create-restack-pattern 0.1.7 → 0.2.0

package/template/overlays/db-sqlite/backend/scripts/db-check.js

@@ -0,0 +1,20 @@
+import Database from "better-sqlite3"
+import dotenv from "dotenv"
+import path from "path"
+import { fileURLToPath } from "url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+dotenv.config({ path: path.resolve(__dirname, "../.env") })
+
+const dbUrl = process.env.DATABASE_URL || "sqlite.db"
+console.log("\x1b[36mChecking SQLite database...\x1b[0m")
+try {
+  const db = new Database(dbUrl)
+  db.exec("SELECT 1")
+  db.close()
+  console.log("\x1b[32m✔ SQLite database ready!\x1b[0m")
+  process.exit(0)
+} catch (err) {
+  console.error("\x1b[31m[ERROR] SQLite database check failed:\x1b[0m", err.message)
+  process.exit(1)
+}

package/template/overlays/db-sqlite/backend/src/infra/db/index.ts

@@ -0,0 +1,8 @@
+import Database from "better-sqlite3"
+import { drizzle } from "drizzle-orm/better-sqlite3"
+import { env } from "../../config/env.js"
+
+const sqlite = new Database(env.DATABASE_URL || "sqlite.db")
+sqlite.pragma("journal_mode = WAL")
+sqlite.pragma("foreign_keys = ON")
+export const db = drizzle(sqlite)

package/template/overlays/id-serial/packages/shared/src/schemas/user.schema.ts

@@ -0,0 +1,14 @@
+import { z } from "zod"
+
+export interface AuthUser {
+  id: number
+  name: string
+  email: string
+  role: string
+}
+
+export const UpdateProfileSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+})
+
+export type UpdateProfileInput = z.infer<typeof UpdateProfileSchema>

package/template/overlays/id-uuid/packages/shared/src/schemas/user.schema.ts

@@ -0,0 +1,14 @@
+import { z } from "zod"
+
+export interface AuthUser {
+  id: string
+  name: string
+  email: string
+  role: string
+}
+
+export const UpdateProfileSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+})
+
+export type UpdateProfileInput = z.infer<typeof UpdateProfileSchema>

package/template/overlays/models/postgres-serial/backend/src/domains/auth/auth.model.ts

@@ -0,0 +1,12 @@
+import { integer, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core"
+import { usersTable } from "../user/user.model.js"
+
+export const authSessionsTable = pgTable("auth_sessions", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => usersTable.id, { onDelete: "cascade" }),
+  refreshTokenHash: text("refresh_token_hash").notNull().unique(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/overlays/models/postgres-serial/backend/src/domains/user/user.model.ts

@@ -0,0 +1,10 @@
+import { pgTable, serial, text, timestamp } from "drizzle-orm/pg-core"
+
+export const usersTable = pgTable("users", {
+  id: serial("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  role: text("role").default("user").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/overlays/models/postgres-uuid/backend/src/domains/auth/auth.model.ts

@@ -0,0 +1,15 @@
+import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core"
+import { uuidv7 } from "@restack/shared"
+import { usersTable } from "../user/user.model.js"
+
+export const authSessionsTable = pgTable("auth_sessions", {
+  id: uuid("id")
+    .primaryKey()
+    .$defaultFn(() => uuidv7()),
+  userId: uuid("user_id")
+    .notNull()
+    .references(() => usersTable.id, { onDelete: "cascade" }),
+  refreshTokenHash: text("refresh_token_hash").notNull().unique(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/overlays/models/postgres-uuid/backend/src/domains/user/user.model.ts

@@ -0,0 +1,13 @@
+import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core"
+import { uuidv7 } from "@restack/shared"
+
+export const usersTable = pgTable("users", {
+  id: uuid("id")
+    .primaryKey()
+    .$defaultFn(() => uuidv7()),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  role: text("role").default("user").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/overlays/models/sqlite-serial/backend/src/domains/auth/auth.model.ts

@@ -0,0 +1,14 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core"
+import { usersTable } from "../user/user.model.js"
+
+export const authSessionsTable = sqliteTable("auth_sessions", {
+  id: integer("id", { mode: "number" }).primaryKey({ autoIncrement: true }),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => usersTable.id, { onDelete: "cascade" }),
+  refreshTokenHash: text("refresh_token_hash").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" })
+    .notNull()
+    .$defaultFn(() => new Date()),
+})

package/template/overlays/models/sqlite-serial/backend/src/domains/user/user.model.ts

@@ -0,0 +1,12 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core"
+
+export const usersTable = sqliteTable("users", {
+  id: integer("id", { mode: "number" }).primaryKey({ autoIncrement: true }),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  role: text("role").default("user").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" })
+    .notNull()
+    .$defaultFn(() => new Date()),
+})

package/template/overlays/models/sqlite-uuid/backend/src/domains/auth/auth.model.ts

@@ -0,0 +1,17 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core"
+import { uuidv7 } from "@restack/shared"
+import { usersTable } from "../user/user.model.js"
+
+export const authSessionsTable = sqliteTable("auth_sessions", {
+  id: text("id")
+    .primaryKey()
+    .$defaultFn(() => uuidv7()),
+  userId: text("user_id")
+    .notNull()
+    .references(() => usersTable.id, { onDelete: "cascade" }),
+  refreshTokenHash: text("refresh_token_hash").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" })
+    .notNull()
+    .$defaultFn(() => new Date()),
+})

package/template/overlays/models/sqlite-uuid/backend/src/domains/user/user.model.ts

@@ -0,0 +1,15 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core"
+import { uuidv7 } from "@restack/shared"
+
+export const usersTable = sqliteTable("users", {
+  id: text("id")
+    .primaryKey()
+    .$defaultFn(() => uuidv7()),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  role: text("role").default("user").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" })
+    .notNull()
+    .$defaultFn(() => new Date()),
+})

package/template/CLAUDE.md

@@ -1,62 +0,0 @@
-# CLAUDE.md
-
-This file provides architecture, build, and styling guidance to Claude Code (claude.ai/code) and other AI assistants working in this repository.
-
-## Project Stack
-- **Frontend**: Next.js 16 (App Router)
-- **Backend**: Hono
-- **ORM**: Drizzle ORM
-- **Database**: PostgreSQL (Postgres-js driver)
-- **Validation**: Zod (shared schemas)
-- **Package Manager**: pnpm workspaces
-
-## Monorepo Layout
-- `frontend/` — Next.js 16 App Router
-- `backend/` — Hono API
-- `packages/shared/` — Shared Zod schemas (the single source of truth)
-
-## Build and Dev Commands
-All commands should be run from the repository root:
-- `pnpm install` — Install all dependencies
-- `pnpm --filter @restack/shared build` — Build shared Zod schemas (run first!)
-- `pnpm --filter backend dev` — Start Hono dev server on port 3001
-- `pnpm --filter frontend dev` — Start Next.js dev server on port 3000
-- `pnpm --filter backend db:push` — Push Drizzle schema to PostgreSQL database
-- `pnpm --filter backend db:studio` — Open Drizzle Studio database viewer
-- `pnpm --filter backend test` — Run Vitest tests
-
-## Architecture Rules: Semi-DDD (Feature-Driven)
-Code is organized by business domain/feature, not by file type.
-
-### Backend Layout (`backend/src/domains/[feature]/`)
-Each domain has 4 primary files:
-- `[feature].routes.ts` — HTTP endpoints & input validation (imports Zod schema from `@restack/shared`)
-- `[feature].service.ts` — Pure business logic only (no direct DB access)
-- `[feature].repo.ts` — Drizzle queries only (no business logic)
-- `[feature].model.ts` — Drizzle table definitions
-
-**Cross-Domain Dependency Rule**: The `auth` domain may import from `user` (e.g. `usersTable` from `user.model.ts`). The reverse (user importing from auth) is STRICTLY FORBIDDEN.
-
-### Frontend Layout (`frontend/domains/[feature]/`)
-- `components/` — UI components (no direct data fetching)
-- `hooks/` — Reactive state & data fetching logic
-- `services/` — Thin HTTP wrappers around `apiClient`
-- `types.ts` — Local TS type declarations
-- `frontend/app/` is strictly for layout, routing config, metadata, or entry gates. Do not implement custom JSX layouts, forms, state, or complex components here. Always delegate rendering to domain feature components.
-
-## Critical Gotcha: Shared Package Build Requirement
-`@restack/shared`'s `package.json` resolves to `dist/`, which is gitignored. When editing Zod schemas in `packages/shared/src/schemas/`, you MUST compile them by running:
-`pnpm --filter @restack/shared build`
-(or keep `pnpm --filter @restack/shared dev` watch mode running in a terminal) or the frontend and backend will fail to resolve the updated types or throw compilation errors.
-
-## Auth & Cookie Strategy
-- Short-lived JWT `access_token` (15m) and opaque `refresh_token` (30d) are both set as `httpOnly` cookies at `Path=/`.
-- Access tokens are automatically refreshed by the client-side `apiClient` on a 401 response.
-- Cookie configuration: `SameSite=None` in production (requires `Secure=true`), and `SameSite=Lax` in development (`Secure=false` since local dev runs on HTTP).
-- There is no server-side auth gate (`middleware.ts`/`proxy.ts`) because cookies cannot be read server-side when frontend and backend deploy to unrelated domains (Topology B). Authenticated routes are protected via backend `requireAuth` middleware, and frontend pages are protected via `<RequireAuth>` or client-side checks in hooks.
-
-## Structured & Correlation Logging
-- Every incoming HTTP request is tagged with a unique `requestId` via Hono's `requestId` middleware.
-- A request-scoped child logger (`logger.child({ requestId })`) is bound to Hono's context.
-- In route handlers, always extract the request-specific child logger from Hono's context (`c.get("logger") || logger`) to log events. This ensures all logs generated during a request carry the correct `requestId` and `userId` context (which is automatically enriched by the `requireAuth` middleware).
-

package/template/backend/src/domains/user/user.routes.test.ts

@@ -1,82 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll } from "vitest"
-import { eq } from "drizzle-orm"
-import { userRoutes } from "./user.routes.js"
-import { authService } from "../auth/auth.service.js"
-import { db } from "../../infra/db/index.js"
-import { usersTable } from "./user.model.js"
-
-const TEST_EMAIL = `user-routes-test-${Date.now()}@example.com`
-let accessToken: string
-let userId: number
-
-beforeAll(async () => {
-  const user = await authService.register({ name: "Route Test", email: TEST_EMAIL, password: "password123" })
-  userId = user.id
-  const tokens = await authService.issueTokenPair(user)
-  accessToken = tokens.accessToken
-})
-
-afterAll(async () => {
-  await db.delete(usersTable).where(eq(usersTable.id, userId))
-})
-
-const authHeaders = (token?: string) => ({
-  "Content-Type": "application/json",
-  ...(token ? { Cookie: `access_token=${token}` } : {}),
-})
-
-describe("GET /me", () => {
-  it("returns 401 without a token", async () => {
-    const res = await userRoutes.request("/me")
-    expect(res.status).toBe(401)
-  })
-
-  it("returns the profile with a valid token", async () => {
-    const res = await userRoutes.request("/me", { headers: authHeaders(accessToken) })
-    expect(res.status).toBe(200)
-    const body = await res.json()
-    expect(body.user.email).toBe(TEST_EMAIL)
-  })
-})
-
-describe("PUT /profile", () => {
-  it("returns 401 without a token", async () => {
-    const res = await userRoutes.request("/profile", {
-      method: "PUT",
-      headers: authHeaders(),
-      body: JSON.stringify({ name: "x" }),
-    })
-    expect(res.status).toBe(401)
-  })
-
-  it("updates the name with a valid token and body", async () => {
-    const res = await userRoutes.request("/profile", {
-      method: "PUT",
-      headers: authHeaders(accessToken),
-      body: JSON.stringify({ name: "Updated Name" }),
-    })
-    expect(res.status).toBe(200)
-    const body = await res.json()
-    expect(body.user.name).toBe("Updated Name")
-  })
-
-  it("rejects an invalid body (empty name)", async () => {
-    const res = await userRoutes.request("/profile", {
-      method: "PUT",
-      headers: authHeaders(accessToken),
-      body: JSON.stringify({ name: "" }),
-    })
-    expect(res.status).toBe(400)
-  })
-
-  it("treats an empty body as a no-op instead of erroring", async () => {
-    const res = await userRoutes.request("/profile", {
-      method: "PUT",
-      headers: authHeaders(accessToken),
-      body: JSON.stringify({}),
-    })
-    expect(res.status).toBe(200)
-    const body = await res.json()
-    expect(body.user.email).toBe(TEST_EMAIL)
-  })
-})

package/template/backend/src/infra/middlewares/require-auth.test.ts

@@ -1,51 +0,0 @@
-import { describe, it, expect } from "vitest"
-import { Hono } from "hono"
-import { SignJWT } from "jose"
-import { requireAuth } from "./require-auth.js"
-import type { AuthVariables } from "./require-auth.js"
-import { env } from "../../config/env.js"
-
-const secret = new TextEncoder().encode(env.JWT_SECRET)
-
-const signTestToken = (payload: Record<string, unknown>, expiresIn = "15m") =>
-  new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setExpirationTime(expiresIn).sign(secret)
-
-function buildApp() {
-  const app = new Hono<{ Variables: AuthVariables }>()
-  app.use("/protected", requireAuth)
-  app.get("/protected", (c) => c.json({ user: c.get("user") }))
-  return app
-}
-
-describe("requireAuth", () => {
-  it("returns 401 when no access_token cookie is present", async () => {
-    const res = await buildApp().request("/protected")
-    expect(res.status).toBe(401)
-  })
-
-  it("returns 401 when the token is garbage", async () => {
-    const res = await buildApp().request("/protected", {
-      headers: { Cookie: "access_token=not-a-real-token" },
-    })
-    expect(res.status).toBe(401)
-  })
-
-  it("returns 401 when the token is expired", async () => {
-    const expired = await signTestToken({ sub: "user-1", email: "a@b.com" }, "-1s")
-    const res = await buildApp().request("/protected", {
-      headers: { Cookie: `access_token=${expired}` },
-    })
-    expect(res.status).toBe(401)
-  })
-
-  it("calls next() and exposes the payload when the token is valid", async () => {
-    const token = await signTestToken({ sub: "user-1", email: "a@b.com" })
-    const res = await buildApp().request("/protected", {
-      headers: { Cookie: `access_token=${token}` },
-    })
-    expect(res.status).toBe(200)
-    const body = await res.json()
-    expect(body.user.sub).toBe("user-1")
-    expect(body.user.email).toBe("a@b.com")
-  })
-})

package/template/backend/src/infra/middlewares/require-auth.ts

@@ -1,36 +0,0 @@
-import type { MiddlewareHandler } from "hono"
-import { getCookie } from "hono/cookie"
-import { authService } from "../../domains/auth/auth.service.js"
-import type { AppVariables } from "../../utils/logger.js"
-
-/**
- * Authentication guard middleware.
- * Enforces the presence and validity of the short-lived JWT access token in request cookies.
- * Resolves the payload, binds it to Hono context variables (`c.get("user")`),
- * and attaches the authenticated userId to the request logger context.
- * 
- * Usage:
- * Apply to any endpoint requiring authentication (e.g. `userRoutes.get("/me", requireAuth, ...)`).
- */
-export const requireAuth: MiddlewareHandler<{ Variables: AppVariables }> = async (c, next) => {
-  // Extract token from cookie (JWT)
-  const token = getCookie(c, "access_token")
-  if (!token) return c.json({ error: "Unauthorized" }, 401)
-
-  try {
-    // Decode and verify signature & expiration
-    const payload = await authService.verifyAccessToken(token)
-    c.set("user", payload)
-
-    // Enrich the child logger with the user's ID for all downstream actions
-    const reqLogger = c.get("logger")
-    if (reqLogger) {
-      c.set("logger", reqLogger.child({ userId: Number(payload.sub) }))
-    }
-  } catch {
-    // Return standard 401 response on invalid / expired signature
-    return c.json({ error: "Unauthorized" }, 401)
-  }
-
-  await next()
-}

package/template/frontend/AGENTS.md

@@ -1,5 +0,0 @@
-<!-- BEGIN:nextjs-agent-rules -->
-# This is NOT the Next.js you know
-
-This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices.
-<!-- END:nextjs-agent-rules -->

package/template/frontend/next.config.ts

@@ -1,7 +0,0 @@
-import type { NextConfig } from "next";
-
-const nextConfig: NextConfig = {
-  transpilePackages: ["@restack/shared"],
-};
-
-export default nextConfig;

package/template/package.json

@@ -1,17 +0,0 @@
-{
-  "name": "restack-pattern",
-  "private": true,
-  "license": "MIT",
-  "scripts": {
-    "dev": "pnpm --parallel dev",
-    "build": "pnpm --parallel build"
-  },
-  "workspaces": [
-    "frontend",
-    "backend",
-    "packages/*"
-  ],
-  "engines": {
-    "node": ">=20"
-  }
-}

package/template/pnpm-workspace.yaml

@@ -1,4 +0,0 @@
-packages:
-  - "frontend"
-  - "backend"
-  - "packages/*"

package/template/{backend → base/backend}/src/index.ts

@@ -1,7 +1,7 @@
 import { serve } from "@hono/node-server"
 import { env } from "./config/env.js"
-import { logger } from "./utils/logger.js"
 import { app } from "./hono-app.js"
+import { logger } from "./utils/logger.js"
 
 /**
  * Local dev / persistent-server entry point (tsx watch, Railway, Render, any VPS).

package/template/{frontend → base/frontend}/app/dashboard/page.tsx

@@ -1,7 +1,7 @@
 import Link from "next/link"
-import { LogoutButton } from "@/domains/auth/components/logout-button"
-import { Button } from "@/components/ui/button"
 import { RequireAuth } from "@/components/require-auth"
+import { Button } from "@/components/ui/button"
+import { LogoutButton } from "@/domains/auth/components/logout-button"
 
 /**
  * Next.js Router Page: Dashboard

package/template/{frontend → base/frontend}/domains/user/hooks/use-profile.ts

@@ -1,8 +1,8 @@
 "use client"
 
-import { useEffect, useState } from "react"
-import { useRouter } from "next/navigation"
 import type { AuthUser } from "@restack/shared"
+import { useRouter } from "next/navigation"
+import { useEffect, useState } from "react"
 import { userApi } from "../services/user.api"
 
 /**