@decohere/scaffold 0.0.1-dev.126 → 0.0.1-dev.18

package/es6/src/webapi/devcontainer/templates/initialize.sh

@@ -1,169 +0,0 @@
-#!/usr/bin/env bash
-# Runs on the host before the container is created (devcontainer initializeCommand).
-# Creates bind-mount sources as the host user so Docker does not create them as root.
-# Optional npm / gh / MCP setup is y/N on a TTY; no TTY skips.
-set -euo pipefail
-
-root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=tty-prompt.sh
-source "$here/tty-prompt.sh"
-
-npm_dir="$root/.devcontainer/npm-auth"
-gh_dir="$root/.devcontainer/gh-auth"
-gh_env="$root/.devcontainer/gh.env"
-cursor_dir="$root/.cursor"
-RAG_ENV="$cursor_dir/codebase-rag.env"
-
-run_codebase_rag_mcp() {
-	local script="$here/codebase-rag-mcp.ts"
-	CODEBASE_RAG_WORKSPACE="$root" node --experimental-strip-types "$script" "$@"
-}
-
-load_rag_env() {
-	RAG_URL=""
-	RAG_TOKEN=""
-	[[ -f "$RAG_ENV" ]] || return 0
-	# shellcheck disable=SC1090
-	set -a
-	# shellcheck disable=SC1090
-	source "$RAG_ENV"
-	set +a
-	RAG_URL="${CODEBASE_RAG_MCP_URL:-}"
-	RAG_TOKEN="${CODEBASE_RAG_MCP_TOKEN:-}"
-}
-
-write_rag_env() {
-	mkdir -p "$(dirname "$RAG_ENV")"
-	umask 077
-	cat >"$RAG_ENV" <<EOF
-# Written by .devcontainer/initialize.sh. Not in git.
-CODEBASE_RAG_MCP_URL=${RAG_URL}
-CODEBASE_RAG_MCP_TOKEN=${RAG_TOKEN}
-CODEBASE_RAG_MCP_ROOT=${root}
-EOF
-	chmod 600 "$RAG_ENV"
-	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
-		run_codebase_rag_mcp merge || true
-	fi
-}
-
-seed_rag_from_host_mcp() {
-	local mcp="${HOME}/.cursor/mcp.json"
-	[[ -f "$mcp" ]] || return 1
-	command -v node >/dev/null 2>&1 || return 1
-	run_codebase_rag_mcp seed-print "$mcp"
-}
-
-ensure_cursor_dir() {
-	mkdir -p "$cursor_dir"
-}
-
-ensure_auth_dir() {
-	local dir="$1"
-	if ! mkdir -p "$dir" 2>/dev/null; then
-		echo "Cannot create $dir (permission denied)." >&2
-		echo "The scaffold container likely left .devcontainer root-owned. Fix with:" >&2
-		echo "  sudo chown -R \"$USER:$USER\" \"$root\"" >&2
-		exit 1
-	fi
-	{
-		echo "*"
-		echo "!.gitignore"
-	} >"$dir/.gitignore"
-}
-
-ensure_gh_env() {
-	if [[ -d "$gh_env" ]]; then
-		echo "Refusing to start: $gh_env is a directory (left by a prior bind mount). Remove it and rebuild." >&2
-		exit 1
-	fi
-	touch "$gh_env"
-}
-
-setup_npm_auth() {
-	if [[ -f "$npm_dir/.npmrc" ]]; then
-		echo "npm auth: using $npm_dir/.npmrc"
-		return 0
-	fi
-	if ! prompt_yn "Configure npm auth for this workspace?"; then
-		echo "npm auth: skipped"
-		return 0
-	fi
-	if [[ -f "${HOME}/.npmrc" ]]; then
-		cp -a "${HOME}/.npmrc" "$npm_dir/.npmrc"
-		echo "npm auth: copied ~/.npmrc → $npm_dir/.npmrc"
-		return 0
-	fi
-	echo "npm auth: no ~/.npmrc — log in inside the container if prompted"
-}
-
-setup_gh_auth() {
-	if [[ -f "$gh_dir/hosts.yml" ]]; then
-		echo "gh auth: using $gh_dir/hosts.yml"
-		return 0
-	fi
-	if ! prompt_yn "Configure GitHub CLI auth for this workspace?"; then
-		echo "gh auth: skipped"
-		return 0
-	fi
-	if [[ -f "${HOME}/.config/gh/hosts.yml" ]]; then
-		cp -a "${HOME}/.config/gh/hosts.yml" "$gh_dir/hosts.yml"
-		[[ -f "${HOME}/.config/gh/config.yml" ]] &&
-			cp -a "${HOME}/.config/gh/config.yml" "$gh_dir/config.yml"
-		echo "gh auth: copied ~/.config/gh → $gh_dir"
-		return 0
-	fi
-	echo "gh auth: no ~/.config/gh/hosts.yml — log in inside the container if prompted"
-}
-
-setup_codebase_rag_env() {
-	load_rag_env
-	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
-		write_rag_env
-		echo "codebase-rag MCP: using $RAG_ENV"
-		return 0
-	fi
-
-	local seeded
-	if seeded="$(seed_rag_from_host_mcp 2>/dev/null)"; then
-		if prompt_yn "Found codebase-rag in ~/.cursor/mcp.json. Use it for this workspace?" y; then
-			RAG_URL="$(printf '%s\n' "$seeded" | sed -n '1p')"
-			RAG_TOKEN="$(printf '%s\n' "$seeded" | sed -n '2p')"
-			write_rag_env
-			echo "codebase-rag MCP: imported HTTP server from ~/.cursor/mcp.json → $RAG_ENV"
-			return 0
-		fi
-	fi
-
-	if ! prompt_yn "Configure codebase RAG MCP (semantic search)?"; then
-		RAG_URL=""
-		RAG_TOKEN=""
-		write_rag_env
-		echo "codebase-rag MCP: skipped"
-		return 0
-	fi
-
-	printf '%s\n' "Empty URL skips. Example: https://rag.example.com/mcp" >/dev/tty
-	printf '%s' "MCP URL: " >/dev/tty
-	read_tty RAG_URL
-	RAG_URL="$(printf '%s' "$RAG_URL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
-	if [[ -z "$RAG_URL" ]]; then
-		RAG_TOKEN=""
-		write_rag_env
-		echo "codebase-rag MCP: skipped"
-		return 0
-	fi
-	printf '%s' "Bearer token (hidden): " >/dev/tty
-	read_tty RAG_TOKEN hidden
-	write_rag_env
-	echo "codebase-rag MCP: saved $RAG_ENV"
-}
-
-ensure_auth_dir "$npm_dir"
-ensure_auth_dir "$gh_dir"
-ensure_gh_env
-ensure_cursor_dir
-setup_npm_auth
-setup_gh_auth
-setup_codebase_rag_env

package/es6/src/webapi/devcontainer/templates/post-create.sh

@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Runs after container create and when workspace content updates
-# (devcontainer postCreateCommand / updateContentCommand).
-# Installs deps when missing or when the lockfile changed; skips otherwise.
-set -euo pipefail
-
-root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$root"
-
-lockfile="pnpm-lock.yaml"
-stamp="node_modules/.decohere-pnpm-lock.sha"
-
-current_hash=""
-if [[ -f "$lockfile" ]]; then
-	current_hash="$(sha256sum "$lockfile" | awk '{print $1}')"
-elif [[ -f package.json ]]; then
-	current_hash="$(sha256sum package.json | awk '{print $1}')"
-fi
-
-if [[ -d node_modules/.bin ]] && [[ -n "$current_hash" ]] && [[ -f "$stamp" ]] && [[ "$(cat "$stamp")" == "$current_hash" ]]; then
-	echo "node_modules: up to date, skipping pnpm install"
-	exit 0
-fi
-
-echo "node_modules: installing dependencies (first create may take a while)..."
-if [[ -f "$lockfile" ]]; then
-	pnpm install --frozen-lockfile
-else
-	pnpm install
-fi
-
-if [[ -n "$current_hash" ]]; then
-	mkdir -p node_modules
-	printf '%s\n' "$current_hash" >"$stamp"
-fi

package/es6/src/webapi/devcontainer/templates/post-start.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# Runs on every container start (devcontainer postStartCommand).
-# Optional npm / gh login is y/N on a TTY. Install is post-create.sh.
-# MCP merge also runs here for later reconnects; the Compose service command
-# merges before Cursor attaches (postStart is too late for the first snapshot).
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-root="$(cd "$here/.." && pwd)"
-# shellcheck source=tty-prompt.sh
-source "$here/tty-prompt.sh"
-
-CODEBASE_RAG_WORKSPACE="$root" node --experimental-strip-types "$here/codebase-rag-mcp.ts" merge ||
-	echo "codebase-rag MCP: merge skipped" >&2
-
-AUTH_REGISTRY="https://registry.npmjs.org"
-
-ensure_npm_auth() {
-	if npm whoami --registry "$AUTH_REGISTRY" >/dev/null 2>&1; then
-		echo "npm: logged in as $(npm whoami --registry "$AUTH_REGISTRY")"
-		return 0
-	fi
-
-	if prompt_yn "Log in to npm?"; then
-		echo "npm: starting login..."
-		npm login --registry "$AUTH_REGISTRY" </dev/tty >/dev/tty
-		return 0
-	fi
-
-	echo "npm: skipped. Open a terminal and run: npm login" >&2
-	echo "    (creds persist in .devcontainer/npm-auth/)" >&2
-	return 1
-}
-
-ensure_gh_auth() {
-	if ! command -v gh >/dev/null 2>&1; then
-		echo "gh: not installed in this container" >&2
-		return 1
-	fi
-
-	if gh auth status >/dev/null 2>&1; then
-		echo "gh: $(gh auth status 2>&1 | head -n1)"
-		return 0
-	fi
-
-	local token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
-	if [[ -n "$token" ]]; then
-		echo "gh: authenticating from GH_TOKEN..."
-		printf '%s\n' "$token" | gh auth login --with-token
-		return 0
-	fi
-
-	if prompt_yn "Log in to GitHub CLI (gh)?"; then
-		echo "gh: starting login..."
-		gh auth login </dev/tty >/dev/tty
-		return 0
-	fi
-
-	echo "gh: skipped. Open a terminal and run: gh auth login" >&2
-	echo "    (creds persist in .devcontainer/gh-auth/; or set GH_TOKEN in .devcontainer/gh.env)" >&2
-	return 1
-}
-
-ensure_npm_auth || true
-ensure_gh_auth || true

package/es6/src/webapi/devcontainer/templates/tty-prompt.sh

@@ -1,38 +0,0 @@
-can_prompt() {
-	[[ -r /dev/tty && -w /dev/tty ]]
-}
-
-read_tty() {
-	local var="$1"
-	local hidden="${2:-}"
-	local value=""
-	if [[ -n "$hidden" ]]; then
-		read -r -s value </dev/tty || true
-		printf '\n' >/dev/tty
-	else
-		read -r value </dev/tty || true
-	fi
-	printf -v "$var" '%s' "$value"
-}
-
-# Returns 0 for yes. Default is n unless the second argument is y.
-prompt_yn() {
-	local question="$1"
-	local default="${2:-n}"
-	local reply=""
-	if ! can_prompt; then
-		return 1
-	fi
-	local hint="y/N"
-	if [[ "$default" == "y" ]]; then
-		hint="Y/n"
-	fi
-	printf '%s [%s] ' "$question" "$hint" >/dev/tty
-	read_tty reply
-	reply="$(printf '%s' "$reply" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
-	if [[ -z "$reply" ]]; then
-		[[ "$default" == "y" ]]
-		return
-	fi
-	[[ "$reply" == "y" || "$reply" == "yes" ]]
-}

package/es6/src/webapi/features/auth.feature.js

@@ -1,357 +0,0 @@
-import { ask, pick } from "../../domain/prompt.js";
-import { WELL_KNOWN_FILES } from "../../models/const.js";
-import { ensureLoggedIn } from "../auth0-commands.js";
-import { AuthConfigModel } from "../models/auth-config.model.js";
-import { ControllerSourceFile } from "../models/controller-source-file.model.js";
-import * as auth0Cli from "./auth0-cli.js";
-const ADMIN_ROLE = "admin";
-const USER_ENTITY_TS = `import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
-import type { Entity as IEntity } from "@decohere/data";
-
-@Entity()
-export class UserEntity implements IEntity {
-\t@PrimaryGeneratedColumn()
-\tpublic id!: number;
-
-\t@Column({ unique: true })
-\tpublic sub!: string;
-
-\t@Column({ type: "varchar", nullable: true })
-\tpublic email!: string | null;
-
-\t@Column()
-\tpublic displayName!: string;
-
-\t/** App-owned roles. The \`admin\` role grants CASL \`manage\`/\`all\` (wildcard). */
-\t@Column({ type: "simple-json", default: "[]" })
-\tpublic roles!: string[];
-}
-`;
-const USER_REPOSITORY_TS = `import { injectable } from "@decohere/crucible/decorators";
-import { injectUnitOfWork } from "@decohere/data";
-import { TypeOrmRepository, TypeOrmUnitOfWork } from "@decohere/data-typeorm";
-import { UserEntity } from "../entities/user.entity.js";
-
-@injectable()
-export class UserEntityRepository extends TypeOrmRepository<UserEntity> {
-\tpublic constructor(@injectUnitOfWork() unitOfWork: TypeOrmUnitOfWork) {
-\t\tsuper(unitOfWork, UserEntity);
-\t}
-
-\tpublic findBySub(sub: string): Promise<UserEntity | null> {
-\t\treturn this.firstOrDefault({ where: { sub } });
-\t}
-}
-`;
-const USER_SERVICE_TS = `import { injectable } from "@decohere/crucible/decorators";
-import type { Principal } from "@decohere/http";
-import { UserEntity } from "../entities/user.entity.js";
-import { UserEntityRepository } from "../repositories/user.repository.js";
-
-function claimString(principal: Principal | undefined, key: string): string | undefined {
-\tconst value = principal?.[key];
-\treturn typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-@injectable()
-export class UserService {
-\tpublic constructor(private readonly users: UserEntityRepository) {}
-
-\t/**
-\t * Upsert a local profile keyed by JWT \`sub\`.
-\t * Profile fields from the token fill gaps; seeded rows keep displayName/email/roles.
-\t */
-\tpublic async ensureFromPrincipal(principal: Principal | undefined): Promise<UserEntity> {
-\t\tconst sub = principal?.sub;
-\t\tif (!sub) {
-\t\t\tthrow new Error("Authenticated request is missing principal.sub");
-\t\t}
-
-\t\tconst email =
-\t\t\tclaimString(principal, "email") ?? claimString(principal, "preferred_username");
-\t\tconst displayFromToken =
-\t\t\tclaimString(principal, "name") ??
-\t\t\tclaimString(principal, "nickname") ??
-\t\t\temail;
-
-\t\tconst existing = await this.users.findBySub(sub);
-\t\tif (existing) {
-\t\t\tlet dirty = false;
-\t\t\tif (!existing.email && email) {
-\t\t\t\texisting.email = email;
-\t\t\t\tdirty = true;
-\t\t\t}
-\t\t\tif (existing.displayName === existing.sub && displayFromToken) {
-\t\t\t\texisting.displayName = displayFromToken;
-\t\t\t\tdirty = true;
-\t\t\t}
-\t\t\treturn dirty ? this.users.save(existing) : existing;
-\t\t}
-
-\t\tconst created = new UserEntity();
-\t\tcreated.sub = sub;
-\t\tcreated.email = email ?? null;
-\t\tcreated.displayName = displayFromToken ?? sub;
-\t\tcreated.roles = Array.isArray(principal.roles)
-\t\t\t? principal.roles.filter((r): r is string => typeof r === "string")
-\t\t\t: [];
-\t\treturn this.users.save(created);
-\t}
-}
-`;
-const ABILITY_FACTORY_TS = `import type { Principal } from "@decohere/http";
-import {
-\tADMIN_ROLE,
-\tcreatePrincipalFromPayload,
-\tdefineAbilitiesFor as defaultDefineAbilitiesFor,
-} from "@decohere/http";
-
-/**
- * Customize CASL authorization here (product-specific rules).
- *
- * Default delegates to \`@decohere/http\`: \`admin\` role → \`manage\`/\`all\`; IdP scopes
- * (\`action:Subject\`) → abilities. Replace the body when you need app rules
- * beyond that — this file is the intentional extension point, not framework
- * infrastructure to copy.
- */
-export function defineAbilitiesFor(principal: Principal) {
-\treturn defaultDefineAbilitiesFor(principal);
-}
-
-/**
- * Customize JWT → Principal mapping here (IdP-specific claims).
- *
- * Elevates \`AUTH0_ADMIN_USER_SUB\` to the admin role so the seeded admin works
- * before/without roles on the access token.
- */
-export function mapPrincipal(payload: Record<string, unknown>): Principal {
-\tconst principal = createPrincipalFromPayload(payload);
-\tconst sub = principal.sub;
-\tif (sub && sub === process.env.AUTH0_ADMIN_USER_SUB) {
-\t\treturn {
-\t\t\t...principal,
-\t\t\troles: [...new Set([ADMIN_ROLE, ...(principal.roles ?? [])])],
-\t\t};
-\t}
-\treturn principal;
-}
-`;
-async function getOptions(workspace, cliOptions) {
-    if (cliOptions.authProvider === "auth0" && !cliOptions.issuerBaseUrl) {
-        return getAuth0Options(workspace, cliOptions);
-    }
-    if (cliOptions.authProvider != null) return {};
-    const choices = [
-        {
-            label: "none"
-        },
-        {
-            label: "auth0"
-        }
-    ];
-    const selected = await pick("\n  Auth provider: ", choices, (c)=>c.label);
-    const provider = selected?.label ?? "none";
-    if (provider !== "auth0") return {
-        authProvider: "none"
-    };
-    return getAuth0Options(workspace, cliOptions);
-}
-async function getAuth0Options(workspace, cliOptions) {
-    const active = ensureLoggedIn();
-    const issuerBaseUrl = `https://${active.name}`;
-    console.log(`\n  ✓ Auth0 tenant: ${issuerBaseUrl}`);
-    process.stdout.write("\n  Fetching Auth0 APIs...");
-    const userApis = auth0Cli.listApis().filter((a)=>!a.name.includes("Management API"));
-    process.stdout.write(` found ${userApis.length}.\n`);
-    const projectName = workspace.name;
-    const apiChoices = [
-        {
-            label: `<new> https://api.${projectName}`,
-            existing: null
-        },
-        ...userApis.map((a)=>({
-                label: `${a.name} — ${a.identifier}`,
-                existing: a.identifier
-            }))
-    ];
-    const apiSelected = await pick("\n  Select Auth0 API: ", apiChoices, (c)=>c.label);
-    let audience;
-    if (!apiSelected || apiSelected.existing === null) {
-        const defaultId = `https://api.${projectName}`;
-        audience = await ask(`  API Identifier [${defaultId}]: `, defaultId);
-        console.log("\n  Creating Auth0 API...");
-        audience = auth0Cli.createApi(`${projectName} API`, audience).identifier;
-        console.log(`  \u2713 API created: ${audience}`);
-    } else {
-        audience = apiSelected.existing;
-        console.log(`  \u2713 Selected: ${audience}`);
-        try {
-            auth0Cli.updateApiScopes(audience);
-            console.log(`  \u2713 API scopes ensured (${auth0Cli.HELLO_API_SCOPES.join(", ")})`);
-        } catch  {
-            console.error("  ✗ Failed to update API scopes — add Hello scopes in the Auth0 dashboard.");
-        }
-    }
-    const withLocalUsers = cliOptions.databaseProvider === "postgres/typeorm";
-    let adminUsername;
-    let adminPassword;
-    if (withLocalUsers) {
-        adminUsername = cliOptions.adminUsername ?? await ask("\n  Admin username [admin]: ", "admin");
-        adminPassword = cliOptions.adminPassword;
-        if (adminPassword == null) {
-            adminPassword = await ask("  Admin password (leave blank to generate): ");
-            if (!adminPassword) {
-                adminPassword = auth0Cli.generateAdminPassword();
-                console.log(`  ✓ Generated admin password (written to .env): ${adminPassword}`);
-            }
-        }
-    }
-    return {
-        authProvider: "auth0",
-        issuerBaseUrl,
-        audience,
-        ...withLocalUsers ? {
-            adminUsername,
-            adminPassword
-        } : {}
-    };
-}
-function adminEmail(workspaceName, username) {
-    if (username.includes("@")) return username;
-    const slug = workspaceName.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-    return `${username}@${slug}.example.com`;
-}
-function createAuth0AdminUser(workspace, options, authConfig) {
-    const username = options.adminUsername ?? "admin";
-    const password = options.adminPassword;
-    if (!password) return;
-    const email = adminEmail(workspace.name, username);
-    try {
-        const admin = auth0Cli.createAdminDatabaseUser({
-            email,
-            password,
-            username
-        });
-        authConfig.setAdminUser({
-            sub: admin.user_id,
-            email: admin.email,
-            password: admin.password,
-            username: admin.username
-        });
-        workspace.getModel(WELL_KNOWN_FILES.ENV_FILE)?.addEntry("AUTH0_ADMIN_USER_SUB", admin.user_id).addEntry("AUTH0_ADMIN_USER_EMAIL", admin.email).addEntry("AUTH0_ADMIN_USER_PASSWORD", admin.password).addEntry("AUTH0_ADMIN_USERNAME", admin.username);
-        console.log(`  ✓ Auth0 admin user ready: ${admin.email} (role: ${ADMIN_ROLE})`);
-        console.log(`    Login with EMAIL (not username): ${admin.email}`);
-        console.log(`    Password: see AUTH0_ADMIN_USER_PASSWORD in .env`);
-    } catch (err) {
-        console.error(`  ✗ Failed to ensure Auth0 admin user (${email}): ${err instanceof Error ? err.message : err}`);
-    }
-}
-function scaffoldLocalUserProfile(workspace) {
-    for (const project of workspace.getProjects()){
-        project.getModel(WELL_KNOWN_FILES.MAIN_TS)?.addEntity({
-            className: "UserEntity",
-            importPath: "./entities/user.entity.js"
-        }).addRepository({
-            className: "UserEntityRepository",
-            importPath: "./repositories/user.repository.js"
-        }).addService({
-            className: "UserService",
-            importPath: "./services/user.service.js",
-            scope: "request"
-        }).addImport("defineAbilitiesFor", "./auth/ability.factory.js").addImport("mapPrincipal", "./auth/ability.factory.js").setTypeOrmSeed([
-            "const sub = process.env.AUTH0_ADMIN_USER_SUB;",
-            "if (!sub) return;",
-            "const repo = dataSource.getRepository(UserEntity);",
-            "const existing = await repo.findOne({ where: { sub } });",
-            "if (existing) return;",
-            "await repo.save(repo.create({",
-            "  sub,",
-            "  email: process.env.AUTH0_ADMIN_USER_EMAIL ?? null,",
-            '  displayName: process.env.AUTH0_ADMIN_USERNAME ?? "admin",',
-            '  roles: ["admin"],',
-            "}));"
-        ].join(" "));
-        project.addFile({
-            files: ()=>[
-                    {
-                        filePath: "src/entities/user.entity.ts",
-                        content: USER_ENTITY_TS
-                    },
-                    {
-                        filePath: "src/repositories/user.repository.ts",
-                        content: USER_REPOSITORY_TS
-                    },
-                    {
-                        filePath: "src/services/user.service.ts",
-                        content: USER_SERVICE_TS
-                    },
-                    {
-                        filePath: "src/auth/ability.factory.ts",
-                        content: ABILITY_FACTORY_TS
-                    }
-                ]
-        });
-    }
-    for (const controller of workspace.getModels(ControllerSourceFile)){
-        controller.addImport("UserService", "../services/user.service.js").addImport("inject", "@decohere/crucible/decorators").addConstructorParam("@inject(UserService) private readonly users: UserService");
-        controller.getMethod("getOne").setAsync(true).setBody([
-            "const user = await this.users.ensureFromPrincipal(this.principalProvider.currentPrincipal);",
-            "return { id, message: `Hello ${user.displayName}!`, username: user.displayName };"
-        ]);
-    }
-}
-function scaffold(workspace, options) {
-    if (options.authProvider !== "auth0") return;
-    const resource = "Hello";
-    const withLocalUsers = options.databaseProvider === "postgres/typeorm";
-    for (const controller of workspace.getModels(ControllerSourceFile)){
-        controller.addDecorator(`@Authorize("read", "${resource}")`).addCortexImport("AllowAnonymous").addCortexImport("Authorize").addCortexImport("IPrincipalProviderToken").addCortexImport("IPrincipalProvider", true).addImport("inject", "@decohere/crucible/decorators").addConstructorParam(`@inject(IPrincipalProviderToken) private readonly principalProvider: IPrincipalProvider`);
-        controller.getMethod("getAll").addDecorator("@AllowAnonymous()");
-        if (!withLocalUsers) {
-            controller.getMethod("getOne").setBody([
-                "const principal = this.principalProvider.currentPrincipal;",
-                "const username =",
-                '\t(typeof principal?.name === "string" && principal.name) ||',
-                '\t(typeof principal?.nickname === "string" && principal.nickname) ||',
-                '\t(typeof principal?.email === "string" && principal.email) ||',
-                '\t(typeof principal?.preferred_username === "string" && principal.preferred_username) ||',
-                "\tprincipal?.sub ||",
-                '\t"unknown";',
-                "return { id, message: `Hello ${username}!`, username };"
-            ]);
-        }
-        controller.getMethod("create").addDecorator(`@Authorize("create", "${resource}")`);
-        controller.getMethod("update").addDecorator(`@Authorize("update", "${resource}")`);
-        controller.getMethod("remove").addDecorator(`@Authorize("delete", "${resource}")`);
-    }
-    for (const project of workspace.getProjects()){
-        project.getModel(WELL_KNOWN_FILES.MAIN_TS)?.addSideEffectImport("@decohere/http/auth");
-    }
-    if (withLocalUsers) {
-        scaffoldLocalUserProfile(workspace);
-        for (const project of workspace.getProjects()){
-            project.getModel(WELL_KNOWN_FILES.MAIN_TS)?.addBuilderCall(".withAuth(defineAbilitiesFor, { principalMapper: mapPrincipal })");
-        }
-    } else {
-        for (const project of workspace.getProjects()){
-            project.getModel(WELL_KNOWN_FILES.MAIN_TS)?.addBuilderCall(".withAuth()");
-        }
-    }
-    const issuerPlaceholder = "${AUTH0_ISSUER_BASE_URL}";
-    const audPlaceholder = "${AUTH0_AUDIENCE}";
-    const configSection = `auth:\n  discoveryUrl: ${issuerPlaceholder}\n  audience: ${audPlaceholder}\n`;
-    workspace.getModel(WELL_KNOWN_FILES.CONFIG_YAML)?.addSection(configSection);
-    workspace.getModel(WELL_KNOWN_FILES.ENV_FILE)?.addEntry("AUTH0_ISSUER_BASE_URL", options.issuerBaseUrl ?? "").addEntry("AUTH0_AUDIENCE", options.audience ?? "");
-    const authConfig = new AuthConfigModel({
-        issuerBaseUrl: options.issuerBaseUrl ?? "",
-        audience: options.audience ?? ""
-    });
-    workspace.addModel(authConfig);
-    if (withLocalUsers && options.adminPassword) {
-        createAuth0AdminUser(workspace, options, authConfig);
-    }
-}
-export const AuthFeature = {
-    getOptions,
-    scaffold
-};