create-restack-pattern 0.1.8 → 0.2.0

package/dist/index.js

@@ -1,20 +1,24 @@
 #!/usr/bin/env node
-import { cpSync, existsSync, readFileSync, writeFileSync, readdirSync, renameSync } from "node:fs";
 import { execSync } from "node:child_process";
-import { createInterface } from "node:readline/promises";
-import { fileURLToPath } from "node:url";
+import { cpSync, existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+import * as p from "@clack/prompts";
+import color from "picocolors";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const templateDir = path.resolve(__dirname, "..", "template");
-async function promptProjectName() {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const answer = await rl.question("Project name: ");
-    rl.close();
-    return answer.trim();
-}
 function isValidProjectName(name) {
     return /^[a-z0-9-_]+$/i.test(name);
 }
+function isCommandAvailable(command) {
+    try {
+        execSync(`${command} --version`, { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // Undoes sync-template.mjs's .gitignore -> gitignore rename (npm strips
 // files literally named .gitignore from the published tarball).
 function renameGitignoreFilesBack(dir) {
@@ -26,85 +30,254 @@ function renameGitignoreFilesBack(dir) {
             renameSync(full, path.join(dir, ".gitignore"));
     }
 }
-function isPnpmInstalled() {
-    try {
-        execSync("pnpm --version", { stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 async function main() {
-    if (!isPnpmInstalled()) {
-        console.error("\n\x1b[31mError: pnpm is not installed.\x1b[0m");
-        console.error("This template is configured as a pnpm workspace monorepo and requires pnpm to run.");
-        console.error("Please install pnpm before continuing:");
-        console.error("  npm install -g pnpm");
-        console.error("Or visit https://pnpm.io for more installation options.\n");
-        process.exit(1);
+    if (process.argv.includes("--help") || process.argv.includes("-h")) {
+        console.log(`
+Usage: create-restack-pattern [project-name]
+
+Options:
+  -h, --help    Show help message
+  -v, --version Show CLI version
+
+Examples:
+  pnpm create restack-pattern my-saas-app
+  npm create restack-pattern@latest
+  bun create restack-pattern@latest
+`);
+        process.exit(0);
     }
-    const argName = process.argv[2];
-    const projectName = argName ?? (await promptProjectName());
-    if (!projectName || !isValidProjectName(projectName)) {
-        console.error("Invalid project name. Use letters, numbers, hyphens, or underscores only.");
-        process.exit(1);
+    if (process.argv.includes("--version") || process.argv.includes("-v")) {
+        const pkg = JSON.parse(readFileSync(path.resolve(__dirname, "..", "package.json"), "utf-8"));
+        console.log(pkg.version);
+        process.exit(0);
+    }
+    console.log();
+    p.intro(color.bgCyan(color.black(" create-restack-pattern ")));
+    let projectName = process.argv[2];
+    if (!projectName || projectName.startsWith("-")) {
+        const nameInput = await p.text({
+            message: "What is your project named?",
+            placeholder: "my-restack-app",
+            defaultValue: "my-restack-app",
+            validate: (value) => {
+                if (!value)
+                    return "Project name cannot be empty";
+                if (!isValidProjectName(value)) {
+                    return "Project name may only contain letters, numbers, hyphens, and underscores";
+                }
+                if (existsSync(path.resolve(process.cwd(), value))) {
+                    return `Directory "${value}" already exists in the current directory`;
+                }
+            },
+        });
+        if (p.isCancel(nameInput)) {
+            p.cancel("Operation cancelled.");
+            process.exit(0);
+        }
+        projectName = nameInput;
     }
     const targetDir = path.resolve(process.cwd(), projectName);
     if (existsSync(targetDir)) {
-        console.error(`Directory "${projectName}" already exists.`);
+        p.cancel(color.red(`Error: Directory "${projectName}" already exists.`));
         process.exit(1);
     }
-    console.log(`Scaffolding into ${targetDir} ...`);
-    cpSync(templateDir, targetDir, { recursive: true });
+    const database = (await p.select({
+        message: "Select your database:",
+        options: [
+            {
+                value: "postgres",
+                label: "PostgreSQL",
+                hint: "Neon, Supabase, Docker, AWS RDS (Recommended for SaaS)",
+            },
+            {
+                value: "sqlite",
+                label: "SQLite",
+                hint: "Zero-config local file, Turso, Cloudflare D1",
+            },
+        ],
+        initialValue: "postgres",
+    }));
+    if (p.isCancel(database)) {
+        p.cancel("Operation cancelled.");
+        process.exit(0);
+    }
+    const idStrategy = (await p.select({
+        message: "Select primary key strategy:",
+        options: [
+            {
+                value: "uuid",
+                label: "UUIDv7",
+                hint: "Time-sortable, unguessable, secure against enumeration (Recommended)",
+            },
+            {
+                value: "serial",
+                label: "Serial Integer",
+                hint: "Auto-incrementing 1, 2, 3... (Simple relational lookups)",
+            },
+        ],
+        initialValue: "uuid",
+    }));
+    if (p.isCancel(idStrategy)) {
+        p.cancel("Operation cancelled.");
+        process.exit(0);
+    }
+    const packageManager = (await p.select({
+        message: "Select package manager:",
+        options: [
+            {
+                value: "pnpm",
+                label: "pnpm",
+                hint: "Fast, disk-efficient workspace monorepo (Recommended)",
+            },
+            {
+                value: "npm",
+                label: "npm",
+                hint: "Default Node.js package manager",
+            },
+            {
+                value: "bun",
+                label: "bun",
+                hint: "Fast all-in-one JavaScript runtime & toolkit",
+            },
+        ],
+        initialValue: "pnpm",
+    }));
+    if (p.isCancel(packageManager)) {
+        p.cancel("Operation cancelled.");
+        process.exit(0);
+    }
+    const s = p.spinner();
+    // 1. Scaffold files
+    s.start(`Scaffolding ${projectName} (${database} + ${idStrategy}) ...`);
+    const baseDir = path.join(templateDir, "base");
+    const overlaysDir = path.join(templateDir, "overlays");
+    // Copy base template
+    cpSync(baseDir, targetDir, { recursive: true });
+    // Overlay database configuration
+    const dbOverlayDir = path.join(overlaysDir, `db-${database}`);
+    if (existsSync(dbOverlayDir)) {
+        cpSync(dbOverlayDir, targetDir, { recursive: true });
+    }
+    // Overlay models
+    const modelOverlayDir = path.join(overlaysDir, "models", `${database}-${idStrategy}`);
+    if (existsSync(modelOverlayDir)) {
+        cpSync(modelOverlayDir, targetDir, { recursive: true });
+    }
+    // Overlay shared schema
+    const idOverlayDir = path.join(overlaysDir, `id-${idStrategy}`);
+    if (existsSync(idOverlayDir)) {
+        cpSync(idOverlayDir, targetDir, { recursive: true });
+    }
     renameGitignoreFilesBack(targetDir);
+    // 2. Patch package.json files
     const rootPkgPath = path.join(targetDir, "package.json");
     const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf-8"));
     rootPkg.name = projectName;
-    writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
-    console.log("Installing dependencies (pnpm install) ...");
-    execSync("pnpm install", { cwd: targetDir, stdio: "inherit" });
-    // packages/shared ships no dist/ (gitignored) — backend/frontend resolve
-    // @restack/shared to compiled output, so it must be built once up front
-    // or the very first `pnpm dev` fails to resolve the import.
-    console.log("Building @restack/shared ...");
-    execSync("pnpm --filter @restack/shared build", { cwd: targetDir, stdio: "inherit" });
+    if (packageManager !== "pnpm") {
+        rootPkg.workspaces = ["frontend", "backend", "packages/*"];
+    }
+    writeFileSync(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
+    const backendPkgPath = path.join(targetDir, "backend/package.json");
+    if (existsSync(backendPkgPath)) {
+        const backendPkg = JSON.parse(readFileSync(backendPkgPath, "utf-8"));
+        if (database === "sqlite") {
+            if (backendPkg.dependencies) {
+                delete backendPkg.dependencies.postgres;
+                backendPkg.dependencies["better-sqlite3"] = "^13.0.3";
+            }
+            if (backendPkg.devDependencies) {
+                backendPkg.devDependencies["@types/better-sqlite3"] = "^7.6.13";
+            }
+        }
+        else {
+            if (backendPkg.dependencies) {
+                delete backendPkg.dependencies["better-sqlite3"];
+            }
+            if (backendPkg.devDependencies) {
+                delete backendPkg.devDependencies["@types/better-sqlite3"];
+            }
+        }
+        if (packageManager !== "pnpm") {
+            if (backendPkg.dependencies?.["@restack/shared"] === "workspace:*") {
+                backendPkg.dependencies["@restack/shared"] = "*";
+            }
+        }
+        writeFileSync(backendPkgPath, `${JSON.stringify(backendPkg, null, 2)}\n`);
+    }
+    const frontendPkgPath = path.join(targetDir, "frontend/package.json");
+    if (existsSync(frontendPkgPath) && packageManager !== "pnpm") {
+        const frontendPkg = JSON.parse(readFileSync(frontendPkgPath, "utf-8"));
+        if (frontendPkg.dependencies?.["@restack/shared"] === "workspace:*") {
+            frontendPkg.dependencies["@restack/shared"] = "*";
+            writeFileSync(frontendPkgPath, `${JSON.stringify(frontendPkg, null, 2)}\n`);
+        }
+    }
+    s.stop(color.green(`Scaffolded ${projectName} files successfully!`));
+    // 3. Install dependencies
+    if (isCommandAvailable(packageManager)) {
+        s.start(`Installing dependencies using ${packageManager} ...`);
+        try {
+            execSync(`${packageManager} install`, { cwd: targetDir, stdio: "ignore" });
+            s.stop(color.green(`Dependencies installed using ${packageManager}!`));
+        }
+        catch {
+            s.stop(color.yellow(`Could not automatically run ${packageManager} install. You can run it manually.`));
+        }
+        // 4. Build @restack/shared
+        s.start("Building @restack/shared package ...");
+        try {
+            if (packageManager === "pnpm") {
+                execSync("pnpm --filter @restack/shared build", { cwd: targetDir, stdio: "ignore" });
+            }
+            else if (packageManager === "bun") {
+                execSync("bun --filter @restack/shared build", { cwd: targetDir, stdio: "ignore" });
+            }
+            else {
+                execSync("npm run build --workspace=@restack/shared", { cwd: targetDir, stdio: "ignore" });
+            }
+            s.stop(color.green("@restack/shared package built!"));
+        }
+        catch {
+            s.stop(color.yellow("Could not automatically build @restack/shared. Run the build script manually."));
+        }
+    }
+    else {
+        p.log.warn(color.yellow(`Note: ${packageManager} was not found on your system. Run '${packageManager} install' manually.`));
+    }
+    // 5. Initialize git
     try {
         execSync("git init", { cwd: targetDir, stdio: "ignore" });
     }
     catch {
-        // git not available — non-fatal, scaffolding still succeeded
+        // Non-fatal
     }
-    console.log(`
-\x1b[32m✔ Scaffolded project successfully!\x1b[0m
-
-Next steps to get started:
+    const dbConfigStep = database === "postgres"
+        ? `• For Backend:
+     ${color.cyan("cp backend/.env.example backend/.env")}
+     (Set ${color.yellow("DATABASE_URL")} and a min-32-character ${color.yellow("JWT_SECRET")})`
+        : `• For Backend:
+     ${color.cyan("cp backend/.env.example backend/.env")}
+     (SQLite database file will be created automatically at ${color.yellow("sqlite.db")})`;
+    p.note(`1. Go to your project directory:
+   ${color.cyan(`cd ${projectName}`)}
 
-  1. Go to your project directory:
-     \x1b[36mcd ${projectName}\x1b[0m
+2. Configure environment variables:
+   ${dbConfigStep}
 
-  2. Configure environment variables:
-     • For Backend:
-       \x1b[36mcp backend/.env.example backend/.env\x1b[0m
-       (Open backend/.env and set \x1b[33mDATABASE_URL\x1b[0m and a min-32-chars \x1b[33mJWT_SECRET\x1b[0m)
+   • For Frontend:
+     ${color.cyan("cp frontend/.env.example frontend/.env")}
 
-     • For Frontend:
-       \x1b[36mcp frontend/.env.example frontend/.env\x1b[0m
+3. Push database tables:
+   ${color.cyan(`${packageManager} --filter backend db:push`)}
 
-  3. Push database tables (creates users & auth_sessions tables):
-     \x1b[36mpnpm --filter backend db:push\x1b[0m
-
-  4. Start development servers:
-     • Backend (running at http://localhost:3001):
-       \x1b[36mpnpm --filter backend dev\x1b[0m
-
-     • Frontend (running at http://localhost:3000):
-       \x1b[36mpnpm --filter frontend dev\x1b[0m
-
-Enjoy building your app with the Restack Pattern!
-`);
+4. Start development servers:
+   • Backend (API running at http://localhost:3001):
+     ${color.cyan(`${packageManager} --filter backend dev`)}
+   • Frontend (Next.js running at http://localhost:3000):
+     ${color.cyan(`${packageManager} --filter frontend dev`)}`, "Next steps to get started:");
+    p.outro(color.green(`All done! Enjoy building with the Restack Pattern!`));
 }
 main().catch((err) => {
-    console.error(err);
+    p.cancel(color.red(String(err)));
     process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-restack-pattern",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "Scaffold a new Next.js + Hono + Drizzle monorepo using the Restack Pattern (Semi-DDD) template.",
   "license": "MIT",
   "type": "module",
@@ -12,18 +12,24 @@
     "dist",
     "template"
   ],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsx src/index.ts",
-    "sync-template": "node scripts/sync-template.mjs",
-    "prepublishOnly": "pnpm sync-template && pnpm build"
+  "publishConfig": {
+    "access": "public"
   },
   "devDependencies": {
     "@types/node": "^20.11.17",
-    "tsx": "^4.7.1",
+    "tsx": "^4.23.15",
     "typescript": "^5.8.3"
   },
   "engines": {
     "node": ">=20"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.8.1",
+    "picocolors": "^1.1.1"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "sync-template": "node scripts/sync-template.mjs"
   }
-}
+}

package/template/{DEVELOPMENT.md → base/DEVELOPMENT.md}

@@ -1,62 +1,73 @@
-# DEVELOPMENT.md
-
-This document outlines the architecture, build guidelines, and code conventions for the Restack Pattern monorepo. All developers and automated tools contributing to this project must follow these rules.
-
-## Project Stack
-- **Frontend**: Next.js 16 (App Router)
-- **Backend**: Hono
-- **ORM**: Drizzle ORM
-- **Database**: PostgreSQL (Postgres-js driver)
-- **Validation**: Zod (shared schemas)
-- **Package Manager**: pnpm workspaces
-
-## Monorepo Layout
-- `frontend/` — Next.js 16 App Router
-- `backend/` — Hono API
-- `packages/shared/` — Shared Zod schemas (the single source of truth)
-
-## Build and Dev Commands
-All commands should be run from the repository root:
-- `pnpm install` — Install all dependencies
-- `pnpm --filter @restack/shared build` — Build shared Zod schemas (run first!)
-- `pnpm --filter backend dev` — Start Hono dev server on port 3001
-- `pnpm --filter frontend dev` — Start Next.js dev server on port 3000
-- `pnpm --filter backend db:push` — Push Drizzle schema to PostgreSQL database
-- `pnpm --filter backend db:studio` — Open Drizzle Studio database viewer
-- `pnpm --filter backend test` — Run Vitest tests
-
-## Architecture Rules: Semi-DDD (Feature-Driven)
-Code is organized by business domain/feature, not by file type.
-
-### Backend Layout (`backend/src/domains/[feature]/`)
-Each domain has 4 primary files:
-- `[feature].routes.ts` — HTTP endpoints & input validation (imports Zod schema from `@restack/shared`)
-- `[feature].service.ts` — Pure business logic only (no direct DB access)
-- `[feature].repo.ts` — Drizzle queries only (no business logic)
-- `[feature].model.ts` — Drizzle table definitions
-
-**Cross-Domain Dependency Rule**: The `auth` domain may import from `user` (e.g. `usersTable` from `user.model.ts`). The reverse (user importing from auth) is STRICTLY FORBIDDEN.
-
-### Frontend Layout (`frontend/domains/[feature]/`)
-- `components/` — UI components (no direct data fetching)
-- `hooks/` — Reactive state & data fetching logic
-- `services/` — Thin HTTP wrappers around `apiClient`
-- `types.ts` — Local TS type declarations
-- `frontend/app/` is strictly for layout, routing config, metadata, or entry gates. Do not implement custom JSX layouts, forms, state, or complex components here. Always delegate rendering to domain feature components.
-
-## Critical Gotcha: Shared Package Build Requirement
-`@restack/shared`'s `package.json` resolves to `dist/`, which is gitignored. When editing Zod schemas in `packages/shared/src/schemas/`, you MUST compile them by running:
-`pnpm --filter @restack/shared build`
-(or keep `pnpm --filter @restack/shared dev` watch mode running in a terminal) or the frontend and backend will fail to resolve the updated types or throw compilation errors.
-
-## Auth & Cookie Strategy
-- Short-lived JWT `access_token` (15m) and opaque `refresh_token` (30d) are both set as `httpOnly` cookies at `Path=/`.
-- Access tokens are automatically refreshed by the client-side `apiClient` on a 401 response.
-- Cookie configuration: `SameSite=None` in production (requires `Secure=true`), and `SameSite=Lax` in development (`Secure=false` since local dev runs on HTTP).
-- There is no server-side auth gate (`middleware.ts`/`proxy.ts`) because cookies cannot be read server-side when frontend and backend deploy to unrelated domains (Topology B). Authenticated routes are protected via backend `requireAuth` middleware, and frontend pages are protected via `<RequireAuth>` or client-side checks in hooks.
-
-## Structured & Correlation Logging
-- Every incoming HTTP request is tagged with a unique `requestId` via Hono's `requestId` middleware.
-- A request-scoped child logger (`logger.child({ requestId })`) is bound to Hono's context.
-- In route handlers, always extract the request-specific child logger from Hono's context (`c.get("logger") || logger`) to log events. This ensures all logs generated during a request carry the correct `requestId` and `userId` context (which is automatically enriched by the `requireAuth` middleware).
-
+# DEVELOPMENT.md
+
+This document outlines the architecture, build guidelines, and code conventions for the Restack Pattern monorepo. All developers and automated tools contributing to this project must follow these rules.
+
+## Project Stack
+- **Frontend**: Next.js 16 (App Router with Turbopack & Typed Routes)
+- **Backend**: Hono
+- **ORM**: Drizzle ORM
+- **Databases**: PostgreSQL (`postgres-js`) & SQLite (`better-sqlite3`)
+- **Primary Keys**: RFC 9562 UUIDv7 or Serial Auto-Increment
+- **Validation**: Zod (shared schemas)
+- **Quality**: Biome v2 (sub-50ms linter & formatter)
+- **Package Manager**: pnpm workspaces (also supports npm & bun)
+
+## Monorepo Layout
+- `frontend/` — Next.js 16 App Router
+- `backend/` — Hono API
+- `packages/shared/` — Shared Zod schemas and utilities (single source of truth)
+- `packages/create-restack-pattern/` — Interactive CLI scaffolder published on npm
+
+## Build and Dev Commands
+All commands should be run from the repository root:
+- `pnpm install` — Install all dependencies
+- `pnpm --filter @restack/shared build` — Build shared Zod schemas (run first!)
+- `pnpm --filter backend dev` — Start Hono dev server on port 3001
+- `pnpm --filter frontend dev` — Start Next.js dev server on port 3000
+- `pnpm --filter backend db:push` — Push Drizzle schema to database
+- `pnpm --filter backend db:studio` — Open Drizzle Studio database viewer
+- `pnpm --filter backend test` — Run Vitest tests
+- `pnpm lint` — Run Biome linter across all packages (<50ms)
+- `pnpm format` — Auto-format all code with Biome
+
+## Architecture Rules: Semi-DDD (Feature-Driven)
+Code is organized by business domain/feature, not by file type.
+
+### Backend Layout (`backend/src/domains/[feature]/`)
+Each domain has 4 primary files:
+- `[feature].routes.ts` — HTTP endpoints & input validation (imports Zod schema from `@restack/shared`)
+- `[feature].service.ts` — Pure business logic only (no direct DB access)
+- `[feature].repo.ts` — Drizzle queries only (no business logic)
+- `[feature].model.ts` — Drizzle table definitions
+
+**Cross-Domain Dependency Rule**: The `auth` domain may import from `user` (e.g. `usersTable` from `user.model.ts`). The reverse (user importing from auth) is STRICTLY FORBIDDEN.
+
+### Frontend Layout (`frontend/domains/[feature]/`)
+- `components/` — UI components (no direct data fetching)
+- `hooks/` — Reactive state & data fetching logic
+- `services/` — Thin HTTP wrappers around `apiClient`
+- `types.ts` — Local TS type declarations
+- `frontend/app/` is strictly for layout, routing config, metadata, or entry gates. Do not implement custom JSX layouts, forms, state, or complex components here. Always delegate rendering to domain feature components.
+
+## Critical Gotcha: Shared Package Build Requirement
+`@restack/shared`'s `package.json` resolves to `dist/`, which is gitignored. When editing Zod schemas in `packages/shared/src/schemas/`, you MUST compile them by running:
+`pnpm --filter @restack/shared build`
+(or keep `pnpm --filter @restack/shared dev` watch mode running in a terminal) or the frontend and backend will fail to resolve the updated types or throw compilation errors.
+
+## Auth & Cookie Strategy (Hybrid Auth & RBAC)
+- **Hybrid Auth**: Accepts tokens via `Authorization: Bearer <token>` header first (for mobile, scripts, and external clients) or `access_token` HttpOnly cookie (for web browsers).
+- **Dual Token Issuance**: Endpoints `/register`, `/login`, and `/refresh` return `{ user, accessToken, refreshToken }` in JSON body while simultaneously issuing HttpOnly cookies.
+- **RBAC Guard**: Use `requireRole(...roles)` after `requireAuth` to restrict routes by role:
+  ```ts
+  userRoutes.get("/admin", requireAuth, requireRole("admin"), (c) => ...)
+  ```
+- Short-lived JWT `access_token` (15m) and opaque `refresh_token` (30d) are both set as `httpOnly` cookies at `Path=/`.
+- Access tokens are automatically refreshed by the client-side `apiClient` on a 401 response.
+- Cookie configuration: `SameSite=None` in production (requires `Secure=true`), and `SameSite=Lax` in development (`Secure=false` since local dev runs on HTTP).
+
+## Structured & Correlation Logging
+- Every incoming HTTP request is tagged with a unique `requestId` via Hono's `requestId` middleware.
+- A request-scoped child logger (`logger.child({ requestId })`) is bound to Hono's context.
+- In route handlers, always extract the request-specific child logger from Hono's context (`c.get("logger") || logger`) to log events. This ensures all logs generated during a request carry the correct `requestId`, `userId`, and `authMethod`.
+
+

package/template/{backend → base/backend}/package.json

@@ -11,23 +11,26 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@hono/node-server": "^2.0.6",
-    "@hono/zod-validator": "^0.8.0",
+    "@hono/node-server": "^2.1.5",
+    "@hono/zod-validator": "^0.9.1",
     "@restack/shared": "workspace:*",
     "bcryptjs": "^3.0.3",
+    "better-sqlite3": "^13.0.3",
     "dotenv": "^17.4.2",
-    "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.27",
-    "jose": "^6.2.3",
-    "pino": "^10.3.1",
+    "drizzle-orm": "^0.45.4",
+    "hono": "^4.13.13",
+    "jose": "^6.2.12",
+    "pino": "^10.4.0",
     "postgres": "^3.4.9",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
+    "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^20.11.17",
-    "drizzle-kit": "^0.31.10",
-    "pino-pretty": "^13.1.3",
-    "tsx": "^4.7.1",
+    "drizzle-kit": "^0.31.11",
+    "fast-check": "^4.10.2",
+    "pino-pretty": "^13.2.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.8.3",
     "vitest": "^3.0.0"
   },

package/template/{backend → base/backend}/src/config/env.ts

@@ -1,5 +1,5 @@
 import "dotenv/config"
-import { z } from "zod";
+import { z } from "zod"
 
 const envSchema = z.object({
   // Memastikan DATABASE_URL ada dan berformat URL valid
@@ -20,4 +20,4 @@ const envSchema = z.object({
   LOG_FILE_PATH: z.string().optional(),
 })
 
-export const env = envSchema.parse(process.env)
+export const env = envSchema.parse(process.env)

package/template/{backend → base/backend}/src/domains/auth/auth.model.ts

@@ -1,10 +1,10 @@
-import { pgTable, serial, integer, text, timestamp } from "drizzle-orm/pg-core"
+import { integer, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core"
 import { usersTable } from "../user/user.model.js"
 
 /**
  * Auth Sessions Table Schema.
  * Tracks active, refreshable user login sessions.
- * 
+ *
  * Security rules:
  * - We only store the SHA-256 hash of the refresh token (`refreshTokenHash`),
  *   protecting the user session from being compromised if the database leaks.
@@ -12,7 +12,9 @@ import { usersTable } from "../user/user.model.js"
  */
 export const authSessionsTable = pgTable("auth_sessions", {
   id: serial("id").primaryKey(),
-  userId: integer("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => usersTable.id, { onDelete: "cascade" }),
   // sha256 of the opaque refresh token — never store the raw token.
   refreshTokenHash: text("refresh_token_hash").notNull().unique(),
   expiresAt: timestamp("expires_at").notNull(),