feat: Turso DB, Panda beta.10, shared auth forms

[fringe4life]

Summary

🗄️ Migrated database from Neon PostgreSQL to Turso libSQL
🎨 Adopted Panda CSS beta.10 typography + view-transition helpers
✨ Added form-data-to-safe-payload and FormField for auth forms
🔐 Split Better Auth into auth.config.ts for CLI schema generate
📦 Upgraded Next canary.95, nuqs 2.9.1, React Doctor 0.8.1
📝 Synced README badges, structure, and Turso env docs
♻️ Refactored to-action-state into module with typed ActionState
🗑️ Removed vendored panda-presets and global VT CSS from index.css

Closes #38
Closes #39
Closes #40
Closes #41

Test plan

• bun install then bun run env:typegen with Turso env set
• bun run db:push / bun run db:migrate and bun run db:seed against Turso
• Sign up / sign in — shared FormField ViewTransitions between password fields
• Failed validation returns safe allowlisted form payload (no secrets)
• Listing search / likes / pagination still work on SQLite
• bun run type and bun run check
• Visual check: view transitions colocated (no broken VT from removed index.css rules)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 7399800.}

[qodo-code-review]

PR Summary by Qodo

Migrate Drizzle from Neon Postgres to Turso libSQL; share auth form helpers

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 40+ Minutes

AI Description

• Switch Drizzle + Better Auth database layer from Neon Postgres to Turso (libSQL/SQLite).
• Refactor server action state handling to return typed, non-sensitive payload echoes.
• Adopt Panda CSS beta.10 typography + colocated ViewTransition helpers; remove global VT CSS.

Diagram

graph TD
  A["Next.js app"] --> B["Auth (Better Auth)"] --> C["Drizzle ORM"] --> D[("Turso libSQL")]
  A --> E["Server actions"] --> F["ActionState utils"]
  A --> G["Panda CSS + VT"]
  E --> B
  subgraph Legend
    direction LR
    _app["App/UI"] ~~~ _svc["Service/Module"] ~~~ _db[("Database")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep Postgres schema and use Turso Postgres-compatible gateway

• ➕ Fewer schema/dialect changes (timestamps/enums/ilike)
• ➕ Less migration churn for existing production data
• ➖ Not the libSQL/SQLite path; may reduce Turso-native benefits
• ➖ Adds operational complexity and potentially different performance characteristics

2. Introduce a DB abstraction boundary for SQL differences (ilike/enums/timestamps)

• ➕ Easier future provider swaps (SQLite vs Postgres)
• ➕ Concentrates dialect-specific code in one place
• ➖ Extra indirection and maintenance overhead
• ➖ May constrain Drizzle’s type-safe query patterns

3. Use drizzle-orm better-sqlite3 for local + libsql for prod via env switch

• ➕ Fast local dev without network dependency
• ➕ Keeps production on Turso while allowing offline workflows
• ➖ More configuration branches and test matrix
• ➖ Risk of subtle behavior drift between drivers

Recommendation: The PR’s approach is sound for a full Turso/libSQL cutover: it updates Drizzle driver/dialect, rewrites schema primitives to sqlite-friendly types, and adjusts queries (LIKE + COLLATE NOCASE) to match SQLite behavior. The safe ActionState payload refactor is a good security/UX improvement. Main review focus should be validating migration correctness (timestamps/booleans/enums), and verifying search/likes flows under SQLite semantics.

Files changed (50) +1449 / -1099

Enhancement (20) +530 / -219

page.tsxAdopt shared FormField + safe payload echo for sign-in +38/-27

Adopt shared FormField + safe payload echo for sign-in

• Replaces per-field label/error wiring with the new FormField component and adds view transition names per field. Updates preserved input defaults to read from ActionState.payload as a safe object rather than FormData.

src/app/(auth)/signin/page.tsx

page.tsxAdopt shared FormField + safe payload echo for sign-up +53/-41

Adopt shared FormField + safe payload echo for sign-up

• Refactors fields to use FormField for consistent label/error handling and shared ViewTransition names. Preserves name/email from a safe payload object and fixes pending-state CSS display from hidden to none.

src/app/(auth)/signup/page.tsx

form-field.tsxAdd reusable FormField with label, errors, and ViewTransition +50/-0

Add reusable FormField with label, errors, and ViewTransition

• Introduces a shared component that ties together a Label, input via render prop (id), and FieldError. Supports ViewTransition via an optional transitionName and handles disabled state with a fieldset wrapper.

src/components/form/form-field.tsx

submit-button.tsxWrap submit button in ViewTransition for auth flows +22/-19

Wrap submit button in ViewTransition for auth flows

• Adds a ViewTransition wrapper around the submit button so auth page transitions can animate the button consistently while preserving pending spinner behavior.

src/components/form/submit-button.tsx

search-input-transition.tsxColocate search spinner view-transition animations via Panda helpers +25/-6

Colocate search spinner view-transition animations via Panda helpers

• Replaces string-based transition class names with viewTransition() definitions for enter/exit animations. Removes dependency on global VT CSS rules.

src/components/search-input/search-input-transition.tsx

drop-tables.tsRewrite drop-tables script for SQLite/Turso +12/-8

Rewrite drop-tables script for SQLite/Turso

• Removes pg Pool usage and replaces it with Drizzle db.run(sql'...') statements. Disables foreign_keys, drops domain tables plus Better Auth tables and drizzle migrations table, then re-enables foreign_keys.

src/db/drop-tables.ts

index.tsSwitch Drizzle client from pg Pool to libSQL client +6/-18

Switch Drizzle client from pg Pool to libSQL client

• Replaces @vercel/functions attachDatabasePool + node-postgres Pool with @libsql/client createClient and drizzle-orm/libsql. Uses TURSO_DATABASE_URL and TURSO_DATABASE_AUTH from Varlock env.

src/db/index.ts

auth.tsConvert Better Auth tables from pg-core to sqlite-core +35/-20

Convert Better Auth tables from pg-core to sqlite-core

• Rewrites auth schema using sqliteTable/integer booleans and timestamp_ms integers, with SQL defaults for creation timestamps. Keeps indexes and onUpdate behavior for updatedAt.

src/db/schema/auth.ts

likes.tsConvert likes table schema to sqlite-core +5/-5

Convert likes table schema to sqlite-core

• Moves from serial/timestamp to sqlite integer autoincrement and timestamp_ms defaults. Keeps the unique user/model constraint and cascade references.

src/db/schema/likes.ts

models.tsConvert categories/models schema to sqlite-core and text enum +12/-22

Convert categories/models schema to sqlite-core and text enum

• Replaces pgEnum-based category slug with a sqlite text enum backed by the CATEGORIES list. Converts ids to integer autoincrement and dateAdded to timestamp_ms integer with Date default function.

src/db/schema/models.ts

sign-in-action.tsReturn typed ActionState with safe payload echo for sign-in +14/-6

Return typed ActionState with safe payload echo for sign-in

• Introduces typed form schema output types and uses formDataToSafePayload to preserve only non-sensitive fields in ActionState.payload. Updates error handling to return payload object instead of raw FormData.

src/features/auth/actions/sign-in-action.ts

sign-up-action.tsReturn typed ActionState with safe payload echo for sign-up +22/-14

Return typed ActionState with safe payload echo for sign-up

• Adds valibot InferOutput types and uses formDataToSafePayload to avoid echoing passwords via RSC state. Updates ActionState generics to carry safe payload shape alongside success data.

src/features/auth/actions/sign-up-action.ts

auth-card.tsxAdd ViewTransition wrappers and Panda viewTransition for auth card +47/-21

Add ViewTransition wrappers and Panda viewTransition for auth card

• Wraps the auth card, title, and footer in ViewTransition components. Defines footer enter/exit animations via Panda viewTransition helper to replace global CSS.

src/features/auth/components/auth-card.tsx

categories-block-transition.tsxColocate category block transitions via Panda viewTransition +21/-2

Colocate category block transitions via Panda viewTransition

• Replaces string transition names with viewTransition() definitions for enter/exit, removing reliance on global view-transition CSS.

src/features/categories/components/categories-block-transition.tsx

model-card.tsxColocate model card transitions and improve image semantics +24/-3

Colocate model card transitions and improve image semantics

• Uses Panda viewTransition definitions for enter/exit animations and adds a priority prop to prefetch the first few images. Fixes next/image alt to use name rather than description.

src/features/models/components/model-card.tsx

models-grid.tsxPass priority to first N model cards for faster LCP +2/-1

Pass priority to first N model cards for faster LCP

• Updates the card prop builder to receive index and sets priority for the first four model images.

src/features/models/components/models-grid.tsx

likes-count-transition.tsxColocate likes count transitions via Panda viewTransition +33/-2

Colocate likes count transitions via Panda viewTransition

• Defines increase/decrease animations using Panda viewTransition helper and wires them into ViewTransition.update, replacing global CSS class names.

src/features/models/likes/components/likes-count-transition.tsx

pagination-offset-transition.tsxColocate pagination transitions via Panda viewTransition +33/-4

Colocate pagination transitions via Panda viewTransition

• Defines enter/exit left/right animations with viewTransition() and wires them into ViewTransition props instead of global CSS transition names.

src/features/pagination/components/pagination-offset-transition.tsx

auth.config.tsAdd CLI-loadable Better Auth config for schema generation +40/-0

Add CLI-loadable Better Auth config for schema generation

• Extracts Better Auth setup into a new module without server-only so the Better Auth CLI can load it. Switches drizzle adapter provider to sqlite to match Turso/libSQL.

src/lib/auth.config.ts

form-data-to-safe-payload.tsAdd FormData allowlist helper to avoid echoing secrets +36/-0

Add FormData allowlist helper to avoid echoing secrets

• Introduces formDataToSafePayload and SafeFormFields to strip sensitive keys like password/confirmPassword. Enables server actions to return safe, plain-object payloads to clients.

src/utils/to-action-state/form-data-to-safe-payload.ts

Bug fix (3) +6 / -6

page.tsxEnsure listing metadata includes description +1/-0

Ensure listing metadata includes description

• Adds description to generated metadata alongside canonical/openGraph fields to keep metadata complete after refactors.

src/app/3d-models/page.tsx

seed.tsAdjust seed likes count SQL for SQLite +2/-3

Adjust seed likes count SQL for SQLite

• Removes Postgres-specific COUNT(*)::int cast when recomputing likes counts, keeping the correlated subquery as a single round-trip update.

src/db/seed.ts

build-models-where.tsReplace Postgres ilike with SQLite LIKE + NOCASE collation +3/-3

Replace Postgres ilike with SQLite LIKE + NOCASE collation

• Switches search filtering from ilike() to like() with COLLATE NOCASE via sql templating to preserve case-insensitive search semantics under SQLite.

src/features/models/queries/build-models-where.ts

Refactor (9) +44 / -162

index.cssRemove global view-transition animation CSS +0/-98

Remove global view-transition animation CSS

• Deletes the previously global ::view-transition-* animation rules, keeping only the @layer declaration. Transitions are now defined in component code via Panda helpers.

src/app/index.css

field-errors.tsxSwitch ActionState import to new types module +1/-1

Switch ActionState import to new types module

• Updates ActionState type import to the new src/utils/to-action-state/types module after the refactor.

src/components/form/field-errors.tsx

form-error.tsxSwitch ActionState import to new types module +1/-1

Switch ActionState import to new types module

• Updates ActionState type import to the new dedicated types module.

src/components/form/form-error.tsx

sign-out-action.tsUpdate sign-out to use new to-action-state module path +1/-1

Update sign-out to use new to-action-state module path

• Adjusts import to fromErrorToActionState from the refactored module location.

src/features/auth/actions/sign-out-action.ts

toggle-like.tsUpdate likes action imports for new ActionState modules +2/-2

Update likes action imports for new ActionState modules

• Moves fromErrorToActionState/toActionState imports to the new to-action-state module and updates ActionState type import to the types module.

src/features/models/likes/actions/toggle-like.ts

use-heart-like.tsSwitch ActionState type import to new types module +1/-1

Switch ActionState type import to new types module

• Updates the ActionState type import path as part of the to-action-state module refactor.

src/features/models/likes/hooks/use-heart-like.ts

auth.tsRe-export Better Auth from CLI-safe config with server-only boundary +4/-38

Re-export Better Auth from CLI-safe config with server-only boundary

• Replaces inline Better Auth creation with a server-only re-export from auth.config.ts to keep app imports safe while enabling CLI generation.

src/lib/auth.ts

to-action-state.tsRefactor to-action-state to use typed payload object (not FormData) +17/-20

Refactor to-action-state to use typed payload object (not FormData)

• Moves ActionState definition into a types module and updates helpers to accept a typed partial payload object. Improves typing by parameterizing the safe payload shape independently from success data.

src/utils/to-action-state/to-action-state.ts

types.tsAdd shared ActionState generic type definition +17/-0

Add shared ActionState generic type definition

• Defines ActionState<T, U> where U is the safe payload echo shape, enabling consistent typing across server actions and UI components.

src/utils/to-action-state/types.ts

Documentation (4) +332 / -35

README.mdUpdate docs for Turso + Panda beta.10 + auth generate + VT colocation +38/-26

Update docs for Turso + Panda beta.10 + auth generate + VT colocation

• Refreshes badges and tech stack notes for Turso/libSQL, Panda beta.10, and nuqs/Next canary updates. Documents new auth schema generation script and notes that view-transition animations are now colocated via Panda helpers rather than global CSS.

README.md

AUTH_SETUP.mdDocument TURSO_* vars and Better Auth secret naming +8/-4

Document TURSO_* vars and Better Auth secret naming

• Updates env examples to use BETTER_AUTH_SECRET and adds Turso URL/auth token variables. Notes the new auth schema generation step before running Drizzle migrations.

docs/AUTH_SETUP.md

VARLOCK.mdUpdate Varlock guidance for Turso credentials +7/-5

Update Varlock guidance for Turso credentials

• Adjusts examples and caveats to reference TURSO_DATABASE_URL and TURSO_DATABASE_AUTH, and clarifies DATABASE_URL is legacy/unused by the app after cutover.

docs/VARLOCK.md

git-pull-request.mdAdd AI-runnable PR workflow guide +279/-0

Add AI-runnable PR workflow guide

• Introduces a detailed, step-by-step document describing how an AI (or user) should create branches, commit safely, push, and open pull requests using gh.

git-pull-request.md

Other (14) +537 / -677

.env.schemaAdd TURSO_* env vars and mark DATABASE_URL as legacy +13/-3

Add TURSO_* env vars and mark DATABASE_URL as legacy

• Introduces TURSO_DATABASE_URL and TURSO_DATABASE_AUTH entries with docs and sensitivity annotations. Reframes DATABASE_URL as legacy/unused after the Turso cutover.

.env.schema

.fallowrc.jsonTighten fallow ignoreDependencies list +0/-5

Tighten fallow ignoreDependencies list

• Removes several dependencies from the ignore list, keeping the styled-system packages and next-devtools-mcp.

.fallowrc.json

.gitignoreIgnore fallow visualization output +1/-0

Ignore fallow visualization output

• Adds fallow-viz.html to gitignore so generated dependency visualizations don’t get committed.

.gitignore

biome.jsonExclude fallow-viz.html from Biome checks +2/-1

Exclude fallow-viz.html from Biome checks

• Adds fallow-viz.html to formatter ignore patterns to avoid tool noise on generated output.

biome.json

bun.lockLockfile updates for Turso + Panda beta.10 and dependency bumps +125/-166

Lockfile updates for Turso + Panda beta.10 and dependency bumps

• Reflects added @libsql/client and removal of Postgres-related packages. Updates Next canary, React canary, Panda packages, nuqs, and react-doctor versions in the resolved lock.

bun.lock

bunfig.tomlAllow newer Panda packages by minimum release age exceptions +18/-1

Allow newer Panda packages by minimum release age exceptions

• Extends minimumReleaseAgeExcludes to include Panda compiler/config/typography packages to unblock beta.10 toolchain installs.

bunfig.toml

drizzle.config.tsSwitch drizzle-kit to Turso dialect with authToken +4/-2

Switch drizzle-kit to Turso dialect with authToken

• Moves drizzle-kit dbCredentials from DATABASE_URL to TURSO_DATABASE_URL plus TURSO_DATABASE_AUTH. Changes dialect from postgresql to turso.

drizzle.config.ts

lint-staged.config.tsRun unit tests on staged TS/TSX +5/-1

Run unit tests on staged TS/TSX

• Extends the staged TypeScript hook to run bun run test in addition to typecheck and react-doctor.

lint-staged.config.ts

next.config.tsRemove Next experimental viewTransition flag +0/-1

Remove Next experimental viewTransition flag

• Drops experimental.viewTransition configuration, aligning transitions to the React/ViewTransition + Panda helper approach instead.

next.config.ts

package.jsonAdd Turso client, bump Next/nuqs/Panda, add auth:generate script +14/-14

Add Turso client, bump Next/nuqs/Panda, add auth:generate script

• Adds @libsql/client and removes Postgres/pg + @vercel/functions usage. Upgrades Next canary, nuqs, React canary, Panda beta.10 (including preset-typography), and react-doctor; adds auth:generate to regenerate Better Auth Drizzle schema from auth.config.ts.

package.json

panda.config.tsUse official preset-typography and enable Panda treeshaking +4/-2

Use official preset-typography and enable Panda treeshaking

• Replaces vendored typography preset import with @pandacss/preset-typography(). Enables treeshakeDesignSystem to reduce generated CSS/system size.

panda.config.ts

migration.sqlAdd initial SQLite migration for auth + app tables +80/-0

Add initial SQLite migration for auth + app tables

• Creates sqlite tables for Better Auth (user/session/account/verification) plus categories/models/likes, including foreign keys and indexes. Uses integer timestamps and AUTOINCREMENT where applicable.

src/db/migrations/20260723011929_turso_init/migration.sql

snapshot.jsonUpdate Drizzle snapshot to SQLite dialect +244/-472

Update Drizzle snapshot to SQLite dialect

• Switches snapshot dialect from postgres to sqlite and removes Postgres enum definitions in favor of sqlite schema representation.

src/db/migrations/20260723011929_turso_init/snapshot.json

env.d.tsRegenerate typed env schema for TURSO_* vars +27/-9

Regenerate typed env schema for TURSO_* vars

• Updates generated Varlock env typings and docs to include TURSO_DATABASE_URL and TURSO_DATABASE_AUTH. Marks DATABASE_URL as legacy/unused after the Turso cutover.

src/env.d.ts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 8 rules

1. FK toggle lacks finally ✓ Resolved 🐞 Bug ☼ Reliability

Description

src/db/drop-tables.ts disables SQLite foreign_keys but does not guarantee re-enabling if any DROP
statement throws, which can leave the shared connection with constraints disabled for the remainder
of the process. This risks follow-on operations silently violating FK expectations when the script
is run in a long-lived process (tests/REPL/etc.).

Code

src/db/drop-tables.ts[R5-14]

+await db.run(sql`PRAGMA foreign_keys = OFF`);
+await db.run(sql`DROP TABLE IF EXISTS likes`);
+await db.run(sql`DROP TABLE IF EXISTS models`);
+await db.run(sql`DROP TABLE IF EXISTS categories`);
+await db.run(sql`DROP TABLE IF EXISTS session`);
+await db.run(sql`DROP TABLE IF EXISTS account`);
+await db.run(sql`DROP TABLE IF EXISTS verification`);
+await db.run(sql`DROP TABLE IF EXISTS user`);
+await db.run(sql`DROP TABLE IF EXISTS __drizzle_migrations`);
+await db.run(sql`PRAGMA foreign_keys = ON`);

Evidence

The script turns foreign keys off, runs multiple awaited DROP statements, and only turns foreign
keys back on at the end; any thrown error before the final line skips re-enabling.

src/db/drop-tables.ts[5-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`PRAGMA foreign_keys = OFF` is not restored if an intermediate statement throws.

### Issue Context
SQLite foreign-key enforcement is connection-specific; leaving it off can affect subsequent queries on the same `db` instance.

### Fix Focus Areas
- src/db/drop-tables.ts[5-14]

### Suggested fix approach
Wrap the drop sequence with `try/finally`:
- Disable FKs
- `try { ...drop tables... } finally { re-enable FKs }`
Optionally log the error and rethrow after restoring the PRAGMA.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Unguarded auth config module ✓ Resolved 🐞 Bug ⛨ Security

Description

src/lib/auth.config.ts intentionally omits a server-only boundary but reads sensitive ENV secrets;
an accidental import from a client component would bypass the intended server-only wrapper and can
either break the client bundle or risk exposing server-only configuration in the client graph. The
current protection relies on developers always importing from src/lib/auth.ts rather than importing
auth.config.ts directly.

Code

src/lib/auth.config.ts[R9-23]

+/** Better Auth instance — no `server-only` so `auth:generate` CLI can load this file. */
+export const auth = betterAuth({
+  basePath: "/api/auth",
+  baseURL: ENV.NEXT_PUBLIC_SITE_URL,
+  database: drizzleAdapter(db, {
+    provider: "sqlite",
+    schema,
+  }),
+  emailAndPassword: {
+    autoSignIn: true,
+    enabled: true,
+  },
+  experimental: { joins: true },
+  plugins: [openAPI(), nextCookies()], // cookies must be last plugin to avoid issues with cache invalidation
+  secret: ENV.BETTER_AUTH_SECRET,

Evidence

The PR introduces a new auth.config.ts that explicitly avoids server-only while still
referencing sensitive ENV secrets; the server-only protection exists only in the thin re-export
module (auth.ts). The config also imports the DB client which is inherently server-side.

src/lib/auth.config.ts[9-39]
src/lib/auth.ts[1-5]
src/db/index.ts[1-9]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`src/lib/auth.config.ts` is intentionally CLI-loadable (no `server-only`) but it embeds sensitive configuration (`BETTER_AUTH_SECRET`, OAuth secrets) and imports the runtime DB client. This makes it easy for a future refactor to accidentally pull server-only auth configuration into a client dependency graph.

### Issue Context
- The app currently re-exports through `src/lib/auth.ts` which *is* `server-only`, but that protection is bypassed if any code imports `src/lib/auth.config.ts` directly.
- The Better Auth CLI likely does not need the full runtime config (social provider secrets, cookie plugins) to generate schema.

### Fix Focus Areas
- src/lib/auth.config.ts[9-40]
- src/lib/auth.ts[1-5]
- package.json[65-72]

### Suggested fix approach
1. Create a dedicated CLI config module (e.g. `src/lib/auth.cli.config.ts`) that contains only what `auth:generate` needs (typically the `database` adapter + schema) and omits secrets/plugins not required for schema generation.
2. Keep the runtime config behind `src/lib/auth.ts` (`server-only`) and ensure the runtime-only module is the only one that references `ENV.BETTER_AUTH_SECRET` / provider secrets.
3. Update the `auth:generate` script to point at the CLI config file instead of `auth.config.ts`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---