create-zerotal 1.1.0 → 1.3.0

package/CHANGELOG.md

@@ -8,6 +8,16 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.3.0] — 2026-08-09
+
+### Changed
+
+- **Scaffolded models use the new composition idiom.** Templates now generate
+  `class User extends Model.using(Authenticatable)` instead of
+  `class User extends BaseModelWith(Authenticatable)`, and plain models extend `Model` rather than
+  `BaseModel` — following the base-class rename in `@zerotal/orm`. Affects the `admin`, `api`,
+  `flow`, `react` and `vue` templates.
+
 ## [1.1.0] — 2026-08-08
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-zerotal",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Create a new Zerotal application",
   "license": "MIT",
   "maturity": "stable",

package/src/scaffold.ts

@@ -13,7 +13,7 @@ export type Template = 'minimal' | 'api' | 'admin' | 'flow' | 'react' | 'vue';
 // "^1.1.0" found for specifier "zerotal"` — the first thing anyone trying the
 // framework saw. `scaffold.test.ts` now asserts the two agree, so CI fails rather
 // than the user's install.
-export const ZT_VERSION = '^1.1.0';
+export const ZT_VERSION = '^1.3.0';
 
 export interface ScaffoldOptions {
   name:     string;

package/templates/admin/app/models/Product.ts

@@ -1,11 +1,11 @@
-import { BaseModel, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 
 /**
  * Something the shop sells. Soft-deleted, so a discontinued product can be
  * restored rather than lost.
  */
 @table("products")
-export class Product extends BaseModel {
+export class Product extends Model {
   static override softDeletes = true;
   static override fillable = ["name", "sku", "description", "price", "stock", "status", "featured"];
 

package/templates/admin/app/models/Setting.ts

@@ -1,11 +1,11 @@
-import { BaseModel, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 
 /**
  * Site-wide configuration — exactly one row, edited through a singular resource
  * rather than a list. See `app/admin/SettingsResource.ts`.
  */
 @table("settings")
-export class Setting extends BaseModel {
+export class Setting extends Model {
   static override fillable = ["siteName", "supportEmail", "ordersOpen"];
 
   @column() siteName!: string;

package/templates/admin/app/models/User.ts

@@ -1,4 +1,4 @@
-import { BaseModelWith, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 import { Authenticatable } from "zerotal/auth";
 
 /**
@@ -6,7 +6,7 @@ import { Authenticatable } from "zerotal/auth";
  * belong to a user.
  */
 @table("users")
-export class User extends BaseModelWith(Authenticatable) {
+export class User extends Model.using(Authenticatable) {
   static override hidden = ["password"];
   static override fillable = ["name", "email", "password", "roles", "avatarUrl"];
 

package/templates/api/app/models/User.ts

@@ -1,7 +1,7 @@
-import { BaseModel, column, table } from 'zerotal/orm';
+import { Model, column, table } from 'zerotal/orm';
 
 @table('users')
-export class User extends BaseModel {
+export class User extends Model {
   // Models guard every attribute by default. List the columns that may be
   // mass-assigned from user input — note `role` is deliberately excluded so a
   // request body cannot escalate privileges via `User.create(ctx.body())`.

package/templates/flow/app/models/User.ts

@@ -1,8 +1,8 @@
-import { BaseModelWith, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 import { Authenticatable } from "zerotal/auth";
 
 /**
- * `BaseModelWith(Authenticatable)`, not a plain `BaseModel`.
+ * `Model.using(Authenticatable)`, not a plain `Model`.
  *
  * The mixin is what brands the class so `authUserModel()` can find it. Without
  * the brand nothing errors and nothing warns — the model saves, queries and
@@ -14,7 +14,7 @@ import { Authenticatable } from "zerotal/auth";
  * reads, and registers the `rememberToken` column that "remember me" needs.
  */
 @table("users")
-export class User extends BaseModelWith(Authenticatable) {
+export class User extends Model.using(Authenticatable) {
   // Models guard every attribute by default. Only these may be mass-assigned
   // from a request body — `role` is deliberately absent, so no amount of extra
   // fields in a form post can promote the account that submitted it.

package/templates/flow/tests/smoke.test.ts.tmpl

@@ -111,7 +111,7 @@ describe('auth', () => {
 
   test('the User model is resolvable by the auth layer', () => {
     // The root cause, asserted directly: `Auth.attempt` finds the user model
-    // through this brand, so a plain `BaseModel` makes every login fail.
+    // through this brand, so a plain `Model` makes every login fail.
     expect(isAuthenticatable(User)).toBe(true);
   });
 

package/templates/react/app/models/User.ts

@@ -1,8 +1,8 @@
-import { BaseModelWith, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 import { Authenticatable } from "zerotal/auth";
 
 /**
- * `BaseModelWith(Authenticatable)`, not a plain `BaseModel`.
+ * `Model.using(Authenticatable)`, not a plain `Model`.
  *
  * The mixin is what brands the class so `authUserModel()` can find it. Without
  * the brand nothing errors and nothing warns — the model saves, queries and
@@ -14,7 +14,7 @@ import { Authenticatable } from "zerotal/auth";
  * reads, and registers the `rememberToken` column that "remember me" needs.
  */
 @table("users")
-export class User extends BaseModelWith(Authenticatable) {
+export class User extends Model.using(Authenticatable) {
   // Models guard every attribute by default. Only these may be mass-assigned
   // from a request body — `role` is deliberately absent, so no amount of extra
   // fields in a form post can promote the account that submitted it.

package/templates/vue/app/models/User.ts

@@ -1,7 +1,7 @@
-import { BaseModel, column, table } from "zerotal/orm";
+import { Model, column, table } from "zerotal/orm";
 
 @table("users")
-export class User extends BaseModel {
+export class User extends Model {
   // Models guard every attribute by default. Only these may be mass-assigned
   // from a request body — `role` is deliberately absent, so no amount of extra
   // fields in a form post can promote the account that submitted it.