feat: rbac

.claude/skills/auth-patterns/SKILL.md

@@ -64,7 +64,7 @@ import { initAuth } from "@nucleus/auth";
 
 export const auth = initAuth({
   baseUrl: getBaseUrl(),
-  productionUrl: `https://${env.VERCEL_PROJECT_PRODUCTION_URL}`,
+  productionUrl: `https://${env.NEXT_PUBLIC_BASE_URL}`,
   secret: env.AUTH_SECRET,
   socialProviders: {
     google: {
@@ -251,7 +251,7 @@ try {
     password: data.password,
   });
 } catch (error) {
-  if (error instanceof Error) {
+  if (Error.isError(error)) {
     // Handle specific auth errors
     if (error.message.includes("Invalid credentials")) {
       setError("Invalid email or password");

.claude/skills/error-handling-patterns/SKILL.md

@@ -50,7 +50,7 @@ export const userRouter = {
         return result[0];
       } catch (error) {
         // Example of catching a specific database constraint error
-        if (error instanceof Error && error.message.includes('duplicate key')) {
+        if (Error.isError(error) && error.message.includes('duplicate key')) {
           throw new TRPCError({
             code: "CONFLICT",
             message: "A user with this email already exists",
@@ -173,7 +173,7 @@ export async function updateUser(id: string, data: Partial<User>) {
 
     return result[0];
   } catch (error) {
-    if (error instanceof Error) {
+    if (Error.isError(error)) {
       // Handle specific database errors
       if (error.message.includes('foreign key constraint')) {
         throw new Error('Cannot update user: referenced by other records');
@@ -208,7 +208,7 @@ export function LoginForm() {
         callbackURL: "/dashboard",
       });
     } catch (error) {
-      if (error instanceof Error) {
+      if (Error.isError(error)) {
         // Handle specific auth errors
         if (error.message.includes("Invalid credentials")) {
           setError("Invalid email or password");

.claude/skills/nextjs/SKILL.md

@@ -1521,7 +1521,7 @@ try {
 try {
   throw new CustomError('Test error');
 } catch (error) {
-  if (error instanceof Error && error.name === 'CustomError') { // ✅ true
+  if (Error.isError(error) && error.name === 'CustomError') { // ✅ true
     // Handle CustomError
   }
 }

.claude/skills/nextjs/templates/package.json

@@ -10,20 +10,20 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "next": "^16.0.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0"
+    "next": "~16",
+    "react": "~19",
+    "react-dom": "~19"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
-    "typescript": "^5.7.0"
+    "@types/node": "~22",
+    "@types/react": "~19",
+    "@types/react-dom": "~19",
+    "typescript": "~6"
   },
   "optionalDependencies": {
-    "zod": "^3.24.0",
-    "@tailwindcss/vite": "^4.1.0",
-    "tailwindcss": "^4.1.0"
+    "zod": "~4",
+    "@tailwindcss/vite": "~4",
+    "tailwindcss": "~4"
   },
   "engines": {
     "node": ">=20.9.0",

.env.example

@@ -15,7 +15,6 @@ AUTH_SECRET='supersecret'
 REDIS_CONNECTION_STRING=''
 
 # APP
-PORT=''
 NEXT_PUBLIC_BASE_URL=''
 
 # Email
@@ -26,4 +25,7 @@ RESEND_TOKEN=''
 GOOGLE_CLIENT_ID=""
 GOOGLE_CLIENT_SECRET=""
 
+# Comma-separated emails granted the super_admin role on signup / via `pnpm -F @nucleus/db seed`
+SUPER_ADMIN_EMAILS=""
+
 

apps/expo/package.json

@@ -15,17 +15,17 @@
   },
   "dependencies": {
     "@better-auth/expo": "catalog:",
-    "@legendapp/list": "^3.0.2",
+    "@legendapp/list": "^3.0.4",
     "@tanstack/react-query": "catalog:",
     "@trpc/client": "catalog:",
     "@trpc/server": "catalog:",
     "@trpc/tanstack-react-query": "catalog:",
     "better-auth": "catalog:",
-    "expo": "~56.0.9",
-    "expo-constants": "~56.0.17",
-    "expo-dev-client": "~56.0.19",
-    "expo-linking": "~56.0.13",
-    "expo-router": "~56.2.9",
+    "expo": "~56.0.11",
+    "expo-constants": "~56.0.18",
+    "expo-dev-client": "~56.0.20",
+    "expo-linking": "~56.0.14",
+    "expo-router": "~56.2.10",
     "expo-secure-store": "~56.0.4",
     "expo-splash-screen": "~56.0.10",
     "expo-status-bar": "~56.0.4",
@@ -34,13 +34,13 @@
     "nativewind": "5.0.0-preview.2",
     "react": "catalog:react19",
     "react-dom": "catalog:react19",
-    "react-native": "~0.85.3",
+    "react-native": "~0.86.0",
     "react-native-css": "3.0.7",
-    "react-native-gesture-handler": "~3.0.0",
+    "react-native-gesture-handler": "~3.0.1",
     "react-native-reanimated": "~4.4.1",
     "react-native-safe-area-context": "~5.8.0",
     "react-native-screens": "~4.25.2",
-    "react-native-worklets": "~0.9.1",
+    "react-native-worklets": "~0.9.2",
     "superjson": "2.2.6"
   },
   "devDependencies": {

apps/expo/src/utils/api.tsx

@@ -24,7 +24,7 @@ export const trpc = createTRPCOptionsProxy<AppRouter>({
       loggerLink({
         enabled: (opts) =>
           process.env.NODE_ENV === "development" ||
-          (opts.direction === "down" && opts.result instanceof Error),
+          (opts.direction === "down" && Error.isError(opts.result)),
         colorMode: "ansi",
       }),
       httpBatchLink({

apps/nextjs/package.json

@@ -38,7 +38,7 @@
   "devDependencies": {
     "@nucleus/tailwind-config": "workspace:*",
     "@nucleus/tsconfig": "workspace:*",
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "@types/react": "catalog:react19",
     "@types/react-dom": "catalog:react19",
     "dotenv-cli": "^11.0.0",

apps/nextjs/src/app/dashboard/layout.tsx

@@ -1,22 +1,33 @@
 import { SidebarInset, SidebarProvider } from "@nucleus/ui/components/sidebar";
 
+import { getSession } from "@/auth/server";
 import { AppSidebar } from "@/components/app-sidebar";
+import { PermissionsProvider } from "@/components/permissions-provider";
 import { SiteHeader } from "@/components/site-header";
 
 export const description = "A sidebar with a header and a search form.";
 
-export default function DashboardLayout({ children }: { children: React.ReactNode }) {
+export default async function DashboardLayout({ children }: { children: React.ReactNode }) {
+  const session = await getSession();
+  const user = {
+    name: session?.user.name ?? "User",
+    email: session?.user.email ?? "",
+    avatar: session?.user.image ?? "",
+  };
+
   return (
-    <div className="[--header-height:calc(theme(spacing.14))]">
-      <SidebarProvider className="flex flex-col">
-        <SiteHeader />
-        <div className="flex flex-1">
-          <AppSidebar />
-          <SidebarInset>
-            <div className="flex flex-1 flex-col gap-4 p-4">{children}</div>
-          </SidebarInset>
-        </div>
-      </SidebarProvider>
-    </div>
+    <PermissionsProvider permissions={session?.user.permissions ?? []}>
+      <div className="[--header-height:calc(--spacing(14))]">
+        <SidebarProvider className="flex flex-col">
+          <SiteHeader />
+          <div className="flex flex-1">
+            <AppSidebar user={user} />
+            <SidebarInset>
+              <div className="flex flex-1 flex-col gap-4 p-4">{children}</div>
+            </SidebarInset>
+          </div>
+        </SidebarProvider>
+      </div>
+    </PermissionsProvider>
   );
 }

apps/nextjs/src/app/dashboard/media-library/page.tsx

@@ -0,0 +1,5 @@
+const MediaLibraryPage = () => {
+  return <div>MediaLibraryPage</div>;
+};
+
+export default MediaLibraryPage;