feat: Turso DB, Panda beta.10, shared auth forms

.env.schema

@@ -27,9 +27,7 @@ GITHUB_CLIENT_SECRET=bitwarden("2bd1b17c-d6bb-44c8-8c8a-b421009ee0d6")
 # @sensitive @type=string
 BETTER_AUTH_SECRET=bitwarden("34439671-d4dc-40eb-892a-b421009f3af2")
 
-# PostgreSQL connection string (Neon) — Drizzle ORM, Better Auth adapter, and `db:*` scripts via `varlock run`.
-# Use the *pooled* host (`ep-…-pooler.…aws.neon.tech`) for app/runtime. Prefer `sslmode=verify-full`.
-# Optional: `&connect_timeout=30` if cold starts still ETIMEDOUT during `next build`.
+# Legacy Neon PostgreSQL URL — retained in Bitwarden; unused by app after Turso cutover (Drizzle / Better Auth use TURSO_*).
 # @docs(https://neon.tech/docs/connect/connection-pooling)
 # @docs(https://neon.tech/docs/connect/connect-from-any-app)
 # @sensitive
@@ -39,3 +37,15 @@ DATABASE_URL=bitwarden("a33af111-73f0-49a6-9579-b421009ead1e")
 # @docs("Next.js metadataBase", https://nextjs.org/docs/app/api-reference/functions/generate-metadata#metadatabase)
 # @type=url(noTrailingSlash=true)
 NEXT_PUBLIC_SITE_URL="http://localhost:3000"
+
+# Turso (libSQL) auth token — drizzle-kit / @libsql/client `authToken`. Keep server-only.
+# @docs(https://docs.turso.tech/cli/db/tokens/create)
+# @docs(https://orm.drizzle.team/docs/connect-turso)
+# @sensitive
+TURSO_DATABASE_AUTH=bitwarden("50b36813-35ae-4b68-bcfb-b4900011b5aa")
+
+# Turso database URL (`libsql://…`) — Drizzle ORM, Better Auth adapter, and `db:*` scripts via `varlock run`.
+# @docs(https://docs.turso.tech/quickstart)
+# @docs(https://orm.drizzle.team/docs/connect-turso)
+# @sensitive
+TURSO_DATABASE_URL=bitwarden("c71a565f-a617-4dda-a3a1-b49000113ac5")

.fallowrc.json

@@ -8,12 +8,7 @@
   },
   "ignorePatterns": ["doctor.config.ts"],
   "ignoreDependencies": [
-    "@varlock/bitwarden-plugin",
-    "babel-plugin-react-compiler",
     "next-devtools-mcp",
-    "@pandacss/preset-panda",
-    "@pandacss/types",
-    "react-doctor",
     "@styled-system/css",
     "@styled-system/patterns",
     "@styled-system/recipes"

.gitignore

@@ -5,6 +5,7 @@ node_modules
 .vercel
 .fallow
 .agents
+fallow-viz.html
 
 # TypeScript
 tsconfig.tsbuildinfo

biome.json

@@ -39,7 +39,8 @@
       "!!**/*.lock",
       "!!**/*.svg",
       "!**/drizzle",
-      "!**/src/env.d.ts"
+      "!**/src/env.d.ts",
+      "!fallow-viz.html"
     ]
   }
 }

bunfig.toml

@@ -8,9 +8,26 @@ minimumReleaseAgeExcludes = [
   "next",
   "@next/swc-linux-x64-gnu",
   "@next/swc-linux-x64-musl",
+  "@pandacss/cli",
+  "@pandacss/compiler",
+  "@pandacss/compiler-darwin-arm64",
+  "@pandacss/compiler-darwin-x64",
+  "@pandacss/compiler-linux-arm64-gnu",
+  "@pandacss/compiler-linux-arm64-musl",
+  "@pandacss/compiler-linux-x64-gnu",
+  "@pandacss/compiler-linux-x64-musl",
+  "@pandacss/compiler-shared",
+  "@pandacss/compiler-wasm",
+  "@pandacss/compiler-wasm32-wasi",
+  "@pandacss/compiler-win32-arm64-msvc",
+  "@pandacss/compiler-win32-x64-msvc",
+  "@pandacss/config",
   "@pandacss/dev",
+  "@pandacss/postcss",
   "@pandacss/preset-base",
-  "@pandacss/preset-panda"
+  "@pandacss/preset-panda",
+  "@pandacss/preset-typography",
+  "@pandacss/types",
 ]
 
 [test]

docs/AUTH_SETUP.md

@@ -20,18 +20,22 @@ All environment variables are validated using Valibot in `src/utils/env.ts`. Cre
 # Site Configuration
 NEXT_PUBLIC_SITE_URL="http://localhost:3000"  # or your production URL
 
-# Better Auth Configuration
-AUTH_SECRET="your-secret-key-here-change-this-in-production"
+# Better Auth
+BETTER_AUTH_SECRET="your-secret-key-here-change-this-in-production"
 
 # GitHub OAuth
 GITHUB_CLIENT_ID="your-github-client-id"
 GITHUB_CLIENT_SECRET="your-github-client-secret"
 
-# Database
+# Turso (libSQL)
+TURSO_DATABASE_URL="libsql://your-db.turso.io"
+TURSO_DATABASE_AUTH="your-turso-auth-token"
+
+# Legacy Neon URL (kept in .env.schema; unused by app)
 DATABASE_URL="your-neon-database-connection-string"
 ```
 
-**Note**: The client-side auth client uses `NEXT_PUBLIC_SITE_URL` for `baseURL`.
+**Note**: The client-side auth client uses `NEXT_PUBLIC_SITE_URL` for `baseURL`. Auth tables: `bun run auth:generate` (writes `src/db/schema/auth.ts` from `src/lib/auth.cli.config.ts`), then `bun run db:generate` / `db:migrate`. Runtime auth (secrets, OAuth, cookies) lives in `src/lib/auth.ts` (`server-only`).
 
 ## How to Get GitHub OAuth Credentials
 

docs/VARLOCK.md

@@ -11,7 +11,7 @@ This note summarizes how [Varlock](https://varlock.dev/) fits a Next.js app on *
 
 - **`.env.schema`** as a single, AI-safe description of config (names, types, validation) without exposing secret values.
 - **Validation, optional type generation**, log redaction, `varlock scan` for leaks, and **`varlock run`** to inject resolved env into arbitrary commands.
-- **Next.js**: replaces internal [`@next/env`](https://www.npmjs.com/package/@next/env) loading via **`@varlock/nextjs-integration`** plus a small **`next.config`** plugin.
+- **Next.js**: replaces internal `[@next/env](https://www.npmjs.com/package/@next/env)` loading via **`@varlock/nextjs-integration`** plus a small **`next.config`** plugin.
 
 ## Recommended integration path (high level)
 
@@ -40,8 +40,10 @@ Varlock’s Bitwarden integration targets **Bitwarden Secrets Manager** (organiz
 # @type=bitwardenAccessToken @sensitive
 BITWARDEN_ACCESS_TOKEN=
 
-# Example: load a DB URL from Secrets Manager by secret UUID
-# DATABASE_URL=bitwarden("12345678-1234-1234-1234-123456789abc")
+# Example: load Turso URL from Secrets Manager by secret UUID
+# TURSO_DATABASE_URL=bitwarden("12345678-1234-1234-1234-123456789abc")
+# TURSO_DATABASE_AUTH=bitwarden("12345678-1234-1234-1234-123456789abc")
+# Legacy Neon (unused by app): DATABASE_URL=bitwarden("…")
 ```
 
 Install the package **`@varlock/bitwarden-plugin`** as a dependency, or load the plugin from the schema with a version per the [plugins installation](https://varlock.dev/guides/plugins/#installation) docs.
@@ -98,7 +100,7 @@ Per [Varlock’s Bun docs](https://varlock.dev/integrations/bun/):
 ### Caveats
 
 - **Bootstrap tokens** (e.g. **`BITWARDEN_ACCESS_TOKEN`**) must be present where Varlock runs (local shell, Vercel env, CI). They are not fetched from Bitwarden by magic without configuration.
-- **`varlock run` in production**: The [standalone mode](https://varlock.dev/integrations/nextjs/) section notes that **standalone** output needs copying `.env.*` and running with the **varlock CLI** installed. This repo does **not** use `output: 'standalone'` today; if you add it later, follow Varlock’s standalone instructions.
+- **`varlock run` in production**: The [standalone mode](https://varlock.dev/integrations/nextjs/) section notes that **standalone** output needs copying `.env.`* and running with the **varlock CLI** installed. This repo does **not** use `output: 'standalone'` today; if you add it later, follow Varlock’s standalone instructions.
 - **Branch-based logic**: For finer control than `VERCEL_ENV`, the docs point at **`VERCEL_GIT_COMMIT_REF`** and similar—useful if schema composition depends on branch name.
 
 ## Friction with the **current** tech stack
@@ -123,7 +125,7 @@ Public client vars use **`NEXT_PUBLIC_SITE_URL`** as the canonical app URL. Varl
 
 ### 3. **Tools outside Next: Drizzle, Playwright, scripts**
 
-- **`drizzle.config.ts`** reads **`process.env.DATABASE_URL`** directly. Drizzle CLI does not use `next.config`; ensure **`DATABASE_URL`** is available when running **`drizzle-kit`** (shell env, `.env`, or `varlock run -- bun x drizzle-kit ...`).
+- **`drizzle.config.ts`** reads **`TURSO_DATABASE_URL`** + **`TURSO_DATABASE_AUTH`** via Varlock. Drizzle CLI does not use `next.config`; run kit via **`varlock run -- bun x drizzle-kit ...`** (or the `db:`* scripts). Legacy **`DATABASE_URL`** remains in `.env.schema` unused.
 - **`playwright.config.ts`** and **`tests/setup/test-preload.ts`** set or assume env. After Varlock + optional `bunfig` changes, re-verify **e2e** and **unit** runs.
 - **`db:seed`**, **`db:drop`**, etc. use **`bun --conditions=react-server`**: confirm env loading matches expectations once Bun auto-env is disabled.
 

drizzle.config.ts

@@ -2,11 +2,13 @@
 
 import { defineConfig } from "drizzle-kit";
 import { ENV } from "varlock/env";
+
 export default defineConfig({
   dbCredentials: {
-    url: ENV.DATABASE_URL,
+    authToken: ENV.TURSO_DATABASE_AUTH,
+    url: ENV.TURSO_DATABASE_URL,
   },
-  dialect: "postgresql",
+  dialect: "turso",
   out: "./src/db/migrations",
   schema: "./src/db/schema/*.ts",
   strict: true,