create-velox-app 0.6.31 → 0.6.52

package/dist/templates/shared/theme.d.ts

@@ -0,0 +1,133 @@
+/**
+ * VeloxTS Design System
+ *
+ * Dark mode theme constants extracted from the SPA template.
+ * This is the single source of truth for all RSC template styling.
+ */
+/**
+ * Color palette - Dark mode with cyan accents
+ */
+export declare const colors: {
+    readonly background: "#0a0a0a";
+    readonly backgroundAlt: "#111";
+    readonly surface: "#111";
+    readonly surfaceHover: "#1a1a1a";
+    readonly surfaceAlt: "#1a1a1a";
+    readonly border: "#222";
+    readonly borderHover: "#333";
+    readonly borderFocus: "#00d9ff";
+    readonly text: "#ededed";
+    readonly textMuted: "#888";
+    readonly textDimmed: "#666";
+    readonly textInverse: "#000";
+    readonly accent: "#00d9ff";
+    readonly accentHover: "rgba(0, 217, 255, 0.8)";
+    readonly accentDimmed: "rgba(0, 217, 255, 0.6)";
+    readonly success: "#00d9ff";
+    readonly error: "#ff4444";
+    readonly errorBg: "#2a1111";
+    readonly errorText: "#ff6666";
+    readonly warning: "#ffaa00";
+    readonly warningBg: "#2a2211";
+    readonly info: "#00d9ff";
+    readonly selection: "#00d9ff";
+    readonly selectionText: "#000";
+    readonly scrollbarTrack: "#111";
+    readonly scrollbarThumb: "#333";
+    readonly scrollbarThumbHover: "#444";
+    readonly codeBg: "#1a1a1a";
+};
+/**
+ * Typography
+ */
+export declare const typography: {
+    readonly fontFamily: {
+        readonly sans: "-apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Oxygen, Ubuntu, Cantarell, \"Open Sans\", \"Helvetica Neue\", sans-serif";
+        readonly mono: "\"SF Mono\", \"Fira Code\", \"Fira Mono\", Menlo, Monaco, \"Courier New\", monospace";
+    };
+    readonly fontSize: {
+        readonly xs: "0.625rem";
+        readonly sm: "0.75rem";
+        readonly base: "0.875rem";
+        readonly md: "0.9rem";
+        readonly lg: "1rem";
+        readonly xl: "1.25rem";
+        readonly '2xl': "1.5rem";
+        readonly '3xl': "2rem";
+        readonly '4xl': "2.5rem";
+        readonly '5xl': "3rem";
+    };
+    readonly fontWeight: {
+        readonly normal: "400";
+        readonly medium: "500";
+        readonly semibold: "600";
+        readonly bold: "700";
+    };
+    readonly lineHeight: {
+        readonly tight: "1.2";
+        readonly normal: "1.6";
+        readonly relaxed: "1.8";
+    };
+};
+/**
+ * Spacing scale (based on 0.25rem = 4px)
+ */
+export declare const spacing: {
+    readonly 0: "0";
+    readonly 1: "0.25rem";
+    readonly 2: "0.5rem";
+    readonly 3: "0.75rem";
+    readonly 4: "1rem";
+    readonly 5: "1.25rem";
+    readonly 6: "1.5rem";
+    readonly 8: "2rem";
+    readonly 10: "2.5rem";
+    readonly 12: "3rem";
+    readonly 16: "4rem";
+    readonly 20: "5rem";
+};
+/**
+ * Layout constants
+ */
+export declare const layout: {
+    readonly maxWidth: "1200px";
+    readonly maxWidthNarrow: "1000px";
+    readonly maxWidthWide: "1400px";
+    readonly navHeight: "64px";
+    readonly sidebarWidth: "240px";
+    readonly borderRadius: {
+        readonly sm: "4px";
+        readonly md: "6px";
+        readonly lg: "8px";
+        readonly xl: "12px";
+    };
+    readonly boxShadow: {
+        readonly sm: "0 1px 2px rgba(0, 0, 0, 0.3)";
+        readonly md: "0 2px 8px rgba(0, 0, 0, 0.4)";
+        readonly lg: "0 4px 16px rgba(0, 0, 0, 0.5)";
+    };
+};
+/**
+ * Transitions
+ */
+export declare const transitions: {
+    readonly fast: "0.1s";
+    readonly normal: "0.2s";
+    readonly slow: "0.3s";
+    readonly ease: "ease";
+    readonly easeIn: "ease-in";
+    readonly easeOut: "ease-out";
+    readonly easeInOut: "ease-in-out";
+};
+/**
+ * Z-index layers
+ */
+export declare const zIndex: {
+    readonly base: 0;
+    readonly dropdown: 10;
+    readonly sticky: 100;
+    readonly fixed: 200;
+    readonly modal: 300;
+    readonly popover: 400;
+    readonly tooltip: 500;
+};

package/dist/templates/shared/theme.js

@@ -0,0 +1,141 @@
+/**
+ * VeloxTS Design System
+ *
+ * Dark mode theme constants extracted from the SPA template.
+ * This is the single source of truth for all RSC template styling.
+ */
+/**
+ * Color palette - Dark mode with cyan accents
+ */
+export const colors = {
+    // Backgrounds
+    background: '#0a0a0a',
+    backgroundAlt: '#111',
+    surface: '#111',
+    surfaceHover: '#1a1a1a',
+    surfaceAlt: '#1a1a1a',
+    // Borders
+    border: '#222',
+    borderHover: '#333',
+    borderFocus: '#00d9ff',
+    // Text
+    text: '#ededed',
+    textMuted: '#888',
+    textDimmed: '#666',
+    textInverse: '#000',
+    // Accent & Brand
+    accent: '#00d9ff',
+    accentHover: 'rgba(0, 217, 255, 0.8)',
+    accentDimmed: 'rgba(0, 217, 255, 0.6)',
+    // Semantic Colors
+    success: '#00d9ff',
+    error: '#ff4444',
+    errorBg: '#2a1111',
+    errorText: '#ff6666',
+    warning: '#ffaa00',
+    warningBg: '#2a2211',
+    info: '#00d9ff',
+    // Selection
+    selection: '#00d9ff',
+    selectionText: '#000',
+    // Scrollbar
+    scrollbarTrack: '#111',
+    scrollbarThumb: '#333',
+    scrollbarThumbHover: '#444',
+    // Code blocks
+    codeBg: '#1a1a1a',
+};
+/**
+ * Typography
+ */
+export const typography = {
+    fontFamily: {
+        sans: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue", sans-serif',
+        mono: '"SF Mono", "Fira Code", "Fira Mono", Menlo, Monaco, "Courier New", monospace',
+    },
+    fontSize: {
+        xs: '0.625rem', // 10px
+        sm: '0.75rem', // 12px
+        base: '0.875rem', // 14px
+        md: '0.9rem', // 14.4px
+        lg: '1rem', // 16px
+        xl: '1.25rem', // 20px
+        '2xl': '1.5rem', // 24px
+        '3xl': '2rem', // 32px
+        '4xl': '2.5rem', // 40px
+        '5xl': '3rem', // 48px
+    },
+    fontWeight: {
+        normal: '400',
+        medium: '500',
+        semibold: '600',
+        bold: '700',
+    },
+    lineHeight: {
+        tight: '1.2',
+        normal: '1.6',
+        relaxed: '1.8',
+    },
+};
+/**
+ * Spacing scale (based on 0.25rem = 4px)
+ */
+export const spacing = {
+    0: '0',
+    1: '0.25rem', // 4px
+    2: '0.5rem', // 8px
+    3: '0.75rem', // 12px
+    4: '1rem', // 16px
+    5: '1.25rem', // 20px
+    6: '1.5rem', // 24px
+    8: '2rem', // 32px
+    10: '2.5rem', // 40px
+    12: '3rem', // 48px
+    16: '4rem', // 64px
+    20: '5rem', // 80px
+};
+/**
+ * Layout constants
+ */
+export const layout = {
+    maxWidth: '1200px',
+    maxWidthNarrow: '1000px',
+    maxWidthWide: '1400px',
+    navHeight: '64px',
+    sidebarWidth: '240px',
+    borderRadius: {
+        sm: '4px',
+        md: '6px',
+        lg: '8px',
+        xl: '12px',
+    },
+    boxShadow: {
+        sm: '0 1px 2px rgba(0, 0, 0, 0.3)',
+        md: '0 2px 8px rgba(0, 0, 0, 0.4)',
+        lg: '0 4px 16px rgba(0, 0, 0, 0.5)',
+    },
+};
+/**
+ * Transitions
+ */
+export const transitions = {
+    fast: '0.1s',
+    normal: '0.2s',
+    slow: '0.3s',
+    ease: 'ease',
+    easeIn: 'ease-in',
+    easeOut: 'ease-out',
+    easeInOut: 'ease-in-out',
+};
+/**
+ * Z-index layers
+ */
+export const zIndex = {
+    base: 0,
+    dropdown: 10,
+    sticky: 100,
+    fixed: 200,
+    modal: 300,
+    popover: 400,
+    tooltip: 500,
+};

package/dist/templates/spa.js

@@ -65,6 +65,9 @@ function generateRoutes() {
 function generateApiTypesDts() {
     return compileTemplate('api/types.d.ts', DEFAULT_CONFIG);
 }
+function generateDockerCompose(config) {
+    return compileTemplate('api/docker-compose.yml', config);
+}
 // ============================================================================
 // SPA Template Generator
 // ============================================================================
@@ -92,6 +95,13 @@ export function generateSpaTemplate(config) {
         { path: 'apps/api/src/routes.ts', content: generateRoutes() },
         { path: 'apps/api/src/types.d.ts', content: generateApiTypesDts() },
     ];
+    // Add docker-compose for PostgreSQL
+    if (config.database === 'postgresql') {
+        files.push({
+            path: 'apps/api/docker-compose.yml',
+            content: generateDockerCompose(config),
+        });
+    }
     // Add root workspace files
     const rootFiles = generateRootFiles(config, false);
     // Add web package files

package/dist/templates/trpc.js

@@ -73,6 +73,9 @@ function generateRoutes() {
 function generateApiTypesDts() {
     return compileTemplate('api/types.d.ts', DEFAULT_CONFIG);
 }
+function generateDockerCompose(config) {
+    return compileTemplate('api/docker-compose.yml', config);
+}
 // ============================================================================
 // tRPC Template Generator
 // ============================================================================
@@ -100,6 +103,13 @@ export function generateTrpcTemplate(config) {
         { path: 'apps/api/src/routes.ts', content: generateRoutes() },
         { path: 'apps/api/src/types.d.ts', content: generateApiTypesDts() },
     ];
+    // Add docker-compose for PostgreSQL
+    if (config.database === 'postgresql') {
+        files.push({
+            path: 'apps/api/docker-compose.yml',
+            content: generateDockerCompose(config),
+        });
+    }
     // Add root workspace files (use false for isAuthTemplate)
     const rootFiles = generateRootFiles(config, false);
     // Add web package files (use false for isAuthTemplate)

package/dist/templates/types.d.ts

@@ -10,8 +10,9 @@
  * - `auth` - SPA + API with JWT authentication
  * - `trpc` - SPA + API with tRPC integration
  * - `rsc` (alias: `fullstack`) - React Server Components with Vinxi
+ * - `rsc-auth` - RSC with JWT authentication and validated() server actions
  */
-export type TemplateType = 'spa' | 'auth' | 'trpc' | 'rsc';
+export type TemplateType = 'spa' | 'auth' | 'trpc' | 'rsc' | 'rsc-auth';
 /**
  * Template aliases for backward compatibility
  */

package/dist/templates/types.js

@@ -92,6 +92,12 @@ export const TEMPLATE_METADATA = {
         description: 'React Server Components with Vinxi + embedded Fastify',
         hint: 'Unified server/client with file-based routing and streaming',
     },
+    'rsc-auth': {
+        type: 'rsc-auth',
+        label: 'RSC + Auth',
+        description: 'RSC with JWT authentication and validated() server actions',
+        hint: 'Full-stack auth with rate limiting, CSRF, and role-based access',
+    },
 };
 /**
  * Get all available template types

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-velox-app",
-  "version": "0.6.31",
+  "version": "0.6.52",
   "description": "Project scaffolder for VeloxTS framework",
   "type": "module",
   "main": "dist/index.js",
@@ -29,8 +29,9 @@
   },
   "devDependencies": {
     "@types/node": "25.0.3",
+    "@vitest/coverage-v8": "4.0.16",
     "typescript": "5.9.3",
-    "vitest": "4.0.15"
+    "vitest": "4.0.16"
   },
   "keywords": [
     "velox",
@@ -59,6 +60,8 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "smoke-test": "./scripts/smoke-test.sh"
+    "test:coverage": "vitest run --coverage",
+    "smoke-test": "./scripts/smoke-test.sh",
+    "verify-publish": "./scripts/verify-publish.sh"
   }
 }

package/src/templates/source/api/config/database.ts

@@ -20,7 +20,6 @@ import type { PrismaBetterSqlite3 as PrismaBetterSqlite3Type } from '@prisma/ada
 import type { PrismaPg as PrismaPgType } from '@prisma/adapter-pg';
 /* @endif postgresql */
 import type { PrismaClient as PrismaClientType } from '@prisma/client';
-import type { Pool as PoolType } from 'pg';
 
 const require = createRequire(import.meta.url);
 /* @if sqlite */
@@ -32,9 +31,6 @@ const { PrismaBetterSqlite3 } = require('@prisma/adapter-better-sqlite3') as {
 const { PrismaPg } = require('@prisma/adapter-pg') as {
   PrismaPg: typeof PrismaPgType;
 };
-const { Pool } = require('pg') as {
-  Pool: typeof PoolType;
-};
 /* @endif postgresql */
 const { PrismaClient } = require('@prisma/client') as {
   PrismaClient: typeof PrismaClientType;
@@ -44,10 +40,6 @@ declare global {
   // Allow global `var` declarations for hot reload in development
   // eslint-disable-next-line no-var
   var __db: PrismaClient | undefined;
-  /* @if postgresql */
-  // eslint-disable-next-line no-var
-  var __pool: InstanceType<typeof PoolType> | undefined;
-  /* @endif postgresql */
 }
 
 /* @if sqlite */
@@ -72,32 +64,24 @@ function createPrismaClient(): PrismaClient {
 /* @endif sqlite */
 /* @if postgresql */
 /**
- * Create a PostgreSQL connection pool.
- * Uses connection pooling for better performance in production.
+ * Create a Prisma client instance using the PostgreSQL adapter.
+ *
+ * Prisma 7 Breaking Change:
+ * - PrismaPg now takes connectionString directly (not a Pool instance)
+ * - Pool management is handled internally by the adapter
  */
-function createPool(): InstanceType<typeof PoolType> {
-  const databaseUrl = process.env.DATABASE_URL;
+function createPrismaClient(): PrismaClient {
+  const connectionString = process.env.DATABASE_URL;
 
-  if (!databaseUrl) {
+  if (!connectionString) {
     throw new Error(
       '[VeloxTS] DATABASE_URL environment variable is not set. ' +
         'Ensure .env file exists with DATABASE_URL defined.'
     );
   }
 
-  return new Pool({
-    connectionString: databaseUrl,
-    max: 10, // Maximum connections in pool
-  });
-}
-
-/**
- * Create a Prisma client instance using the PostgreSQL adapter.
- * Uses connection pooling for efficient database access.
- */
-function createPrismaClient(pool: InstanceType<typeof PoolType>): PrismaClient {
-  // Prisma 7 requires driver adapters for direct connections
-  const adapter = new PrismaPg(pool);
+  // Prisma 7: Pass connectionString directly to PrismaPg (not a Pool)
+  const adapter = new PrismaPg({ connectionString });
   return new PrismaClient({ adapter });
 }
 /* @endif postgresql */
@@ -111,19 +95,16 @@ if (process.env.NODE_ENV !== 'production') {
 }
 /* @endif sqlite */
 /* @if postgresql */
-// Use global singletons for hot reload in development
-const pool = globalThis.__pool ?? createPool();
-export const db = globalThis.__db ?? createPrismaClient(pool);
+// Use global singleton for hot reload in development
+export const db = globalThis.__db ?? createPrismaClient();
 
 if (process.env.NODE_ENV !== 'production') {
-  globalThis.__pool = pool;
   globalThis.__db = db;
 }
 
-// Graceful shutdown - close pool on process exit
+// Graceful shutdown - disconnect Prisma on process exit
 const shutdown = async () => {
   await db.$disconnect();
-  await pool.end();
   process.exit(0);
 };
 

package/src/templates/source/api/docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: __PROJECT_NAME__-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${DATABASE_USER:-user}
+      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
+      POSTGRES_DB: ${DATABASE_NAME:-__PROJECT_NAME__}
+    ports:
+      - "${DATABASE_PORT:-5432}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DATABASE_USER:-user} -d ${DATABASE_NAME:-__PROJECT_NAME__}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_data:

package/src/templates/source/root/CLAUDE.auth.md

@@ -69,6 +69,12 @@ export const postProcedures = procedures('posts', {
 
 Then register in `src/procedures/index.ts` and add to collections in `src/index.ts`.
 
+## Prisma 7 Configuration
+
+This project uses Prisma 7 which has breaking changes:
+- Database URL is configured in `prisma.config.ts`, NOT in `schema.prisma`
+- NEVER add `url` property to the datasource block in `schema.prisma`
+
 ### Frontend Development (apps/web)
 
 **Creating a new route:**

package/src/templates/source/root/CLAUDE.default.md

@@ -68,6 +68,12 @@ export const postProcedures = procedures('posts', {
 
 Then register in `src/procedures/index.ts` and add to collections in `src/index.ts`.
 
+## Prisma 7 Configuration
+
+This project uses Prisma 7 which has breaking changes:
+- Database URL is configured in `prisma.config.ts`, NOT in `schema.prisma`
+- NEVER add `url` property to the datasource block in `schema.prisma`
+
 ### Frontend Development (apps/web)
 
 **Creating a new route:**

package/src/templates/source/rsc/CLAUDE.md

@@ -44,15 +44,69 @@ __PROJECT_NAME__/
 
 ### Server Actions
 - Defined in `app/actions/` with `'use server'` directive
-- Type-safe with Zod validation via `createAction()`
+- Type-safe with Zod validation
 - Can be called directly from client components
 
+### Validated Actions (Recommended)
+Use `validated()` for secure server actions with built-in protection:
+```typescript
+// app/actions/users.ts
+'use server';
+import { validated, validatedMutation, validatedQuery } from '@veloxts/web/server';
+import { z } from 'zod';
+
+// Public query (no auth required)
+export const searchUsers = validatedQuery(
+  z.object({ query: z.string().optional() }),
+  async (input) => {
+    return db.user.findMany({ where: { name: { contains: input.query } } });
+  }
+);
+
+// Protected mutation (requires auth by default)
+export const updateUser = validatedMutation(
+  z.object({ id: z.string(), name: z.string() }),
+  async (input, ctx) => {
+    // ctx.user is typed and available
+    return db.user.update({ where: { id: input.id }, data: input });
+  }
+);
+
+// Custom security options
+export const createUser = validated(
+  CreateUserSchema,
+  async (input) => { /* ... */ },
+  {
+    rateLimit: { maxRequests: 10, windowMs: 60_000 },
+    maxInputSize: 10 * 1024,
+  }
+);
+
+// With role-based authorization
+export const deleteUser = validated(
+  DeleteUserSchema,
+  async (input) => { /* ... */ },
+  {
+    requireAuth: true,
+    requireRoles: ['admin'],
+  }
+);
+```
+
+Security features:
+- **Input validation** - Zod schema validation
+- **Input sanitization** - Prototype pollution prevention
+- **Input size limits** - DoS protection (default 1MB)
+- **Rate limiting** - Sliding window per IP
+- **Authentication** - Optional via `requireAuth: true`
+- **Authorization** - Custom callbacks via `authorize`
+
 ### Procedure Bridge Pattern
 Server actions can bridge to API procedures for code reuse:
 ```typescript
 // app/actions/posts.ts
 'use server';
-import { action } from '@veloxts/web';
+import { action } from '@veloxts/web/server';
 import { postProcedures } from '@/api/procedures/posts';
 
 export const createPost = action.fromProcedure(

package/src/templates/source/rsc/app/actions/posts.ts

@@ -35,7 +35,7 @@
  * ```
  */
 
-import { action } from '@veloxts/web';
+import { action } from '@veloxts/web/server';
 
 import { postProcedures } from '@/api/procedures/posts';