umpordez 1.5.1 → 1.6.2

package/.claude/settings.local.json

@@ -63,7 +63,20 @@
       "Bash(bash -n template/scripts/clean-appledouble.sh)",
       "Bash(bash -n template/scripts/prebuild.sh)",
       "Bash(bash -n template/scripts/run-ios.sh)",
-      "Bash(bash -n template/install.sh)"
+      "Bash(bash -n template/install.sh)",
+      "WebSearch",
+      "Bash(tar -xzf expo-57.0.7.tgz package/bundledNativeModules.json)",
+      "Bash(npm -v)",
+      "Read(//dev/**)",
+      "Bash(npm ls *)",
+      "Bash(LC_ALL=C sed -i '' -e 's/dotenv\\\\.config\\(\\)/dotenv.config\\({ quiet: true }\\)/' apps/api/app.ts apps/site-api/app.ts console/index.ts)",
+      "Bash(LC_ALL=C sed -i '' -e \"s/dotenv\\\\.config\\({ path: path.resolve\\(dirname, '.env'\\) }\\)/dotenv.config\\({ path: path.resolve\\(dirname, '.env'\\), quiet: true }\\)/\" core/knexfile.ts)",
+      "Bash(npx eslint *)",
+      "Bash(ln -sfn /private/tmp/claude-501/-Users-ligeiro-dev-umpordez-cli/12177a90-5ebe-47b5-977f-9bb132141080/scratchpad/acme/server/node_modules /Users/ligeiro/dev/umpordez-cli/template/server/node_modules)",
+      "Bash(rm -f tailwind.config.ts postcss.config.js)",
+      "Bash(cp ../../server/eslint.config.js eslint.config.js)",
+      "Bash(ln -sfn /private/tmp/claude-501/-Users-ligeiro-dev-umpordez-cli/12177a90-5ebe-47b5-977f-9bb132141080/scratchpad/acme/ui/admin/node_modules /Users/ligeiro/dev/umpordez-cli/template/ui/admin/node_modules)",
+      "Bash(awk '{print $2}')"
     ]
   }
 }

package/create.mjs

@@ -126,7 +126,7 @@ async function promptComponents() {
         ));
     } else if (site && mobile && adminUi) {
         const { landing } = await inquirer.prompt([{
-            type: 'list',
+            type: 'select',
             name: 'landing',
             message: 'Landing page flavor:',
             choices: [
@@ -298,7 +298,7 @@ async function promptProjectDetails() {
             filter: (v) => v.trim().startsWith('#') ? v.trim() : `#${v.trim()}`,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'defaultTheme',
             message: 'Default theme:',
             choices: [
@@ -340,7 +340,7 @@ async function promptProjectDetails() {
                 : 'Lowercase alphanumeric, dashes allowed',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'splashStyle',
             message: 'Splash screen:',
             choices: [

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "umpordez",
     "type": "module",
-    "version": "1.5.1",
+    "version": "1.6.2",
     "description": "SaaS starter kit generator — server, admin SPA, public site (i18n), mobile app (offline-first, IAP, native push)",
     "main": "cli.mjs",
     "scripts": {
@@ -24,9 +24,9 @@
     },
     "homepage": "https://github.com/umpordez/cli#readme",
     "dependencies": {
-        "chalk": "^5.4.1",
-        "figlet": "^1.8.2",
-        "inquirer": "^12.7.0",
-        "sharp": "^0.33.5"
+        "chalk": "^5.6.2",
+        "figlet": "^1.11.2",
+        "inquirer": "^14.0.2",
+        "sharp": "^0.35.3"
     }
 }

package/template/.github/copilot-instructions.md

@@ -9,7 +9,7 @@ Multi-tenant SaaS application built with the **umpordez** architecture pattern f
 ## Tech Stack
 
 - **Backend:** TypeScript, Express.js, PostgreSQL, Knex.js, Zod
-- **Admin UI:** React 18, Vite, TailwindCSS, shadcn/ui (Radix), React Router DOM 6, TanStack Query v5, React Hook Form + Zod
+- **Admin UI:** React 19, Vite 8, TailwindCSS v4, shadcn/ui (Radix), React Router DOM 7, TanStack Query v5
 - **Site UI:** Express + EJS + TailwindCSS
 - **Auth:** httpOnly JWT cookies (30-day expiry)
 - **Uploads:** AWS S3 via multer-s3 with signed URLs

package/template/AGENTS.md

@@ -59,7 +59,7 @@ ui/site/               Public marketing site (Express + EJS, port 3000)
 ## Tech Stack
 
 - **Backend:** TypeScript, Express.js, PostgreSQL, Knex.js, Zod
-- **Admin UI:** React 18, Vite, TailwindCSS, shadcn/ui (Radix), React Router DOM 6, React Query (TanStack Query v5), React Hook Form + Zod, Recharts
+- **Admin UI:** React 19, Vite 8, TailwindCSS v4, shadcn/ui (Radix), React Router DOM 7, React Query (TanStack Query v5)
 - **Site UI:** Express + EJS + TailwindCSS
 - **Auth:** httpOnly JWT cookies (30-day expiry)
 - **Uploads:** AWS S3 via multer-s3 with signed URLs

package/template/mobile/{{PROJECT_SLUG}}/README.md

@@ -6,11 +6,26 @@ typed fetch client pointed at the project's admin API.
 
 ## Quick start
 
+**This is a development-build app, not an Expo Go app.** It ships
+native modules (Apple Sign-In, `expo-build-properties`, and optionally
+`expo-iap`) and rides the newest Expo SDK, so the public Expo Go from
+the App Store either won't run it (`"requires a newer version of Expo
+Go"` right after an SDK release) or crashes on a native import. Use a
+development build instead — `expo-dev-client` is already a dependency:
+
 ```bash
 npm install
-npm run start          # Metro + QR — open with Expo Go for the JS-only flow
-npm run ios            # build + run on iOS (requires Xcode)
+npm run ios            # build + run a dev client on iOS (requires Xcode)
 npm run android        # build + run on Android (requires Android Studio)
+npm run start          # Metro — connect from an installed dev build
+```
+
+Need a device build without Xcode/Android Studio, or want the Expo Go
+experience on the current SDK? Use EAS-hosted Expo Go, which always
+matches the SDK you target (unlike the store build):
+
+```bash
+npx eas go             # installs a matching Expo Go for this SDK
 ```
 
 For a clean iOS run that picks a connected device automatically:

package/template/mobile/{{PROJECT_SLUG}}/package.json

@@ -9,7 +9,7 @@
         "ios": "expo run:ios",
         "web": "expo start --web",
         "prebuild": "bash ../../scripts/prebuild.sh",
-        "lint": "eslint src --ext .ts,.tsx",
+        "lint": "eslint \"src/**/*.{ts,tsx}\"",
         "typecheck": "tsc --noEmit"
     },
     "expo": {
@@ -20,41 +20,39 @@
     "dependencies": {
         "@noble/hashes": "^2.2.0",
         "@react-native-async-storage/async-storage": "2.2.0",
-        "@react-navigation/bottom-tabs": "^7.7.3",
-        "@react-navigation/native": "^7.1.19",
-        "@react-navigation/native-stack": "^7.6.2",
-        "expo": "~57.0.4",
-        "expo-apple-authentication": "~57.0.0",
-        "expo-auth-session": "~57.0.2",
-        "expo-build-properties": "~57.0.3",
-        "expo-constants": "~57.0.3",
-        "expo-file-system": "~57.0.0",{{IAP_DEP_JSON}}
-        "expo-linking": "~57.0.2",
-        "expo-localization": "~57.0.0",
-        "expo-splash-screen": "~57.0.2",
-        "expo-sqlite": "~57.0.0",
-        "expo-status-bar": "~57.0.0",
-        "expo-system-ui": "~57.0.0",
-        "expo-web-browser": "~57.0.0",
-        "i18next": "^23.16.5",
-        "lucide-react-native": "^1.24.0",
+        "@react-navigation/bottom-tabs": "^7.18.11",
+        "@react-navigation/native": "^7.3.11",
+        "@react-navigation/native-stack": "^7.18.3",
+        "expo": "~57.0.7",
+        "expo-apple-authentication": "~57.0.1",
+        "expo-build-properties": "~57.0.6",
+        "expo-constants": "~57.0.6",
+        "expo-dev-client": "~57.0.7",
+        "expo-file-system": "~57.0.1",{{IAP_DEP_JSON}}
+        "expo-localization": "~57.0.1",
+        "expo-splash-screen": "~57.0.4",
+        "expo-sqlite": "~57.0.1",
+        "expo-system-ui": "~57.0.1",
+        "expo-web-browser": "~57.0.1",
+        "i18next": "^23.16.8",
+        "lucide-react-native": "^1.25.0",
         "react": "19.2.3",
         "react-native": "0.86.0",
-        "react-i18next": "^15.1.1",
+        "react-i18next": "^15.7.4",
         "react-native-gesture-handler": "~2.32.0",
         "react-native-reanimated": "4.5.0",
         "react-native-safe-area-context": "~5.7.0",
         "react-native-screens": "4.25.2",
         "react-native-svg": "15.15.4",
-        "react-native-toast-message": "^2.3.3",
+        "react-native-toast-message": "^2.4.0",
         "react-native-worklets": "0.10.0"
     },
     "devDependencies": {
-        "@stylistic/eslint-plugin": "^2.13.0",
+        "@stylistic/eslint-plugin": "^5.10.0",
         "@types/react": "~19.2.2",
-        "babel-preset-expo": "~57.0.2",
-        "eslint": "^9.20.1",
+        "babel-preset-expo": "~57.0.3",
+        "eslint": "^10.7.0",
         "typescript": "~5.9.3",
-        "typescript-eslint": "^8.24.0"
+        "typescript-eslint": "^8.64.0"
     }
 }

package/template/server/apps/api/app.ts

@@ -1,5 +1,5 @@
 import dotenv from 'dotenv';
-dotenv.config();
+dotenv.config({ quiet: true });
 
 import express from 'express';
 import cors from 'cors';

package/template/server/apps/api/routes/account.ts

@@ -1,20 +1,22 @@
 import type { Express, Request, Response } from 'express';
 import express from 'express';
 import { z } from 'zod';
-import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import trySetUserByTokenMiddleware
+    from '#shared/middlewares/try-set-user-by-token.js';
 import demandUserMiddleware from '#shared/middlewares/demand-user.js';
-import demandAccountAccessMiddleware from '#shared/middlewares/demand-account-access.js';
+import demandAccountAccessMiddleware
+    from '#shared/middlewares/demand-account-access.js';
 import { buildHandler } from '#shared/utils.js';
 
 const router = express.Router();
 
 const updateSettingsSchema = z.object({
     name: z.string().min(1, 'Nome é obrigatório'),
-    settings: z.record(z.unknown()).optional()
+    settings: z.record(z.string(), z.unknown()).optional()
 });
 
 const addMemberSchema = z.object({
-    email: z.string().email('Email inválido'),
+    email: z.email('Email inválido'),
     role: z.enum(['owner', 'manager', 'user']).default('user'),
     name: z.string().min(1).optional(),
     password: z.string().min(6).optional()
@@ -41,14 +43,21 @@ async function handleGetSettings(req: Request, res: Response): Promise<void> {
     res.json({ ok: true, account });
 }
 
-async function handleUpdateSettings(req: Request, res: Response): Promise<void> {
+async function handleUpdateSettings(
+    req: Request,
+    res: Response
+): Promise<void> {
     const data = updateSettingsSchema.parse(req.body);
     const account = await req.context.account.update(req.accountId!, data);
     res.json({ ok: true, account });
 }
 
 async function handleDeleteAccount(req: Request, res: Response): Promise<void> {
-    await req.context.account.delete(req.accountId!, req.user!.id, req.accountRole!);
+    await req.context.account.delete(
+        req.accountId!,
+        req.user!.id,
+        req.accountRole!
+    );
     res.json({ ok: true });
 }
 
@@ -57,7 +66,10 @@ async function handleListMembers(req: Request, res: Response): Promise<void> {
     const limit = parseInt(req.query.limit as string) || 20;
     const search = (req.query.search as string) || '';
 
-    const result = await req.context.account.listMembers(req.accountId!, { page, limit, search });
+    const result = await req.context.account.listMembers(
+        req.accountId!,
+        { page, limit, search }
+    );
     res.json({ ok: true, ...result });
 }
 
@@ -67,14 +79,24 @@ async function handleAddMember(req: Request, res: Response): Promise<void> {
     res.json({ ok: true, member });
 }
 
-async function handleUpdateMemberRole(req: Request, res: Response): Promise<void> {
+async function handleUpdateMemberRole(
+    req: Request,
+    res: Response
+): Promise<void> {
     const { role } = updateMemberRoleSchema.parse(req.body);
-    await req.context.account.updateMemberRole(req.accountId!, (req.params.userId as string), role);
+    await req.context.account.updateMemberRole(
+        req.accountId!,
+        req.params.userId as string,
+        role
+    );
     res.json({ ok: true });
 }
 
 async function handleRemoveMember(req: Request, res: Response): Promise<void> {
-    await req.context.account.removeMember(req.accountId!, (req.params.userId as string));
+    await req.context.account.removeMember(
+        req.accountId!,
+        req.params.userId as string
+    );
     res.json({ ok: true });
 }
 

package/template/server/apps/api/routes/admin.ts

@@ -1,25 +1,29 @@
 import type { Express, Request, Response } from 'express';
 import express from 'express';
 import { z } from 'zod';
-import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import trySetUserByTokenMiddleware
+    from '#shared/middlewares/try-set-user-by-token.js';
 import demandUserMiddleware from '#shared/middlewares/demand-user.js';
-import demandAdminUserMiddleware from '#shared/middlewares/demand-admin-user.js';
+import demandAdminUserMiddleware
+    from '#shared/middlewares/demand-admin-user.js';
 import { buildHandler } from '#shared/utils.js';
 
 const router = express.Router();
 
 const createUserSchema = z.object({
     name: z.string().min(1, 'Nome é obrigatório'),
-    email: z.string().email('Email inválido'),
+    email: z.email('Email inválido'),
     password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres'),
     role: z.enum(['admin', 'user']).default('user')
 });
 
 const updateUserSchema = z.object({
     name: z.string().min(1, 'Nome é obrigatório'),
-    email: z.string().email('Email inválido'),
+    email: z.email('Email inválido'),
     role: z.enum(['admin', 'user']).optional(),
-    password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres').optional()
+    password: z.string()
+        .min(6, 'Senha deve ter no mínimo 6 caracteres')
+        .optional()
 });
 
 async function handleGetDashboard(req: Request, res: Response): Promise<void> {
@@ -53,7 +57,10 @@ async function handleCreateUser(req: Request, res: Response): Promise<void> {
 
 async function handleUpdateUser(req: Request, res: Response): Promise<void> {
     const data = updateUserSchema.parse(req.body);
-    const user = await req.context.user.adminUpdate((req.params.id as string), data);
+    const user = await req.context.user.adminUpdate(
+        req.params.id as string,
+        data
+    );
     res.json({ ok: true, user });
 }
 

package/template/server/apps/api/routes/auth.ts

@@ -1,7 +1,8 @@
 import type { Express, Request, Response } from 'express';
 import express from 'express';
 import { z } from 'zod';
-import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import trySetUserByTokenMiddleware
+    from '#shared/middlewares/try-set-user-by-token.js';
 import demandUserMiddleware from '#shared/middlewares/demand-user.js';
 import { buildHandler } from '#shared/utils.js';
 import { ForbiddenError, ValidationError } from '#core/errors.js';
@@ -18,7 +19,9 @@ const router = express.Router();
 const COOKIE_OPTIONS = {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
-    sameSite: (process.env.NODE_ENV === 'production' ? 'strict' : 'lax') as 'strict' | 'lax',
+    sameSite: (process.env.NODE_ENV === 'production'
+        ? 'strict'
+        : 'lax') as 'strict' | 'lax',
     maxAge: 30 * 24 * 60 * 60 * 1000,
     path: '/'
 };
@@ -32,19 +35,19 @@ function clearAuthCookie(res: Response): void {
 }
 
 const loginSchema = z.object({
-    email: z.string().email('Email inválido'),
+    email: z.email('Email inválido'),
     password: z.string().min(1, 'Senha é obrigatória')
 });
 
 const signupSchema = z.object({
-    email: z.string().email('Email inválido'),
+    email: z.email('Email inválido'),
     password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres'),
     name: z.string().min(1, 'Nome é obrigatório'),
     account_name: z.string().optional()
 });
 
 const forgotPasswordSchema = z.object({
-    email: z.string().email('Email inválido')
+    email: z.email('Email inválido')
 });
 
 const resetPasswordSchema = z.object({
@@ -53,12 +56,13 @@ const resetPasswordSchema = z.object({
 
 const updateProfileSchema = z.object({
     name: z.string().min(1, 'Nome é obrigatório'),
-    email: z.string().email('Email inválido')
+    email: z.email('Email inválido')
 });
 
 const changePasswordSchema = z.object({
     current_password: z.string().min(1, 'Senha atual é obrigatória'),
-    new_password: z.string().min(6, 'Nova senha deve ter no mínimo 6 caracteres')
+    new_password: z.string()
+        .min(6, 'Nova senha deve ter no mínimo 6 caracteres')
 });
 
 const avatarUpload = createS3Upload({
@@ -67,18 +71,30 @@ const avatarUpload = createS3Upload({
     maxFileSize: 2 * 1024 * 1024, // 2MB
 });
 
-async function resolveAvatarUrl(avatarKey: string | null): Promise<string | null> {
-    if (!avatarKey) return null;
+async function resolveAvatarUrl(
+    avatarKey: string | null
+): Promise<string | null> {
+    if (!avatarKey) {
+        return null;
+    }
     return generateSignedUrl(avatarKey, 3600);
 }
 
-async function userWithAvatar(user: any) {
+interface UserRow {
+    id: string;
+    email: string;
+    name: string;
+    role: string;
+    avatar_key?: string | null;
+}
+
+async function userWithAvatar(user: UserRow) {
     return {
         id: user.id,
         email: user.email,
         name: user.name,
         role: user.role,
-        avatar_url: await resolveAvatarUrl(user.avatar_key)
+        avatar_url: await resolveAvatarUrl(user.avatar_key ?? null)
     };
 }
 
@@ -115,7 +131,8 @@ async function handleLogin(req: Request, res: Response): Promise<void> {
 }
 
 async function handleSignup(req: Request, res: Response): Promise<void> {
-    const { email, password, name, account_name } = signupSchema.parse(req.body);
+    const { email, password, name, account_name } =
+        signupSchema.parse(req.body);
     const result = await req.context.auth.signup({
         email, password, name, accountName: account_name
     });
@@ -124,7 +141,8 @@ async function handleSignup(req: Request, res: Response): Promise<void> {
         res.json({
             ok: true,
             existingUser: true,
-            message: 'Uma nova conta foi criada. Como seu email já estava cadastrado, faça login para acessá-la.'
+            message: 'Uma nova conta foi criada. Como seu email '
+                + 'já estava cadastrado, faça login para acessá-la.'
         });
         return;
     }
@@ -366,20 +384,35 @@ async function handleGoogleCallback(
     );
 }
 
-async function handleForgotPassword(req: Request, res: Response): Promise<void> {
+async function handleForgotPassword(
+    req: Request,
+    res: Response
+): Promise<void> {
     const { email } = forgotPasswordSchema.parse(req.body);
     await req.context.auth.forgotPassword(email);
-    res.json({ ok: true, message: 'Se o email existir, você receberá um link de recuperação' });
+    res.json({
+        ok: true,
+        message: 'Se o email existir, você receberá um link de '
+            + 'recuperação'
+    });
 }
 
-async function handleValidateResetToken(req: Request, res: Response): Promise<void> {
-    const valid = await req.context.auth.validateResetToken((req.params.token as string));
+async function handleValidateResetToken(
+    req: Request,
+    res: Response
+): Promise<void> {
+    const valid = await req.context.auth.validateResetToken(
+        req.params.token as string
+    );
     res.json({ ok: valid });
 }
 
 async function handleResetPassword(req: Request, res: Response): Promise<void> {
     const { password } = resetPasswordSchema.parse(req.body);
-    await req.context.auth.resetPassword((req.params.token as string), password);
+    await req.context.auth.resetPassword(
+        req.params.token as string,
+        password
+    );
     res.json({ ok: true, message: 'Senha alterada com sucesso' });
 }
 
@@ -402,7 +435,12 @@ async function handleAuth(req: Request, res: Response): Promise<void> {
         throw new ForbiddenError('Acesso negado a esta conta');
     }
 
-    res.json({ ok: true, user, account: userAccount.account, role: userAccount.role });
+    res.json({
+        ok: true,
+        user,
+        account: userAccount.account,
+        role: userAccount.role
+    });
 }
 
 async function handleGetAccounts(req: Request, res: Response): Promise<void> {
@@ -412,13 +450,24 @@ async function handleGetAccounts(req: Request, res: Response): Promise<void> {
 
 async function handleUpdateProfile(req: Request, res: Response): Promise<void> {
     const { name, email } = updateProfileSchema.parse(req.body);
-    const user = await req.context.user.updateProfile(req.user!.id, { name, email });
+    const user = await req.context.user.updateProfile(
+        req.user!.id,
+        { name, email }
+    );
     res.json({ ok: true, user });
 }
 
-async function handleChangePassword(req: Request, res: Response): Promise<void> {
-    const { current_password, new_password } = changePasswordSchema.parse(req.body);
-    await req.context.auth.changePassword(req.user!.id, current_password, new_password);
+async function handleChangePassword(
+    req: Request,
+    res: Response
+): Promise<void> {
+    const { current_password, new_password } =
+        changePasswordSchema.parse(req.body);
+    await req.context.auth.changePassword(
+        req.user!.id,
+        current_password,
+        new_password
+    );
     res.json({ ok: true, message: 'Senha alterada com sucesso' });
 }
 
@@ -470,12 +519,43 @@ router.post('/forgot-password', buildHandler(handleForgotPassword));
 router.get('/reset-password/:token', buildHandler(handleValidateResetToken));
 router.post('/reset-password/:token', buildHandler(handleResetPassword));
 
-router.get('/auth', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleAuth));
-router.get('/user/accounts', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleGetAccounts));
-router.post('/user/update-profile', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleUpdateProfile));
-router.post('/user/change-password', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleChangePassword));
-router.post('/user/avatar', trySetUserByTokenMiddleware, demandUserMiddleware, avatarUpload.single('avatar'), buildHandler(handleUploadAvatar));
-router.delete('/user/avatar', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleDeleteAvatar));
+router.get(
+    '/auth',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    buildHandler(handleAuth)
+);
+router.get(
+    '/user/accounts',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    buildHandler(handleGetAccounts)
+);
+router.post(
+    '/user/update-profile',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    buildHandler(handleUpdateProfile)
+);
+router.post(
+    '/user/change-password',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    buildHandler(handleChangePassword)
+);
+router.post(
+    '/user/avatar',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    avatarUpload.single('avatar'),
+    buildHandler(handleUploadAvatar)
+);
+router.delete(
+    '/user/avatar',
+    trySetUserByTokenMiddleware,
+    demandUserMiddleware,
+    buildHandler(handleDeleteAvatar)
+);
 
 export default function makeEndpoint(app: Express): void {
     app.use('/api', router);

package/template/server/apps/api/routes/files.ts

@@ -1,9 +1,15 @@
 import type { Express, Request, Response } from 'express';
 import express from 'express';
-import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import trySetUserByTokenMiddleware
+    from '#shared/middlewares/try-set-user-by-token.js';
 import demandUserMiddleware from '#shared/middlewares/demand-user.js';
 import { buildHandler } from '#shared/utils.js';
-import { createS3Upload, generateSignedUrl, extractS3Key, downloadFromS3 } from '#core/s3.js';
+import {
+    createS3Upload,
+    generateSignedUrl,
+    extractS3Key,
+    downloadFromS3
+} from '#core/s3.js';
 import { ValidationError, NotFoundError } from '#core/errors.js';
 
 const router = express.Router();
@@ -16,7 +22,8 @@ const upload = createS3Upload({
         'image/png',
         'image/jpg',
         'application/msword',
-        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        'application/vnd.openxmlformats-officedocument'
+            + '.wordprocessingml.document',
         'application/vnd.ms-excel',
         'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
     ],
@@ -60,8 +67,10 @@ async function handleGetSignedUrl(req: Request, res: Response): Promise<void> {
 }
 
 async function handleDownload(req: Request, res: Response): Promise<void> {
+    // Express 5 wildcard params arrive as an array of path
+    // segments — rejoin them into the S3 key.
     const rawKey = req.params.key;
-    const key = Array.isArray(rawKey) ? rawKey[0] : rawKey;
+    const key = Array.isArray(rawKey) ? rawKey.join('/') : rawKey;
 
     if (!key) {
         throw new ValidationError('Chave do arquivo é obrigatória');
@@ -81,7 +90,7 @@ async function handleDownload(req: Request, res: Response): Promise<void> {
 
 router.post('/upload', upload.single('file'), buildHandler(handleUpload));
 router.get('/signed-url', buildHandler(handleGetSignedUrl));
-router.get('/download/:key(*)', buildHandler(handleDownload));
+router.get('/download/*key', buildHandler(handleDownload));
 
 export default function makeEndpoint(app: Express): void {
     app.use(

package/template/server/apps/api/routes/health.ts

@@ -15,9 +15,9 @@ const router = express.Router();
 // events at once.
 const eventSchema = z.object({
     kind: z.string().min(1).max(64),
-    occurredAt: z.string().datetime(),
+    occurredAt: z.iso.datetime(),
     durationMs: z.number().int().nonnegative().optional(),
-    payload: z.record(z.unknown()).optional()
+    payload: z.record(z.string(), z.unknown()).optional()
 });
 
 const syncSchema = z.object({

package/template/server/apps/api/routes/user.ts

@@ -1,6 +1,7 @@
 import type { Express } from 'express';
 import express from 'express';
-import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import trySetUserByTokenMiddleware
+    from '#shared/middlewares/try-set-user-by-token.js';
 import demandUserMiddleware from '#shared/middlewares/demand-user.js';
 
 const router = express.Router();