create-tigra 3.0.3 → 3.1.0

package/template/client/src/features/auth/components/LoginForm.tsx

@@ -3,7 +3,6 @@
 import type React from 'react';
 import { Suspense } from 'react';
 
-import Link from 'next/link';
 import { useSearchParams } from 'next/navigation';
 import { useForm } from 'react-hook-form';
 import { zodResolver } from '@hookform/resolvers/zod';
@@ -13,6 +12,7 @@ import { Loader2 } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
+import { AppLink } from '@/components/common/AppLink';
 import { useAuth } from '../hooks/useAuth';
 import { ROUTES } from '@/lib/constants/routes';
 import { cn } from '@/lib/utils';
@@ -100,12 +100,12 @@ const LoginFormInner = (): React.ReactElement => {
 
       <p className="text-center text-sm text-muted-foreground">
         Don&apos;t have an account?{' '}
-        <Link
+        <AppLink
           href={ROUTES.REGISTER}
           className="font-medium text-primary transition-colors duration-150 active:opacity-70 md:hover:text-primary/80"
         >
           Create account
-        </Link>
+        </AppLink>
       </p>
     </div>
   );

package/template/client/src/features/auth/components/RegisterForm.tsx

@@ -2,7 +2,6 @@
 
 import type React from 'react';
 
-import Link from 'next/link';
 import { useForm } from 'react-hook-form';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { z } from 'zod';
@@ -11,6 +10,7 @@ import { Loader2 } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
+import { AppLink } from '@/components/common/AppLink';
 import { useAuth } from '../hooks/useAuth';
 import { ROUTES } from '@/lib/constants/routes';
 import { cn } from '@/lib/utils';
@@ -166,12 +166,12 @@ export const RegisterForm = (): React.ReactElement => {
 
       <p className="text-center text-sm text-muted-foreground">
         Already have an account?{' '}
-        <Link
+        <AppLink
           href={ROUTES.LOGIN}
           className="font-medium text-primary transition-colors duration-150 active:opacity-70 md:hover:text-primary/80"
         >
           Sign in
-        </Link>
+        </AppLink>
       </p>
     </div>
   );

package/template/client/src/features/auth/hooks/useAuth.ts

@@ -3,10 +3,10 @@
 import { useCallback, useRef } from 'react';
 
 import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { useRouter } from 'next/navigation';
 import { toast } from 'sonner';
 
 import { useAppDispatch, useAppSelector } from '@/store/hooks';
+import { useAppRouter } from '@/hooks/useAppRouter';
 import { getErrorMessage, isErrorCode, ERROR_CODES } from '@/lib/utils/error';
 import { ROUTES } from '@/lib/constants/routes';
 import { authService } from '../services/auth.service';
@@ -28,7 +28,7 @@ interface UseAuthReturn {
 
 export const useAuth = (): UseAuthReturn => {
   const dispatch = useAppDispatch();
-  const router = useRouter();
+  const router = useAppRouter();
   const queryClient = useQueryClient();
   const { user, isAuthenticated, isInitializing, isLoggingOut } = useAppSelector((state) => state.auth);
   const pendingRedirectRef = useRef<string>(ROUTES.DASHBOARD);

package/template/client/src/features/auth/hooks/usePasswordReset.ts

@@ -1,9 +1,9 @@
 'use client';
 
 import { useMutation } from '@tanstack/react-query';
-import { useRouter } from 'next/navigation';
 import { toast } from 'sonner';
 
+import { useAppRouter } from '@/hooks/useAppRouter';
 import { ROUTES } from '@/lib/constants/routes';
 import { getErrorMessage } from '@/lib/utils/error';
 import { authService } from '../services/auth.service';
@@ -36,7 +36,7 @@ interface UseResetPasswordReturn {
 }
 
 export const useResetPassword = (): UseResetPasswordReturn => {
-  const router = useRouter();
+  const router = useAppRouter();
 
   const mutation = useMutation({
     mutationFn: (data: { token: string; newPassword: string }) =>

package/template/client/src/hooks/useAppRouter.ts

@@ -0,0 +1,40 @@
+'use client';
+
+import { useCallback, useMemo } from 'react';
+
+import { useRouter } from 'next/navigation';
+
+import { useSmoothNavigation } from '@/components/common/SmoothNavigationProvider';
+
+type AppRouter = ReturnType<typeof useRouter>;
+
+/**
+ * App Router wrapper that keeps Next.js from performing its instant scroll.
+ * Pass `{ scroll: false }` explicitly when navigation should preserve position.
+ */
+export const useAppRouter = (): AppRouter => {
+  const router = useRouter();
+  const { startNavigation } = useSmoothNavigation();
+
+  const push = useCallback<AppRouter['push']>(
+    (href, options) => {
+      if (options?.scroll !== false) {
+        startNavigation(href);
+      }
+      router.push(href, { ...options, scroll: false });
+    },
+    [router, startNavigation]
+  );
+
+  const replace = useCallback<AppRouter['replace']>(
+    (href, options) => {
+      if (options?.scroll !== false) {
+        startNavigation(href);
+      }
+      router.replace(href, { ...options, scroll: false });
+    },
+    [router, startNavigation]
+  );
+
+  return useMemo(() => ({ ...router, push, replace }), [router, push, replace]);
+};

package/template/client/src/instrumentation-client.ts

@@ -1,30 +1,38 @@
 /**
- * Browser (client) instrumentation — env-gated Sentry, INERT by default.
+ * Browser instrumentation.
  *
- * Next.js 15.3+/16 loads this module in the browser before the app hydrates.
- * We init Sentry ONLY when the public DSN is set, so with no DSN this file is a
- * no-op and ships nothing that phones home.
- *
- * `process.env.NEXT_PUBLIC_*` is inlined at build time by Next — reference it
- * literally (not via a computed key) so the value is statically replaced.
- *
- * Like the server side, this stays runtime + env-gated: we do NOT wrap
- * next.config.ts with `withSentryConfig` (that would couple `next build` to a
- * source-map upload auth token). withSentryConfig is the opt-in upgrade.
+ * Keep local dev cold: do not import @sentry/nextjs unless production has a
+ * public DSN. This avoids compiling the Sentry SDK for every local dev server.
  */
-import * as Sentry from '@sentry/nextjs';
+type SentryNext = typeof import('@sentry/nextjs');
+type RouterTransitionStart = SentryNext['captureRouterTransitionStart'];
 
 const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
+
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled || !dsn) return Promise.resolve(null);
 
-if (dsn) {
-  Sentry.init({
-    dsn,
-    tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
-      ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
-      : 0.1,
+  sentryPromise ??= import('@sentry/nextjs').then((Sentry) => {
+    Sentry.init({
+      dsn,
+      tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+        ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+        : 0.1,
+    });
+
+    return Sentry;
   });
+
+  return sentryPromise;
 }
 
-// Instruments App Router navigations for tracing. Harmless when Sentry is
-// uninitialized (no DSN).
-export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;
+void loadSentry();
+
+export const onRouterTransitionStart = ((...args: Parameters<RouterTransitionStart>) => {
+  void loadSentry().then((Sentry) => {
+    Sentry?.captureRouterTransitionStart(...args);
+  });
+}) as RouterTransitionStart;

package/template/client/src/instrumentation.ts

@@ -1,28 +1,30 @@
 /**
- * Server/Edge runtime instrumentation — env-gated Sentry, INERT by default.
+ * Server/Edge runtime instrumentation.
  *
- * Next.js calls `register()` once per server runtime at startup. We init Sentry
- * ONLY when a DSN is present (a server `SENTRY_DSN`, or the public DSN shared
- * with the browser), so with no DSN this is a clean no-op and `next build`
- * succeeds with zero Sentry credentials.
- *
- * NOTE: we deliberately do NOT wrap next.config.ts with `withSentryConfig`.
- * That adds build-time source-map upload which requires a SENTRY_AUTH_TOKEN and
- * would couple `next build` to credentials. Source-map upload is the opt-in
- * upgrade — add `withSentryConfig` + an auth token when you want it. This setup
- * stays purely runtime + env-gated.
+ * Keep local dev cold: importing @sentry/nextjs at module top-level makes Next
+ * compile the Sentry SDK before the first page, even with no DSN.
  */
-import * as Sentry from '@sentry/nextjs';
+type SentryNext = typeof import('@sentry/nextjs');
+type RequestErrorHandler = SentryNext['captureRequestError'];
 
 const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN ?? process.env.SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
 
 const tracesSampleRate = process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
   ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
   : 0.1;
 
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled) return Promise.resolve(null);
+  sentryPromise ??= import('@sentry/nextjs');
+  return sentryPromise;
+}
+
 export async function register(): Promise<void> {
-  // No DSN → stay inert.
-  if (!dsn) return;
+  const Sentry = await loadSentry();
+  if (!Sentry || !dsn) return;
 
   if (process.env.NEXT_RUNTIME === 'nodejs' || process.env.NEXT_RUNTIME === 'edge') {
     Sentry.init({
@@ -33,6 +35,8 @@ export async function register(): Promise<void> {
   }
 }
 
-// Capture errors from Server Components, route handlers, and middleware.
-// Safe no-op when Sentry was never initialized (no DSN).
-export const onRequestError = Sentry.captureRequestError;
+export const onRequestError = (async (...args: Parameters<RequestErrorHandler>) => {
+  const Sentry = await loadSentry();
+  if (!Sentry) return;
+  return Sentry.captureRequestError(...args);
+}) as RequestErrorHandler;

package/template/client/src/styles/themes/default.css

@@ -1,5 +1,5 @@
 /*
- * Default Theme — Claude-inspired warm palette
+ * Default Theme — warm neutral palette
  * Accent: Terracotta orange
  * Vibe: Earthy, warm, approachable
  *

package/template/gitignore

@@ -20,12 +20,6 @@ Thumbs.db
 .vscode/
 .idea/
 
-# Claude Code local settings
-.claude/settings.local.json
-
-# Developer role (personal per developer)
-.developer-role
-
 # Playwright MCP artifacts
 .playwright-mcp/
 

package/template/server/AGENTS.md

@@ -0,0 +1,28 @@
+# Server Codex instructions
+
+## Architecture and naming
+
+- Request flow is route → controller → service → repository → Prisma. Routes register HTTP/schema metadata; controllers translate HTTP input/output; services own business rules; repositories contain database queries only.
+- Domain modules live in `src/modules/<domain>/` with `<domain>.routes.ts`, `.controller.ts`, `.service.ts`, `.repo.ts`, and `.schemas.ts`.
+- All API routes use the `/api/v1` prefix. Use the shared `successResponse`, `paginatedResponse`, and typed `AppError` contracts rather than custom response/error shapes.
+- Use the shared logger and outbound HTTP client. Never add ad-hoc `console.log`, raw `fetch`, or per-call HTTP clients that bypass redaction, timeouts, and error mapping.
+
+## Sources of truth
+
+- `prisma/schema.prisma` owns models, relations, indexes, and database naming. Change schema through reviewed Prisma migrations; production is forward-only with `prisma migrate deploy`.
+- `src/config/env.ts` owns runtime configuration validation. Keep `.env.example` and `.env.example.production` synchronized, but keep real secrets out of the repository and image.
+- Zod route schemas own external input validation. Services own authorization and business invariants; repositories must not decide access policy.
+
+## Security and deployment
+
+- Preserve httpOnly cookie auth, production CORS allowlists, state-changing request origin checks, rate limiting, safe client IP handling, generic 500 responses, and server-side-only diagnostic logging.
+- Use Prisma parameterization and explicit safe projections; never expose password hashes, tokens, internal errors, or secret-bearing upstream payloads.
+- Keep public uploads under the static public root. Private uploads stay outside it and are served only through authenticated, owner-scoped routes; preserve filename/path validation.
+- The production image runs non-root, applies `prisma migrate deploy` before `node dist/server.js`, and probes unauthenticated `GET /api/v1/live`. Preserve writable ownership for runtime storage and add explicit Alpine packages for new native runtime dependencies.
+
+## Mandatory security completion gate
+
+- Follow the root `AGENTS.md` security workflow for every meaningful server change: use `security-audit` guidance during implementation and run `codex-security:security-diff-scan` on the resulting patch when the Codex Security plugin is available.
+- Review the concrete trust boundary, attacker-controlled input, affected principal/resource, authorization decision, validation point, and observable impact. Missing best practices without a reachable boundary failure are hardening notes, not confirmed vulnerabilities.
+- Add or update focused regression coverage for changed authorization, validation, origin/CORS, cookie/session, upload/path, outbound-request, and data-isolation behavior. Never rely on client checks as security evidence.
+- If a required security check cannot run, state the exact blocker and safe follow-up instead of reporting the server change as fully verified.

package/template/server/Dockerfile

@@ -1,7 +1,11 @@
+# syntax=docker/dockerfile:1
 # ===================================================================
 # Multi-stage Dockerfile for Production Deployment
 # Optimized for Coolify, Docker Compose, and Kubernetes
 # ===================================================================
+# BuildKit cache mounts (--mount=type=cache) keep the npm download cache warm
+# ACROSS builds, so a lockfile-change rebuild re-installs without re-downloading.
+# Requires the `# syntax` line above; auto-enabled on Docker 23+ / any BuildKit.
 
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
@@ -15,7 +19,8 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
 # Install dependencies (use the lockfile that exists)
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --prod --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --production --frozen-lockfile; \
@@ -32,7 +37,7 @@ RUN if [ -f pnpm-lock.yaml ]; then \
 # --no-save keeps package.json and the lockfile untouched. Because this stage
 # runs on the same Alpine (musl) base as the runtime stage, the engine binaries
 # downloaded here are the correct ones for production.
-RUN npm install --no-save --no-audit --no-fund \
+RUN --mount=type=cache,target=/root/.npm npm install --no-save --no-audit --no-fund \
       "prisma@$(node -p "require('@prisma/client/package.json').version")"
 
 # ===================================================================
@@ -50,7 +55,8 @@ WORKDIR /app
 # Copy package files and install ALL dependencies (including dev)
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --frozen-lockfile; \