@akanjs/cli 3.0.0-beta.2 → 3.0.0-beta.20

package/templates/appSample/lib/__scalar/workHistory/workHistory.abstract.ts

@@ -3,45 +3,14 @@ import type { AppInfo, LibInfo } from "akanjs";
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
   return {
     filename: "workHistory.abstract.md",
-    content: `# WorkHistory Scalar Abstract
-
-## Akan.js Module Pattern
-
-WorkHistory is a **scalar module** — a reusable value type under lib/__scalar/.
-Scalar modules are embedded into models via field([ScalarType]), not stored independently.
-They live under the double-underscore prefix to distinguish them from database models.
-
-Standard scalar layers:
-- workHistory.constant.ts — enum (WorkHistoryAction) + entry class (WorkHistory) defined via via() + enumOf()
-- workHistory.dictionary.ts — i18n via scalarDictionary() (fewer layers than modelDictionary)
-- workHistory.abstract.md — embedding rules and intent
-
-## Convention: lib/__scalar/<type>/ directory naming
-
-- Scalar modules use double-underscore prefix: lib/__scalar/workHistory/
-- Files drop the underscores: workHistory.constant.ts, not __workHistory.constant.ts
-- Models embed scalars via field([WorkHistory]) — list-of-scalar embedding
-
-## Embedding Example (in task.constant.ts)
-
-TaskObject embeds a list of WorkHistory:
-  import { WorkHistory } from "../../__scalar/workHistory/workHistory.constant";
-  export class TaskObject extends via(TaskInput, (field) => ({
-    workHistory: field([WorkHistory]),
-  }))
-
-Each status change (create, start, complete) pushes a new entry.
-
-## Agent Notes
-
-- Read this abstract before modifying the WorkHistory scalar.
-- Update when new action types or fields are added.
-- Do not duplicate workHistory fields in individual models; always reuse this scalar.
-
-## Related Modules
-
-- lib/task/ — database module embedding workHistory as a list field
-- lib/_noti/ — pure service module (different module type, no scalar usage)
+    content: `# workHistory Abstract
+One step in a task's history: which move happened, when, and an optional note.
+
+## Rules
+- Entries are only appended — by \`Task\`'s chain methods and by the task service on create — and never edited or
+  removed, so the list reads as the task's moves in order.
+- \`at\` is the moment the entry was built when the writer gives none.
+- \`note\` is empty on every entry the app writes itself.
 `,
   };
 }

package/templates/appSample/lib/_noti/noti.abstract.ts

@@ -3,36 +3,13 @@ import type { AppInfo, LibInfo } from "akanjs";
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
   return {
     filename: "noti.abstract.md",
-    content: `# Noti Abstract
+    content: `# noti Service Abstract
+Noti holds the in-app notification list on the client: the messages the app shows, an unread count, and dismissal.
 
-## Akan.js Module Pattern
-
-Noti is a **pure service module** — not a database module. It demonstrates the Akan.js convention
-for modules that orchestrate behavior without owning a persistent document model.
-
-Both module types follow the same layer pattern, but service modules have fewer layers:
-no constant.ts (no data shape), no document.ts (no DB queries), no UI components.
-
-- noti.service.ts — business logic via serve("noti" as const, ...) (named service, no DB binding)
-- noti.signal.ts — real-time pubsub endpoint bound via endpoint(srv.noti, ...)
-- noti.store.ts — client state via store("noti" as const, ...) (named store, no signal binding)
-- noti.dictionary.ts — i18n via serviceDictionary() (no model field labels)
-
-## Convention: lib/_<service>/ directory naming
-
-- Service modules live under lib/_<service>/ — the underscore prefix signals "this is a service, not a database model."
-- Files drop the underscore: lib/_noti/noti.service.ts, not lib/_noti/_noti.service.ts.
-- Scan registers into the same barrel files: srv.ts, sig.ts, st.ts, dict.ts.
-
-## Convention: named serve/store (no DB binding)
-
-- serve("noti" as const, ...) — service name passed as string, no db.<module> binding.
-- store("noti" as const, ...) — store name passed as string, no sig.<module> binding.
-
-## Related Modules
-
-- lib/task/ — database module reference (compare structure differences)
-- lib/__scalar/workHistory/ — reusable scalar field modules (double-underscore prefix, embedded in models)
+## Rules
+- Notifications live only in the client store; the server side declares nothing yet, so a reload starts empty.
+- \`unreadCount\` counts additions since the last \`markAllRead()\`, not the list's length — removing a notification
+  does not lower it.
 `,
   };
 }

package/templates/appSample/lib/task/task.abstract.ts

@@ -3,38 +3,18 @@ import type { AppInfo, LibInfo } from "akanjs";
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
   return {
     filename: "task.abstract.md",
-    content: `# Task Abstract
-
-## Akan.js Module Pattern
-
-Task is a **database-backed domain module** — the standard Akan.js pattern for persisted entities.
-This module demonstrates the full Akan.js module lifecycle:
-constant -> document -> service -> signal -> store -> UI.
-
-Every database module in Akan.js follows this layered architecture:
-- task.constant.ts — data shape (enum, Input, Object, Light, Full layers via via())
-- task.document.ts — DB queries, filters, sorts, indexes, Document chain methods
-- task.dictionary.ts — i18n labels, error messages, UI translations
-- task.service.ts — business logic orchestration bound to DB via serve(db.task, ...)
-- task.signal.ts — API surface (query, mutation, pubsub endpoints bound via endpoint(srv.task, ...))
-- task.store.ts — client state management bound to signal via store(sig.task, ...)
-- Task.*.tsx — UI components (Zone -> Load -> Unit / View / Template / Util)
-
-## Convention: lib/<module>/ directory naming
-
-- Database modules live under lib/<module>/ (no underscore prefix)
-- Files follow <module>.<layer>.ts naming — e.g., task.constant.ts, task.service.ts
-- UI files use PascalCase with explicit suffix: Task.Zone.tsx, Task.Unit.tsx, Task.View.tsx
-
-## Convention: scan-registered barrels
-
-akan sync auto-discovers each file and registers it in the corresponding barrel:
-cnst.ts, db.ts, dict.ts, srv.ts, sig.ts, st.ts
-
-## Related Modules
-
-- lib/__scalar/workHistory/ — standard scalar modules with double-underscore prefix (reusable field sets)
-- lib/_noti/ — pure service module (compare structure differences: no constant/document, serve without DB binding)
+    content: `# task Abstract
+A task is one unit of work that moves from todo through in progress to completed, and keeps a record of each move.
+
+## Rules
+- A task only moves forward: \`start()\` needs \`todo\` and \`complete()\` needs \`inProgress\`; any other state throws.
+- Every move appends one \`workHistory\` entry, and creation writes the first (\`created\`), so the history is never
+  empty and its last entry always matches \`status\`.
+- Anyone may read a task; creating, changing, starting and completing one needs a signed-in caller. There is no
+  generated admin API (\`root: None\`).
+- Removal is soft: a removed task keeps its row with \`removedAt\` set.
+
+todo -> inProgress -> completed
 `,
   };
 }

package/templates/appSample/lib/task/task.signal.spec.ts

@@ -1,16 +1,26 @@
 import type { AppInfo, LibInfo } from "akanjs";
 
-export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
-  return `import { expect } from "bun:test";
-import type { DocumentModel } from "akanjs/constant";
-import { getOrSetupSignalTestFetch, sampleOf } from "akanjs/test";
+export default function getContent(
+  scanInfo: AppInfo | LibInfo | null,
+  dict: { appName: string },
+  options: { libs?: string[] } = {},
+) {
+  // Task writes are guarded by SignedIn, so the fixtures sign a user in through libs/shared when it is installed.
+  const signsIn = options.libs?.includes("shared") ?? false;
+  return `${
+    signsIn
+      ? `import * as userSpec from "@libs/shared/lib/user/user.signal.spec";
+`
+      : ""
+  }import type { DocumentModel } from "akanjs/constant";
+import { ${signsIn ? "" : "getOrSetupSignalTestFetch, "}sampleOf } from "akanjs/test";
 
 import * as cnst from "../cnst";
 import type { fetch as appFetch } from "../useServer";
 
 type AppFetch = typeof appFetch;
 
-const getFetch = async () => await getOrSetupSignalTestFetch<AppFetch>();
+const getFetch = async () => ${signsIn ? "(await userSpec.getUserAgentWithPassword<AppFetch>()).fetch" : "await getOrSetupSignalTestFetch<AppFetch>()"};
 
 export interface TaskAgent {
   task: cnst.Task;
@@ -27,13 +37,6 @@ export const createTask = async (overrides: Partial<DocumentModel<cnst.TaskInput
 
   const task = await fetch.createTask(taskInput);
 
-  expect(task).toMatchObject({
-    title: taskInput.title,
-    content: taskInput.content,
-    status: "todo",
-  });
-  expect(task.workHistory.map((entry) => entry.action)).toEqual(["created"]);
-
   return {
     task,
     fetch,
@@ -45,9 +48,6 @@ export const getStartedTask = async (overrides: Partial<DocumentModel<cnst.TaskI
   const agent = await createTask(overrides);
   const task = await agent.fetch.startTask(agent.task.id);
 
-  expect(task.status).toBe("inProgress");
-  expect(task.workHistory.map((entry) => entry.action)).toEqual(["created", "started"]);
-
   return {
     ...agent,
     task,
@@ -58,9 +58,6 @@ export const getCompletedTask = async (overrides: Partial<DocumentModel<cnst.Tas
   const agent = await getStartedTask(overrides);
   const task = await agent.fetch.completeTask(agent.task.id);
 
-  expect(task.status).toBe("completed");
-  expect(task.workHistory.map((entry) => entry.action)).toEqual(["created", "started", "completed"]);
-
   return {
     ...agent,
     task,

package/templates/appSample/lib/task/task.signal.test.ts

@@ -6,9 +6,23 @@ import { configureSignalTest } from "akanjs/test";
 
 import * as taskSpec from "./task.signal.spec";
 
-configureSignalTest({ databaseMode: "memory" });
+configureSignalTest({ storage: "memory" });
 
 describe("Task signal smoke", () => {
+  test("creates a task in todo", async () => {
+    const { task, taskInput } = await taskSpec.createTask({ title: "Signal smoke task" });
+
+    expect(task).toMatchObject({ title: taskInput.title, content: taskInput.content, status: "todo" });
+    expect(task.workHistory.map((entry) => entry.action)).toEqual(["created"]);
+  });
+
+  test("starts a task", async () => {
+    const { task } = await taskSpec.getStartedTask({ title: "Signal smoke task" });
+
+    expect(task.status).toBe("inProgress");
+    expect(task.workHistory.map((entry) => entry.action)).toEqual(["created", "started"]);
+  });
+
   test("exposes custom task mutations over fetch", async () => {
     const { task } = await taskSpec.getCompletedTask({ title: "Signal smoke task" });
 

package/templates/appSample/lib/task/task.signal.ts

@@ -25,7 +25,7 @@ export class TaskInternal extends internal(srv.task, ({ interval }) => ({})) {}
 // Guards, per key: root = the generated admin API (runs any filter with caller-supplied args), get = reads,
 // cru = create/update/remove. root and cru are never Public; None here means "nobody until you name a guard".
 export class TaskSlice extends slice(srv.task, { guards: { root: None, get: Public, cru: SignedIn } }, (init) => ({
-  inPublic: init().exec(function () {
+  inPublic: init({ guards: [Public] }).exec(function () {
     return this.taskService.queryAny();
   }),
 })) {}

package/templates/appSample/srvkit/{AuthGuard.ts → guards.ts}

@@ -2,14 +2,14 @@ import type { AppInfo, LibInfo } from "akanjs";
 
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
   return {
-    filename: "AuthGuard.ts",
+    filename: "guards.ts",
     content: `import type { Guard, GuardScope, SignalContext } from "akanjs/signal";
 
-// ===== AuthGuard.ts =====
+// ===== guards.ts =====
 // Convention: srvkit/ folder — server-only helpers, cannot import from client code.
 // Implements the Guard interface from akanjs/signal.
 // Guards are applied at endpoint/slice declaration: { guards: { root: SignedIn } }.
-// Naming: PascalCase .ts, static name property matches the guard identifier.
+// Naming: camelCase file, PascalCase classes; each static name matches its guard identifier.
 // Scanned by akan sync into srvkit/index.ts barrel automatically.
 
 export class SignedIn implements Guard {
@@ -21,7 +21,10 @@ export class SignedIn implements Guard {
 
   canPass(context: SignalContext): boolean {
     // Reads the account the middleware resolved, so the same guard answers over HTTP, a websocket and MCP alike.
-    return !!context.get<{ id?: string }>("account");
+    // A guest still has an account — libs/shared resolves one to \`{ appName, environment }\` — so only an
+    // identity on it proves a sign-in: your own middleware's \`id\`, or libs/shared's \`self\` (user) / \`me\` (admin).
+    const account = context.get<{ id?: string; self?: { id?: string }; me?: { id?: string } }>("account");
+    return !!(account?.id ?? account?.self?.id ?? account?.me?.id);
   }
 }
 

package/templates/appSample/srvkit/{SessionInternalArg.ts → internalArgs.ts}

@@ -2,22 +2,24 @@ import type { AppInfo, LibInfo } from "akanjs";
 
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { appName: string }) {
   return {
-    filename: "SessionInternalArg.ts",
+    filename: "internalArgs.ts",
     content: `import type { InternalArg, SignalContext } from "akanjs/signal";
 
-// ===== SessionInternalArg.ts =====
+// ===== internalArgs.ts =====
 // Convention: srvkit/ folder — server-only helpers.
 // Implements the InternalArg interface from akanjs/signal.
 // InternalArg is an auto-injected argument for resolveField/endpoint .with() chains.
 // Appended to a query/mutation via: .with(CurrentUserId, { nullable: true }).exec(...)
-// Naming: PascalCase .ts, class name = arg identifier.
+// Naming: camelCase file, PascalCase classes; each class name is its arg identifier.
 // Scanned by akan sync into srvkit/index.ts barrel automatically.
 
 export class CurrentUserId implements InternalArg<string | null> {
   getArg(context: SignalContext): string | null {
     // \`context.get\` reads what the account middleware resolved, on every transport. Branching on
     // \`getHttpContext()\` would return null for the same caller arriving over a websocket or MCP.
-    return context.get<{ id?: string }>("account")?.id ?? null;
+    // An app's own middleware may put the id on the account itself; libs/shared puts it on \`self\` or \`me\`.
+    const account = context.get<{ id?: string; self?: { id?: string }; me?: { id?: string } }>("account");
+    return account?.id ?? account?.self?.id ?? account?.me?.id ?? null;
   }
 }
 

package/templates/client.ts

@@ -4,36 +4,13 @@ const capitalize = (str: string) => str.charAt(0).toUpperCase() + str.slice(1);
 
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { [key: string]: string } = {}) {
   if (!scanInfo) return null;
-  const databaseModules = [...scanInfo.database.entries()]
-    .filter(
-      ([_, fileTypes]) =>
-        fileTypes.has("template") ||
-        fileTypes.has("unit") ||
-        fileTypes.has("util") ||
-        fileTypes.has("view") ||
-        fileTypes.has("zone"),
-    )
-    .map(([key]) => key);
-  const scalarModules = [...scanInfo.scalar.entries()]
-    .filter(
-      ([_, fileTypes]) =>
-        fileTypes.has("template") ||
-        fileTypes.has("unit") ||
-        fileTypes.has("util") ||
-        fileTypes.has("view") ||
-        fileTypes.has("zone"),
-    )
-    .map(([key]) => key);
-  const serviceModules = [...scanInfo.service.entries()]
-    .filter(
-      ([_, fileTypes]) =>
-        fileTypes.has("template") ||
-        fileTypes.has("unit") ||
-        fileTypes.has("util") ||
-        fileTypes.has("view") ||
-        fileTypes.has("zone"),
-    )
-    .map(([key]) => key);
+  const uiModules = (modules: Map<string, Set<string>>) =>
+    [...modules.entries()]
+      .filter(([_, fileTypes]) => ["template", "unit", "util", "view", "zone"].some((type) => fileTypes.has(type)))
+      .map(([key]) => key);
+  const databaseModules = uiModules(scanInfo.database);
+  const scalarModules = uiModules(scanInfo.scalar);
+  const serviceModules = uiModules(scanInfo.service);
   return `
 export * as cnst from "./lib/cnst";
 export { msg, Err, usePage, fetch, sig } from "./lib/useClient";

package/templates/crudPages/[__model__Id]/edit/page.tsx

@@ -4,12 +4,13 @@ interface Dict {
   Model: string;
   model: string;
   appName: string;
+  clientPath: string;
 }
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
   return {
     filename: "_index.tsx",
     content: `
-import { ${dict.Model}, fetch, usePage } from "@apps/${dict.appName}/client";
+import { ${dict.Model}, fetch, usePage } from "${dict.clientPath}";
 import { ID } from "akanjs/base";
 import { page } from "akanjs/client";
 import { Load } from "akanjs/ui";

package/templates/crudPages/[__model__Id]/page.tsx

@@ -4,12 +4,13 @@ interface Dict {
   Model: string;
   model: string;
   appName: string;
+  clientPath: string;
 }
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
   return {
     filename: "_index.tsx",
     content: `
-import { ${dict.Model}, fetch, usePage } from "@apps/${dict.appName}/client";
+import { ${dict.Model}, fetch, usePage } from "${dict.clientPath}";
 import { ID } from "akanjs/base";
 import { page } from "akanjs/client";
 import { buttonRecipe, Link } from "akanjs/ui";

package/templates/crudPages/new/page.tsx

@@ -4,12 +4,13 @@ interface Dict {
   Model: string;
   model: string;
   appName: string;
+  clientPath: string;
 }
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
   return {
     filename: "_index.tsx",
     content: `
-import { type cnst, fetch, usePage, ${dict.Model} } from "@apps/${dict.appName}/client";
+import { type cnst, fetch, usePage, ${dict.Model} } from "${dict.clientPath}";
 import { page } from "akanjs/client";
 import { Load } from "akanjs/ui";
 

package/templates/crudPages/page.tsx

@@ -4,12 +4,13 @@ interface Dict {
   Model: string;
   model: string;
   appName: string;
+  clientPath: string;
 }
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
   return {
     filename: "_index.tsx",
     content: `
-import { ${dict.Model}, fetch, usePage } from "@apps/${dict.appName}/client";
+import { ${dict.Model}, fetch, usePage } from "${dict.clientPath}";
 import { page } from "akanjs/client";
 import { buttonRecipe, Link } from "akanjs/ui";
 

package/templates/crudSinglePage/page.tsx

@@ -4,12 +4,13 @@ interface Dict {
   Model: string;
   model: string;
   appName: string;
+  clientPath: string;
 }
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
   return {
     filename: "_index.tsx",
     content: `
-import { ${dict.Model}, fetch, usePage } from "@apps/${dict.appName}/client";
+import { ${dict.Model}, fetch, usePage } from "${dict.clientPath}";
 import { page } from "akanjs/client";
 import { buttonRecipe, Model } from "akanjs/ui";
 

package/templates/lib/__lib/lib.dictionary.ts

@@ -1,7 +1,5 @@
 import type { AppInfo, LibInfo } from "akanjs";
 
-const capitalize = (str: string) => str.charAt(0).toUpperCase() + str.slice(1);
-
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { [key: string]: string } = {}) {
   if (!scanInfo) return null;
   const libs = scanInfo.getLibs();

package/templates/lib/__lib/lib.document.ts

@@ -1,7 +1,5 @@
 import type { AppInfo, LibInfo } from "akanjs";
 
-const capitalize = (str: string) => str.charAt(0).toUpperCase() + str.slice(1);
-
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { [key: string]: string } = {}) {
   if (!scanInfo) return null;
   const libs = scanInfo.getLibs();

package/templates/lib/sig.ts

@@ -13,6 +13,8 @@ export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { [
   const libs = scanInfo.getLibs();
 
   const signalNames = [...(libs.length === 0 ? ["base"] : libs), ...databaseModules, ...serviceModules];
+  const serverSignalClass = (module: string) =>
+    `export class ${capitalize(module)} extends serverSignal(${module}Sig.${capitalize(module)}Endpoint, ${module}Sig.${capitalize(module)}Internal) {}`;
 
   return `
 import { FetchClient, type FetchClientType } from "akanjs/fetch";
@@ -20,38 +22,14 @@ import { SignalRegistry, serverSignal${libs.length === 0 ? ", fetch as base" : "
 import { Err } from "./dict";
 ${libs.map((lib) => `import { fetch as ${lib} } from "@libs/${lib}/lib/sig";`).join("\n")}
 
-${[...scanInfo.database.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(([module]) => `import * as ${module}Sig from "./${module}/${module}.signal";`)
-  .join("\n")}
-${[...scanInfo.service.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(([module]) => `import * as ${module}Sig from "./_${module}/${module}.signal";`)
-  .join("\n")}
+${databaseModules.map((module) => `import * as ${module}Sig from "./${module}/${module}.signal";`).join("\n")}
+${serviceModules.map((module) => `import * as ${module}Sig from "./_${module}/${module}.signal";`).join("\n")}
 
-${[...scanInfo.database.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(([module]) => `export * from "./${module}/${module}.signal";`)
-  .join("\n")}
-${[...scanInfo.service.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(([module]) => `export * from "./_${module}/${module}.signal";`)
-  .join("\n")}
+${databaseModules.map((module) => `export * from "./${module}/${module}.signal";`).join("\n")}
+${serviceModules.map((module) => `export * from "./_${module}/${module}.signal";`).join("\n")}
 
-${[...scanInfo.database.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(
-    ([module]) =>
-      `export class ${capitalize(module)} extends serverSignal(${module}Sig.${capitalize(module)}Endpoint, ${module}Sig.${capitalize(module)}Internal) {}`,
-  )
-  .join("\n")}
-${[...scanInfo.service.entries()]
-  .filter(([_, files]) => files.has("signal"))
-  .map(
-    ([module]) =>
-      `export class ${capitalize(module)} extends serverSignal(${module}Sig.${capitalize(module)}Endpoint, ${module}Sig.${capitalize(module)}Internal) {}`,
-  )
-  .join("\n")}
+${databaseModules.map(serverSignalClass).join("\n")}
+${serviceModules.map(serverSignalClass).join("\n")}
 
 ${databaseModules.map((module) => `export const ${module} = SignalRegistry.registerDatabase("${module}" as const, ${module}Sig.${capitalize(module)}Internal, ${module}Sig.${capitalize(module)}Endpoint, ${module}Sig.${capitalize(module)}Slice, ${capitalize(module)});`).join("\n")}
 ${serviceModules.map((module) => `export const ${module} = SignalRegistry.registerService("${module}" as const, ${module}Sig.${capitalize(module)}Internal, ${module}Sig.${capitalize(module)}Endpoint, ${capitalize(module)});`).join("\n")}

package/templates/localDev/docker-compose.yaml.template

@@ -1,29 +1,18 @@
-version: "3.8"
 networks:
   <%= repoName %>-network:
     driver: bridge
 services:
   redis:
     container_name: <%= repoName %>-redis
-    image: redis
+    image: redis:8
     restart: unless-stopped
     ports:
       - 6379:6379
     networks:
       - <%= repoName %>-network
-  libsql:
-    container_name: <%= repoName %>-libsql
-    image: ghcr.io/tursodatabase/libsql-server:latest
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    volumes:
-      - ./libsql:/var/lib/sqld
-    networks:
-      - <%= repoName %>-network
   postgres:
     container_name: <%= repoName %>-postgres
-    image: postgres:17
+    image: postgres:18
     restart: unless-stopped
     ports:
       - 5432:5432
@@ -32,6 +21,6 @@ services:
       - POSTGRES_USER=akan
       - POSTGRES_PASSWORD=akan
     volumes:
-      - ./postgres:/var/lib/postgresql/data
+      - ./postgres:/var/lib/postgresql
     networks:
       - <%= repoName %>-network

package/templates/module/__model__.signal.ts

@@ -6,16 +6,24 @@ interface Dict {
   models: string;
   sysName: string;
 }
-export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict) {
+interface Options {
+  sharedGuards?: boolean;
+}
+export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: Dict, options: Options = {}) {
+  // Admin lives in libs/shared; without it root and cru stay None, shut until the app names a guard of its own.
+  const guardImports = options.sharedGuards
+    ? `import { Admin } from "@libs/shared/srvkit";\nimport { endpoint, internal, Public, slice } from "akanjs/signal";`
+    : `import { endpoint, internal, None, Public, slice } from "akanjs/signal";`;
+  const writeGuard = options.sharedGuards ? "Admin" : "None";
   return `
-import { endpoint, internal, None, Public, slice } from "akanjs/signal";
+${guardImports}
 
 import * as srv from "../srv";
 
 export class ${dict.Model}Internal extends internal(srv.${dict.model}, ({ interval }) => ({})) {}
 
-export class ${dict.Model}Slice extends slice(srv.${dict.model}, { guards: { root: None, get: Public, cru: Public } }, (init) => ({
-  inPublic: init()
+export class ${dict.Model}Slice extends slice(srv.${dict.model}, { guards: { root: ${writeGuard}, get: Public, cru: ${writeGuard} } }, (init) => ({
+  inPublic: init({ guards: [Public] })
     .exec(function () {
       return this.${dict.model}Service.queryAny();
     }),

package/templates/pkgRoot/tsconfig.json.template

@@ -1,10 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "<%= workspaceRootPath %>/tsconfig.json",
   "files": [],
-  "include": ["**/*.ts", "**/*.tsx"],
-  "references": [
-    {
-      "path": "./tsconfig.spec.json"
-    }
-  ]
+  "include": ["**/*.ts", "**/*.tsx"]
 }

package/templates/server.ts

@@ -1,7 +1,5 @@
 import type { AppInfo, LibInfo } from "akanjs";
 
-const capitalize = (str: string) => str.charAt(0).toUpperCase() + str.slice(1);
-
 export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { [key: string]: string } = {}) {
   if (!scanInfo) return null;
   const libs = scanInfo.getLibs();

package/templates/service/__model__.abstract.md.template

@@ -0,0 +1,8 @@
+# <%= model %> Service Abstract
+
+<One sentence: the workflow or integration this service owns, stated as fact.>
+
+## Rules
+
+- <An invariant the code obeys but cannot explain: a lifetime, a refusal, an ordering, and its reason.>
+- <Two to five of them. If the service moves something through states, end the file with one arrow line.>