create-restack-pattern 0.1.7 → 0.2.0

package/template/{frontend → base/frontend}/domains/auth/components/login-form.tsx

@@ -1,17 +1,24 @@
 "use client"
 
-import { useState } from "react"
 import Link from "next/link"
+import { useState } from "react"
 import { Button } from "@/components/ui/button"
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card"
 import { Input } from "@/components/ui/input"
 import { Label } from "@/components/ui/label"
-import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card"
 import { useLogin } from "../hooks/use-login"
 
 /**
  * LoginForm UI Component (Auth Domain).
  * Handles rendering the login form and calling the `useLogin` hook.
- * 
+ *
  * Semi-DDD rules:
  * - UI components should stay isolated from direct backend API fetching logic.
  * - Local react state controls input values, and mutation runs through the domain hook.

package/template/{frontend → base/frontend}/domains/auth/components/logout-button.tsx

@@ -1,14 +1,14 @@
 "use client"
 
-import { useState } from "react"
 import { useRouter } from "next/navigation"
+import { useState } from "react"
 import { Button } from "@/components/ui/button"
 import { authApi } from "../services/auth.api"
 
 /**
  * LogoutButton Component (Auth Domain).
  * Simple action component to trigger sessions termination and redirect.
- * 
+ *
  * Semi-DDD rules:
  * - Simple action triggers can invoke services directly if no reactive local states/business orchestration is required.
  */

package/template/{frontend → base/frontend}/domains/auth/components/register-form.tsx

@@ -1,17 +1,24 @@
 "use client"
 
-import { useState } from "react"
 import Link from "next/link"
+import { useState } from "react"
 import { Button } from "@/components/ui/button"
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card"
 import { Input } from "@/components/ui/input"
 import { Label } from "@/components/ui/label"
-import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card"
 import { useRegister } from "../hooks/use-register"
 
 /**
  * RegisterForm UI Component (Auth Domain).
  * Handles rendering the register form and calling the `useRegister` hook.
- * 
+ *
  * Semi-DDD rules:
  * - UI components should stay isolated from direct backend API fetching logic.
  * - Local react state controls input values, and mutation runs through the domain hook.

package/template/{frontend → base/frontend}/domains/auth/hooks/use-login.ts

@@ -1,13 +1,13 @@
 "use client"
 
-import { LoginSchema, type LoginInput } from "@restack/shared"
+import { type LoginInput, LoginSchema } from "@restack/shared"
 import { useAuthMutation } from "@/hooks/use-auth-mutation"
 import { authApi } from "../services/auth.api"
 
 /**
  * Domain-specific hook for Login (Auth Domain).
  * Orchestrates login form mutation by wrapping the reusable useAuthMutation hook.
- * 
+ *
  * Semi-DDD rules:
  * - Domain hooks hide specific Zod validation schemas, API calls, and loading states from components.
  */

package/template/{frontend → base/frontend}/domains/auth/hooks/use-register.ts

@@ -1,17 +1,20 @@
 "use client"
 
-import { RegisterSchema, type RegisterInput } from "@restack/shared"
+import { type RegisterInput, RegisterSchema } from "@restack/shared"
 import { useAuthMutation } from "@/hooks/use-auth-mutation"
 import { authApi } from "../services/auth.api"
 
 /**
  * Domain-specific hook for Registration (Auth Domain).
  * Orchestrates registration form mutation by wrapping the reusable useAuthMutation hook.
- * 
+ *
  * Semi-DDD rules:
  * - Domain hooks hide specific Zod validation schemas, API calls, and loading states from components.
  */
 export function useRegister() {
-  const { submit, error, isPending } = useAuthMutation<RegisterInput>(RegisterSchema, authApi.register)
+  const { submit, error, isPending } = useAuthMutation<RegisterInput>(
+    RegisterSchema,
+    authApi.register,
+  )
   return { register: submit, error, isPending }
 }

package/template/{frontend → base/frontend}/domains/auth/services/auth.api.ts

@@ -1,21 +1,19 @@
-import type { AuthUser, LoginInput, RegisterInput } from "@restack/shared"
+import type { AuthResponse, LoginInput, RegisterInput } from "@restack/shared"
 import { client, unwrap } from "@/lib/api-client"
 
 /**
  * Service API layer for the Auth domain.
  * Thin wrappers that perform API calls to the Hono backend endpoints.
- * 
+ *
  * Semi-DDD rules:
  * - Domain services (`domains/[feature]/services/*.api.ts`) handle only raw HTTP calls.
  * - Request and response structures are mapped using schemas shared from `@restack/shared`.
  */
 export const authApi = {
   register: (data: RegisterInput) =>
-    unwrap<{ user: AuthUser }>(client.api.auth.register.$post({ json: data })),
+    unwrap<AuthResponse>(client.api.auth.register.$post({ json: data })),
 
-  login: (data: LoginInput) =>
-    unwrap<{ user: AuthUser }>(client.api.auth.login.$post({ json: data })),
+  login: (data: LoginInput) => unwrap<AuthResponse>(client.api.auth.login.$post({ json: data })),
 
-  logout: () =>
-    unwrap<{ success: boolean }>(client.api.auth.logout.$post()),
+  logout: () => unwrap<{ success: boolean }>(client.api.auth.logout.$post()),
 }

package/template/{frontend → base/frontend}/domains/user/components/profile-card.tsx

@@ -6,7 +6,7 @@ import { useProfile } from "../hooks/use-profile"
 /**
  * ProfileCard UI component.
  * Displays the loaded user profile information in a card layout.
- * 
+ *
  * Semi-DDD rules:
  * - Domain components (`domains/[feature]/components/*`) are responsible for UI layout and rendering.
  * - They should never perform direct HTTP calls or manage global state; instead, they consume data
@@ -25,9 +25,7 @@ export function ProfileCard() {
         <CardTitle>{profile.name}</CardTitle>
         <CardDescription>{profile.email}</CardDescription>
       </CardHeader>
-      <CardContent className="text-xs text-muted-foreground">
-        User ID: {profile.id}
-      </CardContent>
+      <CardContent className="text-xs text-muted-foreground">User ID: {profile.id}</CardContent>
     </Card>
   )
 }

package/template/{frontend → base/frontend}/domains/user/services/user.api.ts

@@ -4,15 +4,14 @@ import { client, unwrap } from "@/lib/api-client"
 /**
  * Service API layer for the User domain.
  * Thin wrappers that perform API calls to the Hono backend endpoints.
- * 
+ *
  * Semi-DDD rules:
  * - Domain services (`domains/[feature]/services/*.api.ts`) handle only raw HTTP calls.
  * - They must not contain UI state or react state; delegate that strictly to domain hooks.
  * - Request and response structures are mapped using schemas shared from `@restack/shared`.
  */
 export const userApi = {
-  me: () =>
-    unwrap<{ user: AuthUser }>(client.api.user.me.$get()),
+  me: () => unwrap<{ user: AuthUser }>(client.api.user.me.$get()),
 
   updateProfile: (data: UpdateProfileInput) =>
     unwrap<{ user: AuthUser }>(client.api.user.profile.$put({ json: data })),

package/template/base/frontend/env.ts

@@ -0,0 +1,12 @@
+import { createEnv } from "@t3-oss/env-nextjs"
+import { z } from "zod"
+
+export const env = createEnv({
+  server: {},
+  client: {
+    NEXT_PUBLIC_API_URL: z.string().url().default("http://localhost:3001"),
+  },
+  experimental__runtimeEnv: {
+    NEXT_PUBLIC_API_URL: process.env.NEXT_PUBLIC_API_URL,
+  },
+})

package/template/{frontend → base/frontend}/hooks/use-auth-mutation.ts

@@ -1,7 +1,7 @@
 "use client"
 
-import { useState } from "react"
 import { useRouter } from "next/navigation"
+import { useState } from "react"
 import type { ZodType } from "zod"
 
 /**
@@ -9,7 +9,10 @@ import type { ZodType } from "zod"
  * Standardizes Zod input validation, pending state tracking, error handling,
  * and automatic client-side redirection on successful mutation.
  */
-export function useAuthMutation<TInput>(schema: ZodType<TInput>, mutate: (data: TInput) => Promise<unknown>) {
+export function useAuthMutation<TInput>(
+  schema: ZodType<TInput>,
+  mutate: (data: TInput) => Promise<unknown>,
+) {
   const router = useRouter()
   const [error, setError] = useState<string | null>(null)
   const [isPending, setIsPending] = useState(false)
@@ -17,7 +20,7 @@ export function useAuthMutation<TInput>(schema: ZodType<TInput>, mutate: (data:
   const submit = async (data: TInput) => {
     const parsed = schema.safeParse(data)
     if (!parsed.success) {
-      setError(parsed.error.issues[0].message)
+      setError(parsed.error.issues[0]?.message ?? "Validation failed")
       return
     }
 

package/template/{frontend → base/frontend}/lib/api-client.ts

@@ -1,22 +1,40 @@
 import { hc } from "hono/client"
+import { env } from "@/env"
 import type { AppType } from "../../backend/src/hono-app"
 
-const BASE_URL = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:3001"
+const BASE_URL = env.NEXT_PUBLIC_API_URL
 
 export class ApiError extends Error {
-  constructor(message: string, public status: number) {
+  constructor(
+    message: string,
+    public status: number,
+  ) {
     super(message)
   }
 }
 
+// In-memory Bearer token storage (for mobile clients, native apps, or Bearer auth mode)
+let bearerToken: string | null = null
+
+export const setAuthToken = (token: string | null) => {
+  bearerToken = token
+}
+
+export const getAuthToken = () => bearerToken
+
 // Share a single refresh request promise to prevent TOCTOU race conditions
 let refreshPromise: Promise<Response> | null = null
 
 function refreshSession() {
   if (!refreshPromise) {
+    const headers: Record<string, string> = {}
+    if (bearerToken) {
+      headers.Authorization = `Bearer ${bearerToken}`
+    }
     refreshPromise = fetch(`${BASE_URL}/api/auth/refresh`, {
       method: "POST",
       credentials: "include",
+      headers,
     }).finally(() => {
       refreshPromise = null
     })
@@ -25,22 +43,39 @@ function refreshSession() {
 }
 
 const customFetch: typeof fetch = async (input, init) => {
-  const newInit = {
+  const headers = new Headers(init?.headers)
+
+  if (bearerToken && !headers.has("Authorization")) {
+    headers.set("Authorization", `Bearer ${bearerToken}`)
+  }
+
+  const newInit: RequestInit = {
     ...init,
     credentials: "include" as const,
+    headers,
   }
 
   const res = await fetch(input, newInit)
 
   // Silently rotate access token on 401, unless it's the auth endpoints themselves
-  const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url
+  const url =
+    typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url
   const isAuthRoute = url.includes("/api/auth/")
 
   if (res.status === 401 && !isAuthRoute) {
     const refreshRes = await refreshSession()
     if (refreshRes.ok) {
+      try {
+        const data = (await refreshRes.clone().json()) as { accessToken?: string }
+        if (data.accessToken && bearerToken) {
+          bearerToken = data.accessToken
+          headers.set("Authorization", `Bearer ${bearerToken}`)
+        }
+      } catch {
+        // ignore JSON parse error
+      }
       // Retry the original request
-      return fetch(input, newInit)
+      return fetch(input, { ...newInit, headers })
     }
   }
 

package/template/{frontend → base/frontend}/lib/utils.ts

@@ -1,4 +1,4 @@
-import { clsx, type ClassValue } from "clsx"
+import { type ClassValue, clsx } from "clsx"
 import { twMerge } from "tailwind-merge"
 
 /**

package/template/base/frontend/next.config.ts

@@ -0,0 +1,11 @@
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  // Tell Next.js to compile and bundle the @restack/shared package as if it were part of the frontend's own source code
+  transpilePackages: ["@restack/shared"],
+  // Enables static route typing for Next JS App Router navigation
+  // when use <Link> or router.push(), the editor will check or autocomplete valid routes and catch typos at compile time.
+  typedRoutes: true,
+};
+
+export default nextConfig;

package/template/{frontend → base/frontend}/package.json

@@ -10,27 +10,28 @@
   },
   "dependencies": {
     "@restack/shared": "workspace:*",
+    "@t3-oss/env-nextjs": "^0.13.11",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "hono": "^4.12.27",
-    "next": "16.2.9",
-    "radix-ui": "^1.6.1",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
-    "shadcn": "^4.12.0",
-    "sharp": "^0.35.3",
-    "tailwind-merge": "^3.6.0",
+    "hono": "^4.13.13",
+    "next": "16.4.2",
+    "radix-ui": "^1.8.1",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
+    "shadcn": "^4.21.5",
+    "sharp": "^0.35.5",
+    "tailwind-merge": "^3.7.0",
     "tw-animate-css": "^1.4.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4",
+    "@tailwindcss/postcss": "^4.3.3",
     "@types/node": "^20",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "eslint": "^9",
-    "eslint-config-next": "16.2.9",
-    "tailwindcss": "^4",
+    "eslint-config-next": "16.4.2",
+    "tailwindcss": "^4.3.3",
     "typescript": "^5"
   },
   "engines": {

package/template/{frontend → base/frontend}/tsconfig.json

@@ -5,6 +5,10 @@
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
     "noEmit": true,
     "esModuleInterop": true,
     "module": "esnext",

package/template/{gitignore → base/gitignore}

@@ -36,8 +36,22 @@ Thumbs.db
 test-project/
 test-app/
 
-# Exclude concerns and root CLAUDE.md from git
+# Exclude concerns from git
 docs/concerns.md
-CLAUDE.md
 
 docs/tutorial.md
+
+# Graphify knowledge graph outputs
+graphify-out/
+.graphify*
+
+node_modules/
+.e2e/results/
+.e2e/cache/
+.e2e/sessions/
+.e2e/report.json
+.e2e/ai-trace.json
+.e2e/junit.xml
+.e2e/summary.md
+.e2e/logs/
+.e2e/videos/

package/template/base/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "restack-pattern",
+  "private": true,
+  "license": "MIT",
+  "scripts": {
+    "dev": "pnpm --parallel dev",
+    "build": "pnpm --parallel build",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "test:e2e": "e2e run"
+  },
+  "workspaces": [
+    "frontend",
+    "backend",
+    "packages/*"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@e2e-dev/web": "^0.15.2",
+    "e2e": "^0.21.2"
+  }
+}

package/template/{packages → base/packages}/shared/package.json

@@ -16,7 +16,7 @@
     "dev": "tsc --watch"
   },
   "dependencies": {
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "typescript": "^5.8.3"

package/template/{packages → base/packages}/shared/src/index.ts

@@ -1,2 +1,3 @@
 export * from "./schemas/auth.schema.js"
 export * from "./schemas/user.schema.js"
+export * from "./utils/uuid.js"

package/template/{packages → base/packages}/shared/src/schemas/auth.schema.ts

@@ -1,4 +1,5 @@
 import { z } from "zod"
+import type { AuthUser } from "./user.schema.js"
 
 /** Zod validation schema for login form and request payload. */
 export const LoginSchema = z.object({
@@ -18,3 +19,10 @@ export type LoginInput = z.infer<typeof LoginSchema>
 
 /** TypeScript input type inferred from RegisterSchema. */
 export type RegisterInput = z.infer<typeof RegisterSchema>
+
+/** Auth response payload returned on register, login, and token rotation. */
+export interface AuthResponse {
+  user: AuthUser
+  accessToken: string
+  refreshToken: string
+}

package/template/{packages → base/packages}/shared/src/schemas/user.schema.ts

@@ -5,6 +5,7 @@ export interface AuthUser {
   id: number
   name: string
   email: string
+  role: string
 }
 
 /** Zod validation schema for updating user profile (partial updates). */

package/template/base/packages/shared/src/utils/uuid.ts

@@ -0,0 +1,40 @@
+/**
+ * Zero-dependency RFC 9562 compliant UUIDv7 generator.
+ *
+ * UUIDv7 combines a 48-bit UNIX timestamp (milliseconds) with 74 bits of
+ * cryptographically secure randomness. Unlike UUIDv4, UUIDv7 is strictly
+ * time-ordered, making it ideal for primary keys in B-Tree database indexes
+ * while avoiding URL enumeration vulnerabilities of auto-incrementing serial IDs.
+ *
+ * Compatible with Node.js, browsers, and Edge runtimes via globalThis.crypto.
+ */
+export function uuidv7(): string {
+  const bytes = new Uint8Array(16)
+  globalThis.crypto.getRandomValues(bytes)
+  const now = Date.now()
+
+  // 48-bit timestamp (milliseconds since epoch) in big-endian
+  bytes[0] = (now / 0x1_00_00_00_00_00) & 0xff
+  bytes[1] = (now / 0x1_00_00_00_00) & 0xff
+  bytes[2] = (now / 0x1_00_00_00) & 0xff
+  bytes[3] = (now / 0x1_00_00) & 0xff
+  bytes[4] = (now / 0x1_00) & 0xff
+  bytes[5] = now & 0xff
+
+  // Version 7: set 4 bits (0111) in byte 6
+  bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x70
+
+  // Variant 1 (RFC 9562): set 2 bits (10) in byte 8
+  bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80
+
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}
+
+/**
+ * Validates whether a given string is a valid UUIDv7 format.
+ */
+export function isUuidv7(uuid: string): boolean {
+  const uuidv7Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+  return uuidv7Regex.test(uuid)
+}

package/template/{packages → base/packages}/shared/tsconfig.json

@@ -28,6 +28,32 @@
      * @description Enables all strict type-checking options to prevent common runtime bugs.
      */
     "strict": true,
+    /**
+     * @noUncheckedIndexedAccess true
+     * @description Adds 'undefined' to any un-declared index access (e.g. arr[i] or record[key]),
+     * forcing explicit null/undefined checks and preventing runtime crashes.
+     */
+    "noUncheckedIndexedAccess": true,
+
+    /**
+     * @exactOptionalPropertyTypes true
+     * @description Differentiates between omitted optional properties and properties explicitly set to 'undefined',
+     * preventing unintended database column mutations and serialization bugs.
+     */
+    "exactOptionalPropertyTypes": true,
+
+    /**
+     * @noImplicitReturns true
+     * @description Ensures all execution branches in a function explicitly return a value,
+     * preventing accidental implicit 'undefined' returns.
+     */
+    "noImplicitReturns": true,
+
+    /**
+     * @noFallthroughCasesInSwitch true
+     * @description Reports an error for fallthrough cases in switch statements that are missing a 'break' or 'return'.
+     */
+    "noFallthroughCasesInSwitch": true,
 
     /**
      * @skipLibCheck true

package/template/base/pnpm-workspace.yaml

@@ -0,0 +1,12 @@
+packages:
+  - "frontend"
+  - "backend"
+  - "packages/*"
+allowBuilds:
+  better-sqlite3: true
+  esbuild: true
+  sharp: true
+  unrs-resolver: true
+minimumReleaseAgeExclude:
+  - '@e2e-dev/web@0.15.2'
+  - e2e@0.21.2

package/template/overlays/db-postgres/backend/.env.example

@@ -0,0 +1,6 @@
+DATABASE_URL=postgresql://postgres:postgres@localhost:5432/restack_pattern
+JWT_SECRET=your-secret-key-min-32-characters
+NODE_ENV=development
+PORT=3001
+FRONTEND_URL=http://localhost:3000
+COOKIE_SAME_SITE=Lax

package/template/overlays/db-postgres/backend/drizzle.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "drizzle-kit"
+import "dotenv/config"
+
+export default defineConfig({
+  schema: "./src/domains/*/*.model.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: process.env.DATABASE_URL!,
+  },
+})

package/template/overlays/db-postgres/backend/scripts/db-check.js

@@ -0,0 +1,27 @@
+import postgres from "postgres"
+import dotenv from "dotenv"
+import path from "path"
+import { fileURLToPath } from "url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+dotenv.config({ path: path.resolve(__dirname, "../.env") })
+
+const dbUrl = process.env.DATABASE_URL
+if (!dbUrl) {
+  console.error("\x1b[31m[ERROR] DATABASE_URL is not set in backend/.env\x1b[0m")
+  process.exit(1)
+}
+
+console.log("\x1b[36mChecking PostgreSQL connection...\x1b[0m")
+const sql = postgres(dbUrl, { max: 1, connect_timeout: 5 })
+
+try {
+  await sql`SELECT 1`
+  console.log("\x1b[32m✔ PostgreSQL connection successful!\x1b[0m")
+  await sql.end()
+  process.exit(0)
+} catch (err) {
+  console.error("\x1b[31m[ERROR] Database connection failed!\x1b[0m", err.message)
+  await sql.end()
+  process.exit(1)
+}

package/template/overlays/db-postgres/backend/src/infra/db/index.ts

@@ -0,0 +1,6 @@
+import { drizzle } from "drizzle-orm/postgres-js"
+import postgres from "postgres"
+import { env } from "../../config/env.js"
+
+const client = postgres(env.DATABASE_URL, { max: 1 })
+export const db = drizzle(client)

package/template/overlays/db-sqlite/backend/.env.example

@@ -0,0 +1,6 @@
+DATABASE_URL=sqlite.db
+JWT_SECRET=your-secret-key-min-32-characters
+NODE_ENV=development
+PORT=3001
+FRONTEND_URL=http://localhost:3000
+COOKIE_SAME_SITE=Lax

package/template/overlays/db-sqlite/backend/drizzle.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "drizzle-kit"
+import "dotenv/config"
+
+export default defineConfig({
+  schema: "./src/domains/*/*.model.ts",
+  out: "./drizzle",
+  dialect: "sqlite",
+  dbCredentials: {
+    url: process.env.DATABASE_URL || "sqlite.db",
+  },
+})