
+
+The `template/` directory in this package is a **copy** of `frontend/`,
+`backend/`, and `packages/shared/` from the repo root, not a live reference —
+and it's gitignored, same as `dist/`. It's regenerated automatically before
+publish (`prepublishOnly` runs `sync-template` then `build`), so it never
+needs to be committed. For local testing, run it manually first:
+
+```bash
+pnpm --filter create-restack-pattern sync-template
+```
+
+This overwrites `template/` from the current state of the root template
+(excluding `node_modules`, build output, `.env*` except `.env.example`, and
+this repo's own internal planning docs like `docs/` and root `CLAUDE.md`,
+which aren't relevant to a generated project).

package/dist/index.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import { cpSync, existsSync, readFileSync, writeFileSync, readdirSync, renameSync } from "node:fs";
+import { execSync } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const templateDir = path.resolve(__dirname, "..", "template");
+async function promptProjectName() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question("Project name: ");
+    rl.close();
+    return answer.trim();
+}
+function isValidProjectName(name) {
+    return /^[a-z0-9-_]+$/i.test(name);
+}
+// Undoes sync-template.mjs's .gitignore -> gitignore rename (npm strips
+// files literally named .gitignore from the published tarball).
+function renameGitignoreFilesBack(dir) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            renameGitignoreFilesBack(full);
+        else if (entry.name === "gitignore")
+            renameSync(full, path.join(dir, ".gitignore"));
+    }
+}
+async function main() {
+    const argName = process.argv[2];
+    const projectName = argName ?? (await promptProjectName());
+    if (!projectName || !isValidProjectName(projectName)) {
+        console.error("Invalid project name. Use letters, numbers, hyphens, or underscores only.");
+        process.exit(1);
+    }
+    const targetDir = path.resolve(process.cwd(), projectName);
+    if (existsSync(targetDir)) {
+        console.error(`Directory "${projectName}" already exists.`);
+        process.exit(1);
+    }
+    console.log(`Scaffolding into ${targetDir} ...`);
+    cpSync(templateDir, targetDir, { recursive: true });
+    renameGitignoreFilesBack(targetDir);
+    const rootPkgPath = path.join(targetDir, "package.json");
+    const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf-8"));
+    rootPkg.name = projectName;
+    writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
+    console.log("Installing dependencies (pnpm install) ...");
+    execSync("pnpm install", { cwd: targetDir, stdio: "inherit" });
+    // packages/shared ships no dist/ (gitignored) — backend/frontend resolve
+    // @restack/shared to compiled output, so it must be built once up front
+    // or the very first `pnpm dev` fails to resolve the import.
+    console.log("Building @restack/shared ...");
+    execSync("pnpm --filter @restack/shared build", { cwd: targetDir, stdio: "inherit" });
+    try {
+        execSync("git init", { cwd: targetDir, stdio: "ignore" });
+    }
+    catch {
+        // git not available — non-fatal, scaffolding still succeeded
+    }
+    console.log(`
+Done! Next steps:
+
+  cd ${projectName}
+  cp backend/.env.example backend/.env   # fill in DATABASE_URL and JWT_SECRET
+  pnpm --filter backend dev
+  pnpm --filter frontend dev
+`);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "create-restack-pattern",
+  "version": "0.1.0",
+  "description": "Scaffold a new Next.js + Hono + Drizzle monorepo using the Restack Pattern (Semi-DDD) template.",
+  "license": "MIT",
+  "type": "module",
+  "private": false,
+  "bin": {
+    "create-restack-pattern": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "template"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "sync-template": "node scripts/sync-template.mjs",
+    "prepublishOnly": "pnpm sync-template && pnpm build"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.17",
+    "tsx": "^4.7.1",
+    "typescript": "^5.8.3"
+  }
+}

package/template/backend/.env.example

@@ -0,0 +1,8 @@
+DATABASE_URL=postgresql://user:password@localhost:5432/restack_pattern
+JWT_SECRET=your-secret-key-min-32-chars
+NODE_ENV=development
+PORT=3001
+FRONTEND_URL=http://localhost:3000,https://myapp.vercel.app
+# COOKIE_SAME_SITE=Lax   # override default (None in production, Lax in development)
+# COOKIE_DOMAIN=.example.com   # only set if FE/BE share a domain, e.g. app.example.com + api.example.com
+#                               # see docs/deployment-verification.md before deploying cross-domain

package/template/backend/README.md

@@ -0,0 +1,8 @@
+```
+npm install
+npm run dev
+```
+
+```
+open http://localhost:3000
+```

package/template/backend/api/index.ts

@@ -0,0 +1,9 @@
+import { app } from "../src/hono-app.js"
+
+/**
+ * Vercel serverless entry point. Hono's `app` already implements the Web
+ * Fetch API shape Vercel Functions expect ({ fetch(request): Response }),
+ * so no adapter package is needed — see backend/vercel.json for the
+ * catch-all rewrite that routes every path here.
+ */
+export default app

package/template/backend/drizzle/0000_grey_lethal_legion.sql

@@ -0,0 +1,19 @@
+CREATE TABLE "auth_sessions" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"user_id" integer NOT NULL,
+	"refresh_token_hash" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "auth_sessions_refresh_token_hash_unique" UNIQUE("refresh_token_hash")
+);
+--> statement-breakpoint
+CREATE TABLE "users" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"password" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "users_email_unique" UNIQUE("email")
+);
+--> statement-breakpoint
+ALTER TABLE "auth_sessions" ADD CONSTRAINT "auth_sessions_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;

package/template/backend/drizzle/meta/0000_snapshot.json

@@ -0,0 +1,137 @@
+{
+  "id": "0f794287-130a-477c-a13b-37f45569e468",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.auth_sessions": {
+      "name": "auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "refresh_token_hash": {
+          "name": "refresh_token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "auth_sessions_user_id_users_id_fk": {
+          "name": "auth_sessions_user_id_users_id_fk",
+          "tableFrom": "auth_sessions",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "auth_sessions_refresh_token_hash_unique": {
+          "name": "auth_sessions_refresh_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "refresh_token_hash"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/template/backend/drizzle/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1783107540765,
+      "tag": "0000_grey_lethal_legion",
+      "breakpoints": true
+    }
+  ]
+}

package/template/backend/drizzle.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "drizzle-kit"
+import "dotenv/config"
+
+export default defineConfig({
+  schema: "./src/domains/*/*.model.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: process.env.DATABASE_URL!,
+  },
+})

package/template/backend/gitignore

@@ -0,0 +1,31 @@
+# dev
+.yarn/
+!.yarn/releases
+.vscode/*
+!.vscode/launch.json
+!.vscode/*.code-snippets
+.idea/workspace.xml
+.idea/usage.statistics.xml
+.idea/shelf
+
+# deps
+node_modules/
+
+# env
+.env
+.env.production
+
+# logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# misc
+.DS_Store
+
+.vercel
+.env*

package/template/backend/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "backend",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "db:generate": "drizzle-kit generate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.0.6",
+    "@hono/zod-validator": "^0.8.0",
+    "@restack/shared": "workspace:*",
+    "bcryptjs": "^3.0.3",
+    "dotenv": "^17.4.2",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.27",
+    "jose": "^6.2.3",
+    "pino": "^10.3.1",
+    "postgres": "^3.4.9",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.17",
+    "drizzle-kit": "^0.31.10",
+    "pino-pretty": "^13.1.3",
+    "tsx": "^4.7.1",
+    "typescript": "^5.8.3",
+    "vitest": "^3.0.0"
+  }
+}

package/template/backend/src/config/env.ts

@@ -0,0 +1,22 @@
+import "dotenv/config"
+import { z } from "zod";
+
+const envSchema = z.object({
+  // Memastikan DATABASE_URL ada dan berformat URL valid
+  DATABASE_URL: z.string().url("DATABASE_URL harus berupa URL yang valid"),
+  // Minimal 32 karakter supaya HS256 secret tidak mudah di-brute-force
+  JWT_SECRET: z.string().min(32, "JWT_SECRET wajib diisi, minimal 32 karakter"),
+  // Validasi enum dengan nilai default "development"
+  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+  // Mengubah string dari process.env menjadi Number secara otomatis
+  PORT: z.coerce.number().default(3001),
+  // Validasi cookie samesite dengan nilai default "Lax"
+  COOKIE_SAME_SITE: z.enum(["Lax", "None", "Strict", ""]).default(""),
+  // Set only when FE and BE share a registrable domain via subdomains
+  // (e.g. ".example.com" for app.example.com + api.example.com) — lets
+  // the frontend's own middleware read the session cookies too.
+  COOKIE_DOMAIN: z.string().optional(),
+  FRONTEND_URL: z.string().default("http://localhost:3000"),
+})
+
+export const env = envSchema.parse(process.env)

package/template/backend/src/domains/auth/auth.model.ts

@@ -0,0 +1,20 @@
+import { pgTable, serial, integer, text, timestamp } from "drizzle-orm/pg-core"
+import { usersTable } from "../user/user.model.js"
+
+/**
+ * Auth Sessions Table Schema.
+ * Tracks active, refreshable user login sessions.
+ * 
+ * Security rules:
+ * - We only store the SHA-256 hash of the refresh token (`refreshTokenHash`),
+ *   protecting the user session from being compromised if the database leaks.
+ * - Cascade delete is used so removing a user automatically purges all their active sessions.
+ */
+export const authSessionsTable = pgTable("auth_sessions", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  // sha256 of the opaque refresh token — never store the raw token.
+  refreshTokenHash: text("refresh_token_hash").notNull().unique(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/backend/src/domains/auth/auth.repo.ts

@@ -0,0 +1,51 @@
+import { and, eq, gt } from "drizzle-orm"
+import { db } from "../../shared/db/index.js"
+import { usersTable } from "../user/user.model.js"
+import { authSessionsTable } from "./auth.model.js"
+
+type UserRow = typeof usersTable.$inferSelect
+type SessionRow = typeof authSessionsTable.$inferSelect
+
+/**
+ * Repository layer for the Auth domain.
+ * Encapsulates sessions management and credential-based queries.
+ * 
+ * Semi-DDD rules:
+ * - Direct database interactions (Drizzle client) must live only inside `.repo.ts` files.
+ * - Under cross-domain rules, the Auth domain can query the User domain's tables (e.g. `usersTable`)
+ *   directly for login resolution, ensuring that dependencies flow one way (auth -> user).
+ */
+export const authRepo = {
+  // Explicit return type matters: without noUncheckedIndexedAccess, TS infers array
+  // destructuring as always-defined, so `user ?? null` silently loses the null branch
+  // and callers' `if (!user)` checks type-check as always-false without this annotation.
+  findByEmail: async (email: string): Promise<UserRow | null> => {
+    const [user] = await db.select().from(usersTable).where(eq(usersTable.email, email))
+    return user ?? null
+  },
+
+  create: async (data: { name: string; email: string; password: string }) => {
+    const [user] = await db.insert(usersTable).values(data).returning()
+    return user
+  },
+
+  createSession: async (data: { userId: number; refreshTokenHash: string; expiresAt: Date }) => {
+    const [session] = await db.insert(authSessionsTable).values(data).returning()
+    return session
+  },
+
+  // Atomic find-and-delete: a single DELETE...RETURNING so concurrent refresh
+  // calls presenting the same token can't both pass a separate SELECT check
+  // before either DELETE lands (TOCTOU) — only one caller ever gets a row back.
+  consumeSessionByHash: async (refreshTokenHash: string): Promise<SessionRow | null> => {
+    const [session] = await db
+      .delete(authSessionsTable)
+      .where(and(eq(authSessionsTable.refreshTokenHash, refreshTokenHash), gt(authSessionsTable.expiresAt, new Date())))
+      .returning()
+    return session ?? null
+  },
+
+  deleteSessionByHash: async (refreshTokenHash: string) => {
+    await db.delete(authSessionsTable).where(eq(authSessionsTable.refreshTokenHash, refreshTokenHash))
+  },
+}

package/template/backend/src/domains/auth/auth.routes.ts

@@ -0,0 +1,93 @@
+import { Hono } from "hono"
+import type { Context } from "hono"
+import { setCookie, deleteCookie, getCookie } from "hono/cookie"
+import { zValidator } from "@hono/zod-validator"
+import { LoginSchema, RegisterSchema } from "@restack/shared"
+import { authService, ACCESS_TOKEN_TTL_SECONDS, REFRESH_TOKEN_TTL_SECONDS } from "./auth.service.js"
+import { env } from "../../config/env.js"
+import { logger } from "../../shared/logger/logger.js"
+import { rateLimit } from "../../shared/middlewares/rate-limit.js"
+
+/**
+ * Routing layer for the Auth domain.
+ * Defines the public endpoints for login, registration, logout, and token rotation.
+ * 
+ * Semi-DDD rules:
+ * - `.routes.ts` files define HTTP endpoints, validate request payloads, and apply CORS/CSRF configurations.
+ * - Endpoints should delegate business flow execution directly to the service layer.
+ */
+const isProduction = env.NODE_ENV === "production"
+const sameSite = (env.COOKIE_SAME_SITE || (isProduction ? "None" : "Lax")) as "Lax" | "None" | "Strict"
+const secure = sameSite === "None" ? true : isProduction
+
+const domainOpt = env.COOKIE_DOMAIN ? { domain: env.COOKIE_DOMAIN } : {}
+const deleteCookieOpts = (path: string) => ({ path, secure, sameSite, ...domainOpt })
+const cookieOpts = (path: string, maxAge: number) => ({ ...deleteCookieOpts(path), httpOnly: true, maxAge })
+
+const accessTokenCookieOptions = cookieOpts("/", ACCESS_TOKEN_TTL_SECONDS)
+const refreshTokenCookieOptions = cookieOpts("/", REFRESH_TOKEN_TTL_SECONDS)
+
+const setAuthCookies = (c: Context, tokens: { accessToken: string; refreshToken: string }) => {
+  setCookie(c, "access_token", tokens.accessToken, accessTokenCookieOptions)
+  setCookie(c, "refresh_token", tokens.refreshToken, refreshTokenCookieOptions)
+}
+
+const clearAuthCookies = (c: Context) => {
+  deleteCookie(c, "access_token", deleteCookieOpts("/"))
+  deleteCookie(c, "refresh_token", deleteCookieOpts("/"))
+}
+
+export const authRoutes = new Hono()
+
+authRoutes.post("/register", rateLimit, zValidator("json", RegisterSchema), async (c) => {
+  try {
+    const body = c.req.valid("json")
+    const user = await authService.register(body)
+    const tokens = await authService.issueTokenPair(user)
+
+    setAuthCookies(c, tokens)
+
+    return c.json({ user }, 201)
+  } catch (e: any) {
+    logger.error({ err: e.message }, "Register failed")
+    return c.json({ error: e.message }, 400)
+  }
+})
+
+authRoutes.post("/login", rateLimit, zValidator("json", LoginSchema), async (c) => {
+  try {
+    const body = c.req.valid("json")
+    const user = await authService.login(body)
+    const tokens = await authService.issueTokenPair(user)
+
+    setAuthCookies(c, tokens)
+
+    return c.json({ user })
+  } catch (e: any) {
+    logger.error({ err: e.message }, "Login failed")
+    return c.json({ error: e.message }, 401)
+  }
+})
+
+authRoutes.post("/refresh", rateLimit, async (c) => {
+  const refreshToken = getCookie(c, "refresh_token")
+  if (!refreshToken) return c.json({ error: "Missing refresh token" }, 401)
+
+  try {
+    const tokens = await authService.refresh(refreshToken)
+    setAuthCookies(c, tokens)
+    return c.json({ user: tokens.user })
+  } catch (e: any) {
+    clearAuthCookies(c)
+    logger.error({ err: e.message }, "Refresh failed")
+    return c.json({ error: "Invalid refresh token" }, 401)
+  }
+})
+
+authRoutes.post("/logout", async (c) => {
+  const refreshToken = getCookie(c, "refresh_token")
+  if (refreshToken) await authService.revokeSession(refreshToken)
+
+  clearAuthCookies(c)
+  return c.json({ success: true })
+})