Helal-maker · Helal-maker · Feb 20, 2026 · Feb 20, 2026 · Feb 20, 2026 · Feb 20, 2026
diff --git a/betterbase/README.md b/betterbase/README.md
@@ -27,7 +27,7 @@ From the monorepo root:
 - `bun install`
 - `bun run dev`
 - `bun run build`
-- `bun run typecheck` (runs `turbo run typecheck --filter '*'`)
+- `bun run typecheck` (runs `turbo run typecheck --filter "*"`)
 
 > Note: `templates/base` is not in the root workspace graph (`apps/*`, `packages/*`), so run template checks separately (e.g. `cd templates/base && bun run typecheck`).
 
@@ -41,3 +41,14 @@ From `templates/base`:
 - `bun run build`
 - `bun run start`
 - `bun run typecheck`
+
+
+## CLI Highlights
+
+- `bb auth setup [project-root]` — scaffold BetterAuth tables, middleware, and routes.
+  - Example: `bun run --cwd packages/cli dev auth setup ../../templates/base`
+- `bb generate crud <table-name> [project-root]` — generate CRUD routes for a schema table.
+  - Example: `bun run --cwd packages/cli dev generate crud users ../../templates/base`
+
+Realtime support is built into the base template via `/ws` and `src/lib/realtime.ts`. Generated CRUD routes broadcast insert/update/delete events to subscribers.
+For command details and flags, run `bb --help`, `bb auth --help`, and `bb generate --help`.
diff --git a/betterbase/package.json b/betterbase/package.json
@@ -10,7 +10,7 @@
     "build": "turbo run build",
     "dev": "turbo run dev --parallel",
     "lint": "turbo run lint",
-    "typecheck": "turbo run typecheck --filter '*'"
+    "typecheck": "turbo run typecheck --filter \"*\""
   },
   "devDependencies": {
     "turbo": "^2.0.0",

diff --git a/betterbase/packages/cli/package.json b/betterbase/packages/cli/package.json
@@ -17,7 +17,7 @@
     "commander": "^12.1.0",
     "inquirer": "^10.2.2",
     "zod": "^3.23.8",
-    "typescript": "^5.3.0"
+    "typescript": "^5.8.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.9"

diff --git a/betterbase/packages/cli/src/commands/auth.ts b/betterbase/packages/cli/src/commands/auth.ts
@@ -44,7 +44,20 @@ const loginSchema = z.object({
 });
 
 authRoute.post('/signup', async (c) => {
-  const body = signupSchema.parse(await c.req.json());
+  let rawBody: unknown;
+  try {
+    rawBody = await c.req.json();
+  } catch (err) {
+    const details = err instanceof Error ? err.message : String(err);
+    return c.json({ error: 'Invalid JSON', details }, 400);
+  }
+
+  const result = signupSchema.safeParse(rawBody);
+  if (!result.success) {
+    return c.json({ error: 'Invalid signup payload', details: result.error.format() }, 400);
+  }
+
+  const body = result.data;
   const passwordHash = await Bun.password.hash(body.password);
 
   const created = await db
@@ -56,17 +69,35 @@ authRoute.post('/signup', async (c) => {
     })
     .returning();
 
+  const createdUser = created[0];
+  if (!createdUser || typeof createdUser !== 'object') {
+    return c.json({ error: 'Failed to create user record' }, 500);
+  }
+
   return c.json({
     user: {
-      id: created[0].id,
-      email: created[0].email,
-      name: created[0].name,
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
     },
   }, 201);
 });
 
 authRoute.post('/login', async (c) => {
-  const body = loginSchema.parse(await c.req.json());
+  let rawBody: unknown;
+  try {
+    rawBody = await c.req.json();
+  } catch (err) {
+    const details = err instanceof Error ? err.message : String(err);
+    return c.json({ error: 'Invalid JSON', details }, 400);
+  }
+
+  const result = loginSchema.safeParse(rawBody);
+  if (!result.success) {
+    return c.json({ error: 'Invalid login payload', details: result.error.format() }, 400);
+  }
+
+  const body = result.data;
 
   const user = await db.select().from(users).where(eq(users.email, body.email)).limit(1);
   if (user.length === 0 || !user[0].passwordHash) {
@@ -142,7 +173,16 @@ async function validateSession(token: string): Promise<AuthContext['user'] | nul
 
   if (session.length === 0) return null;
 
-  const user = await db.select().from(users).where(eq(users.id, session[0].userId)).limit(1);
+  const user = await db
+    .select({
+      id: users.id,
+      email: users.email,
+      name: users.name,
+    })
+    .from(users)
+    .where(eq(users.id, session[0].userId))
+    .limit(1);
+
   return user.length > 0 ? user[0] : null;
 }
 
@@ -196,14 +236,99 @@ function ensurePasswordHashColumn(schemaPath: string): void {
     return;
   }
 
-  const usersBlock = current.match(/export\s+const\s+users\s*=\s*sqliteTable\([^]+?\}\);/m);
-  if (!usersBlock) {
+  const usersExportIdx = current.search(/export\s+const\s+users\s*=\s*sqliteTable\s*\(/);
+  if (usersExportIdx === -1) {
     logger.warn('Could not find sqlite users table block; skipping passwordHash injection.');
     return;
   }
 
-  const replacement = usersBlock[0].replace(/\n\}\);$/, "\n  passwordHash: text('password_hash').notNull(),\n});");
-  writeFileSync(schemaPath, current.replace(usersBlock[0], replacement));
+  const callStart = current.indexOf('sqliteTable(', usersExportIdx);
+  if (callStart === -1) {
+    logger.warn('Could not locate sqliteTable call for users; skipping passwordHash injection.');
+    return;
+  }
+
+  let i = callStart;
+  let parenDepth = 0;
+  let inSingle = false;
+  let inDouble = false;
+  let inBacktick = false;
+  let escaped = false;
+
+  while (i < current.length) {
+    const ch = current[i];
+    const next = current[i + 1];
+
+    if (escaped) {
+      escaped = false;
+      i += 1;
+      continue;
+    }
+
+    if ((inSingle || inDouble || inBacktick) && ch === '\\') {
+      escaped = true;
+      i += 1;
+      continue;
+    }
+
+    if (!inDouble && !inBacktick && ch === "'") {
+      if (inSingle && next === "'") {
+        i += 2;
+        continue;
+      }
+      inSingle = !inSingle;
+      i += 1;
+      continue;
+    }
+
+    if (!inSingle && !inBacktick && ch === '"') {
+      inDouble = !inDouble;
+      i += 1;
+      continue;
+    }
+
+    if (!inSingle && !inDouble && ch === '`') {
+      inBacktick = !inBacktick;
+      i += 1;
+      continue;
+    }
+
+    if (inSingle || inDouble || inBacktick) {
+      i += 1;
+      continue;
+    }
+
+    if (ch === '(') {
+      parenDepth += 1;
+    } else if (ch === ')') {
+      parenDepth -= 1;
+      if (parenDepth === 0) {
+        break;
+      }
+    }
+
+    i += 1;
+  }
+
+  if (i >= current.length || parenDepth !== 0) {
+    logger.warn('Could not safely parse users sqliteTable block; skipping passwordHash injection.');
+    return;
+  }
+
+  const statementEnd = current.indexOf(';', i);
+  if (statementEnd === -1) {
+    logger.warn('Could not locate end of users sqliteTable statement; skipping passwordHash injection.');
+    return;
+  }
+
+  const usersBlock = current.slice(usersExportIdx, statementEnd + 1);
+  const replacement = usersBlock.replace(/\n\}\);\s*$/, "\n  passwordHash: text('password_hash').notNull(),\n});");
+  if (replacement === usersBlock) {
+    logger.warn('Could not inject passwordHash into users table; block layout was unexpected.');
+    return;
+  }
+
+  writeFileSync(schemaPath, `${current.slice(0, usersExportIdx)}${replacement}${current.slice(statementEnd + 1)}`);
 }
 
 function ensureAuthInConfig(projectRoot: string): void {
@@ -253,17 +378,31 @@ function ensureRoutesIndexHook(projectRoot: string): void {
   const routesIndexPath = path.join(projectRoot, 'src/routes/index.ts');
   if (!existsSync(routesIndexPath)) return;
 
-  let current = readFileSync(routesIndexPath, 'utf-8');
+  const current = readFileSync(routesIndexPath, 'utf-8');
+  const importAnchor = "import { usersRoute } from './users';";
+  const routeAnchor = "app.route('/api/users', usersRoute);";
+
+  let next = current;
 
-  if (!current.includes("import { authRoute } from './auth';")) {
-    current = current.replace("import { usersRoute } from './users';", "import { usersRoute } from './users';\nimport { authRoute } from './auth';");
+  if (!next.includes("import { authRoute } from './auth';")) {
+    if (next.includes(importAnchor)) {
+      next = next.replace(importAnchor, `${importAnchor}\nimport { authRoute } from './auth';`);
+    } else {
+      logger.warn(`Could not find import anchor in ${routesIndexPath}; skipping auth route import injection.`);
+    }
   }
 
-  if (!current.includes("app.route('/auth', authRoute);")) {
-    current = current.replace("app.route('/api/users', usersRoute);", "app.route('/api/users', usersRoute);\n  app.route('/auth', authRoute);");
+  if (!next.includes("app.route('/auth', authRoute);")) {
+    if (next.includes(routeAnchor)) {
+      next = next.replace(routeAnchor, `${routeAnchor}\n  app.route('/auth', authRoute);`);
+    } else {
+      logger.warn(`Could not find route anchor in ${routesIndexPath}; skipping auth route registration injection.`);
+    }
   }
 
-  writeFileSync(routesIndexPath, current);
+  if (next !== current) {
+    writeFileSync(routesIndexPath, next);
+  }
 }
 
 export async function runAuthSetupCommand(projectRoot: string = process.cwd()): Promise<void> {

diff --git a/betterbase/packages/cli/src/commands/generate.ts b/betterbase/packages/cli/src/commands/generate.ts
@@ -72,19 +72,35 @@ ${updateShape}
 });
 
 ${tableName}Route.get('/', async (c) => {
-  const limit = Number(c.req.query('limit') ?? 50);
-  const offset = Number(c.req.query('offset') ?? 0);
-  const safeLimit = Number.isFinite(limit) && limit >= 0 ? Math.min(limit, 100) : 50;
-  const safeOffset = Number.isFinite(offset) && offset >= 0 ? offset : 0;
+  const DEFAULT_LIMIT = 50;
+  const MAX_LIMIT = 100;
+  const DEFAULT_OFFSET = 0;
+
+  const paginationSchema = z.object({
+    limit: z.coerce.number().int().nonnegative().default(DEFAULT_LIMIT),
+    offset: z.coerce.number().int().nonnegative().default(DEFAULT_OFFSET),
+  });
 
   const queryParams = c.req.query();
-  const sort = queryParams.sort;
+  const paginationResult = paginationSchema.safeParse({
+    limit: queryParams.limit,
+    offset: queryParams.offset,
+  });
 
+  if (!paginationResult.success) {
+    return c.json({ error: 'Invalid pagination params', details: paginationResult.error.format() }, 400);
+  }
+
+  const { limit, offset } = paginationResult.data;
+  const fetchLimit = Math.min(limit, MAX_LIMIT);
+  const sort = queryParams.sort;
   const filters = Object.entries(queryParams).filter(([key, value]) => key !== 'limit' && key !== 'offset' && key !== 'sort' && value !== undefined);
 
   let query = db.select().from(${tableName}).$dynamic();
 
   if (filters.length > 0) {
+    // Security note: by default all table columns are filterable. Consider adding a schema scanner
+    // annotation (e.g., "filterable") and replacing this with an explicit allowlist for sensitive tables.
     const conditions = filters
       .filter(([key]) => key in ${tableName})
       .map(([key, value]) => eq(${tableName}[key as keyof typeof ${tableName}] as never, value as never));
@@ -102,8 +118,13 @@ ${tableName}Route.get('/', async (c) => {
     }
   }
 
-  const items = await query.limit(safeLimit).offset(safeOffset);
-  return c.json({ ${tableName}: items, count: items.length, pagination: { limit: safeLimit, offset: safeOffset } });
+  const items = await query.limit(fetchLimit + 1).offset(offset);
+  const hasMore = items.length > fetchLimit;
+
+  return c.json({
+    ${tableName}: items.slice(0, fetchLimit),
+    pagination: { limit: fetchLimit, offset, hasMore },
+  });
 });
 
 ${tableName}Route.get('/:id', async (c) => {
@@ -185,7 +206,7 @@ function ensureRealtimeUtility(projectRoot: string): void {
   const realtimePath = path.join(projectRoot, 'src/lib/realtime.ts');
   if (existsSync(realtimePath)) return;
 
-  const canonicalRealtimePath = path.resolve(import.meta.dir, '../../../templates/base/src/lib/realtime.ts');
+  const canonicalRealtimePath = path.resolve(import.meta.dir, '../../../../templates/base/src/lib/realtime.ts');
   if (!existsSync(canonicalRealtimePath)) {
     throw new Error(`Canonical realtime template not found at ${canonicalRealtimePath}`);
   }
@@ -195,6 +216,28 @@ function ensureRealtimeUtility(projectRoot: string): void {
 }
 
 async function ensureZodValidatorInstalled(projectRoot: string): Promise<void> {
+  const packageJsonPath = path.join(projectRoot, 'package.json');
+  const modulePath = path.join(projectRoot, 'node_modules', '@hono', 'zod-validator');
+
+  if (existsSync(modulePath)) {
+    return;
+  }
+
+  if (existsSync(packageJsonPath)) {
+    try {
+      const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {
+        dependencies?: Record<string, string>;
+        devDependencies?: Record<string, string>;
+      };
+
+      if (packageJson.dependencies?.['@hono/zod-validator'] || packageJson.devDependencies?.['@hono/zod-validator']) {
+        return;
+      }
+    } catch {
+      // Fall through to install branch.
+    }
+  }
+
   logger.info('Installing @hono/zod-validator...');
   const process = Bun.spawn(['bun', 'add', '@hono/zod-validator'], {
     cwd: projectRoot,