@getarbiter/cli 0.5.0

package/dist/templates/integration-testing/eslint.config.no-fake-db.mjs.ejs

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Flat ESLint config for the `no-fake-db imports` gate (INV-34, #1887-D). Run in
+// isolation by check-all.mjs via `eslint --config eslint.config.no-fake-db.mjs
+// --no-config-lookup` so it enforces ONLY this prohibition, independent of your
+// main eslint.config.mjs — mirrors eslint.config.static.mjs's precedent. ESLint
+// v9+ flat config: the legacy `.eslintrc-no-fake-db.json` cannot be loaded this
+// way (eslintrc support was removed in v9, deleted in v10) and is retained only
+// for tooling that still reads it.
+import tseslint from 'typescript-eslint'
+
+export default [
+  {
+    files: [
+      '**/*.test.ts',
+      '**/*.spec.ts',
+      '**/*.test.tsx',
+      '**/*.spec.tsx',
+      'src/test/**/*.ts',
+      '__tests__/**/*.ts',
+    ],
+    languageOptions: {
+      parser: tseslint.parser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+    },
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          paths: [
+            {
+              name: 'sqlite3',
+              message:
+                'Use Testcontainers + PostgreSQL for integration tests (INV-34). sqlite3 is banned in test files.',
+            },
+            {
+              name: 'better-sqlite3',
+              message:
+                'Use Testcontainers + PostgreSQL for integration tests (INV-34). better-sqlite3 is banned in test files.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+]

package/dist/templates/integration-testing/main_test.go.ejs

@@ -0,0 +1,53 @@
+// Integration test main — generated by arbiter (M26, INV-34)
+// File: tests/main_test.go
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/modules/postgres"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+var testDBURL string
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+
+	pgContainer, err := postgres.RunContainer(ctx,
+		testcontainers.WithImage("postgres:16-alpine"),
+		postgres.WithDatabase("testdb"),
+		postgres.WithUsername("test"),
+		postgres.WithPassword("test"),
+		testcontainers.WithWaitStrategy(
+			wait.ForLog("database system is ready to accept connections"),
+		),
+	)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to start PostgreSQL container: %v\n", err)
+		os.Exit(1)
+	}
+	defer func() {
+		if err := pgContainer.Terminate(ctx); err != nil {
+			fmt.Fprintf(os.Stderr, "failed to terminate container: %v\n", err)
+		}
+	}()
+
+	connStr, err := pgContainer.ConnectionString(ctx, "sslmode=disable")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to get connection string: %v\n", err)
+		os.Exit(1)
+	}
+	testDBURL = connStr
+	os.Setenv("DATABASE_URL", connStr)
+
+	// PostgresContainer is used above; reference for test discovery
+	_ = testcontainers.GenericContainerRequest{}
+
+	os.Exit(m.Run())
+}

package/dist/templates/integration-testing/main_test_sqlite.go.ejs

@@ -0,0 +1,37 @@
+// Integration test main — generated by arbiter (#1317, INV-34)
+// File: tests/main_test.go
+//
+// Containerless variant: databaseEngine = "sqlite". No Docker container
+// dependency — the test database is an in-process SQLite file under the OS temp
+// dir, removed on exit. Switch to the container-backed variant by setting a real
+// engine (postgresql/mysql) in arbiter.json.
+
+package tests
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+var testDBURL string
+
+func TestMain(m *testing.M) {
+	dir, err := os.MkdirTemp("", "arbiter-it-*")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create temp dir: %v\n", err)
+		os.Exit(1)
+	}
+
+	dbPath := filepath.Join(dir, "test.db")
+	testDBURL = fmt.Sprintf("file:%s?cache=shared&mode=rwc", dbPath)
+	os.Setenv("DATABASE_URL", testDBURL)
+
+	// os.Exit skips deferred calls, so run cleanup explicitly between m.Run and exit.
+	code := m.Run()
+	if err := os.RemoveAll(dir); err != nil {
+		fmt.Fprintf(os.Stderr, "failed to remove temp dir: %v\n", err)
+	}
+	os.Exit(code)
+}

package/dist/templates/integration-testing/test-setup.ts.ejs

@@ -0,0 +1,26 @@
+// Integration test setup — generated by arbiter (M26, INV-34)
+// Opt-in: requires `npm i -D @testcontainers/postgresql` before use.
+
+import { PostgreSqlContainer, StartedPostgreSqlContainer } from '@testcontainers/postgresql'
+
+let container: StartedPostgreSqlContainer
+
+export async function startDatabase(): Promise<string> {
+  container = await new PostgreSqlContainer('postgres:16-alpine')
+    .withDatabase('testdb')
+    .withUsername('test')
+    .withPassword('test')
+    .start()
+  return container.getConnectionUri()
+}
+
+export async function stopDatabase(): Promise<void> {
+  if (container) {
+    await container.stop()
+  }
+}
+
+// Usage in vitest setup:
+// import { startDatabase, stopDatabase } from './test-setup'
+// beforeAll(async () => { process.env.DATABASE_URL = await startDatabase() })
+// afterAll(async () => { await stopDatabase() })

package/dist/templates/integration-testing/testcontainers-deps.gradle.ejs

@@ -0,0 +1,9 @@
+// Testcontainers — generated by arbiter (M26)
+// Add to your build.gradle dependencies block:
+
+dependencies {
+    testImplementation 'org.testcontainers:testcontainers:1.20.4'
+    testImplementation 'org.testcontainers:postgresql:1.20.4'
+    testImplementation 'org.testcontainers:junit-jupiter:1.20.4'
+    testRuntimeOnly 'org.postgresql:postgresql:42.7.3'
+}

package/dist/templates/java/DeprecationInterceptor.java.ejs

@@ -0,0 +1,50 @@
+package <%= basePackage ? basePackage + '.web.interceptor' : 'web.interceptor' %>;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import java.time.Instant;
+import java.time.format.DateTimeFormatter;
+
+/**
+ * RFC 8594-compliant deprecation interceptor for Spring MVC.
+ * Adds Sunset and Deprecation headers to every matched response.
+ *
+ * Register via WebMvcConfigurer.addInterceptors() with an addPathPatterns()
+ * filter to scope to deprecated API versions only.
+ *
+ * Generated by arbiter — see issue #215 (RFC 8594 deprecation protocol).
+ */
+public class DeprecationInterceptor implements HandlerInterceptor {
+
+    private final Instant sunsetDate;
+    private final String successorUrl;
+
+    public DeprecationInterceptor(Instant sunsetDate, String successorUrl) {
+        this.sunsetDate = sunsetDate;
+        this.successorUrl = successorUrl;
+    }
+
+    public DeprecationInterceptor(Instant sunsetDate) {
+        this(sunsetDate, null);
+    }
+
+    @Override
+    public void postHandle(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            Object handler,
+            org.springframework.web.servlet.ModelAndView modelAndView) {
+
+        response.setHeader("Deprecation", "true");
+        response.setHeader(
+                "Sunset",
+                DateTimeFormatter.RFC_1123_DATE_TIME
+                        .format(sunsetDate.atZone(java.time.ZoneOffset.UTC)));
+
+        if (successorUrl != null && !successorUrl.isBlank()) {
+            response.setHeader("Link", "<" + successorUrl + ">; rel=\"successor-version\"");
+        }
+    }
+}

package/dist/templates/java/archunit-hexagonal.ejs

@@ -0,0 +1,69 @@
+package <%= basePackage ? basePackage + '.architecture' : 'architecture' %>;
+
+import com.tngtech.archunit.core.importer.ImportOption;
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+import org.junit.jupiter.api.Test;
+
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+/**
+ * Hexagonal (ports-and-adapters) architecture enforcement — generated by arbiter (#998).
+ *
+ * Enforces clean separation of domain / application / infrastructure layers:
+ *   - Domain must not depend on application, infrastructure, or adapters
+ *   - Application must not depend on infrastructure or adapters
+ *   - Infrastructure and adapters communicate only through application ports
+ *
+ * Generated by arbiter. Re-run `arbiter init` to regenerate.
+ */
+@SuppressWarnings("java:S2699")
+@AnalyzeClasses(
+    packages = "<%= basePackage ? basePackage : '.' %>",
+    importOptions = ImportOption.DoNotIncludeTests.class
+)
+class HexagonalArchTest {
+
+    @ArchTest
+    static final ArchRule domain_must_not_depend_on_infrastructure =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.domain..' : 'domain..' %>")
+            .should().dependOnClassesThat()
+            .resideInAnyPackage(
+                "<%= basePackage ? basePackage + '.infrastructure..' : 'infrastructure..' %>",
+                "<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>"
+            )
+            .because("Domain must not depend on infrastructure or adapters — hexagonal architecture.");
+
+    @ArchTest
+    static final ArchRule domain_must_not_depend_on_application =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.domain..' : 'domain..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.application..' : 'application..' %>")
+            .because("Domain is the innermost layer — it must not depend on application services.");
+
+    @ArchTest
+    static final ArchRule application_must_not_depend_on_infrastructure =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.application..' : 'application..' %>")
+            .should().dependOnClassesThat()
+            .resideInAnyPackage(
+                "<%= basePackage ? basePackage + '.infrastructure..' : 'infrastructure..' %>",
+                "<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>"
+            )
+            .because("Application layer orchestrates via ports — it must not depend on infrastructure implementations.");
+
+    @ArchTest
+    static final ArchRule adapters_must_not_depend_on_each_other =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>")
+            .because("Adapters are independent — they communicate only through domain ports.");
+
+    @Test
+    void hexagonal_layers_declared() {
+    }
+}

package/dist/templates/java/modulith/ApplicationModulesTest.java.ejs

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: Apache-2.0
+package <%- locals.basePackage %>.modulith;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.modulith.core.ApplicationModules;
+
+/**
+ * Spring Modulith structural-verification test (N77).
+ * Verifies that all defined application modules are structurally sound:
+ * no cyclic dependencies, no forbidden cross-module access.
+ *
+ * Run with: ./mvnw test -Dtest=ApplicationModulesTest  (or Gradle equivalent)
+ */
+class ApplicationModulesTest {
+
+    @Test
+    void verifyApplicationModules() {
+        var modules = ApplicationModules.of(<%- locals.basePackage %>.Application.class);
+        modules.verify();
+    }
+}

package/dist/templates/java/modulith/modulith-deps.gradle.ejs

@@ -0,0 +1,13 @@
+// modulith-deps.gradle — generated by arbiter (#1886)
+// Wired automatically: applied from the root build's arbiter-managed block.
+// Re-generate: arbiter update
+//
+// Pinned to the Spring Modulith 1.4.x line, which targets Spring Boot 3.x /
+// Spring Framework 6 (Spring Modulith 2.x requires Spring Boot 4 / Framework 7 —
+// see https://github.com/spring-projects/spring-modulith/issues/971). arbiter
+// detects "spring-boot" in the build file without resolving the exact Boot
+// version, so the 1.4.x line is the safe default for the common case.
+
+dependencies {
+    testImplementation 'org.springframework.modulith:spring-modulith-starter-test:1.4.12'
+}

package/dist/templates/java/modulith/modulith-maven-setup.md.ejs

@@ -0,0 +1,21 @@
+# Spring Modulith Test Dependency (Maven)
+
+Generated by arbiter (#1886). `ApplicationModulesTest.java` imports
+`org.springframework.modulith.core.ApplicationModules`, which is not on the
+classpath by default — add this dependency to your `pom.xml` under
+`<dependencies>` or the build will fail to compile.
+
+Pinned to the Spring Modulith 1.4.x line, which targets Spring Boot 3.x / Spring
+Framework 6 (Spring Modulith 2.x requires Spring Boot 4 / Framework 7 — see
+https://github.com/spring-projects/spring-modulith/issues/971). If your project
+is on Spring Boot 4, use the matching 2.x version instead.
+
+```xml
+<!-- Spring Modulith — structural module verification (ApplicationModules.verify()) -->
+<dependency>
+    <groupId>org.springframework.modulith</groupId>
+    <artifactId>spring-modulith-starter-test</artifactId>
+    <version>1.4.12</version>
+    <scope>test</scope>
+</dependency>
+```

package/dist/templates/java/pharma/AuditEvent.java.ejs

@@ -0,0 +1,138 @@
+package <%= basePackage ? basePackage + '.audit' : 'audit' %>;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.EnumType;
+import jakarta.persistence.Enumerated;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import java.time.Instant;
+import java.util.UUID;
+
+/**
+ * Pharma audit event entity — KIT dims 73-74.
+ *
+ * Captures every mutable operation performed on a regulated entity.
+ * Required by 21 CFR Part 11 §11.10(e) and EU Annex 11 §12.4.
+ *
+ * Generated by arbiter pharma overlay (#888). Do not remove fields;
+ * audit logs are regulatory artefacts and must be immutable once written.
+ *
+ * Rules enforced by ArchUnit R-35..R-39 (PharmaArchUnitTest.java).
+ */
+@Entity
+@Table(name = "audit_events")
+public class AuditEvent {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    private UUID id;
+
+    /** Who performed the action — maps to authenticated user ID or system identity. */
+    @Column(name = "actor_id", nullable = false, length = 256)
+    private String actorId;
+
+    /** Human-readable action label, e.g. "CREATE", "UPDATE", "DELETE", "APPROVE". */
+    @Column(name = "action", nullable = false, length = 64)
+    private String action;
+
+    /** Qualified class name of the regulated entity, e.g. "com.example.domain.Batch". */
+    @Column(name = "entity_type", nullable = false, length = 512)
+    private String entityType;
+
+    /** Primary key of the entity that was mutated. */
+    @Column(name = "entity_id", nullable = false, length = 256)
+    private String entityId;
+
+    /** JSON snapshot of the entity state before mutation. Null for CREATE. */
+    @Column(name = "old_value", columnDefinition = "TEXT")
+    private String oldValue;
+
+    /** JSON snapshot of the entity state after mutation. Null for DELETE. */
+    @Column(name = "new_value", columnDefinition = "TEXT")
+    private String newValue;
+
+    /** Correlation ID linking this event to the originating HTTP request or job. */
+    @Column(name = "correlation_id", length = 64)
+    private String correlationId;
+
+    /** Audit trail source context — R-37: must be set to SYSTEM for automated mutations. */
+    @Enumerated(EnumType.STRING)
+    @Column(name = "source_context", nullable = false, length = 32)
+    private SourceContext sourceContext = SourceContext.HUMAN;
+
+    /** UTC timestamp when the event was persisted. Never null. */
+    @Column(name = "recorded_at", nullable = false, updatable = false)
+    private Instant recordedAt;
+
+    /**
+     * Source context discriminator — R-37 (PharmaArchUnitTest).
+     * Automated system mutations MUST use SYSTEM; human-triggered mutations use HUMAN.
+     */
+    public enum SourceContext {
+        HUMAN,
+        SYSTEM,
+    }
+
+    protected AuditEvent() {
+        // JPA requires no-arg constructor
+    }
+
+    private AuditEvent(Builder builder) {
+        this.actorId = builder.actorId;
+        this.action = builder.action;
+        this.entityType = builder.entityType;
+        this.entityId = builder.entityId;
+        this.oldValue = builder.oldValue;
+        this.newValue = builder.newValue;
+        this.correlationId = builder.correlationId;
+        this.sourceContext = builder.sourceContext;
+        this.recordedAt = Instant.now();
+    }
+
+    public UUID getId() { return id; }
+    public String getActorId() { return actorId; }
+    public String getAction() { return action; }
+    public String getEntityType() { return entityType; }
+    public String getEntityId() { return entityId; }
+    public String getOldValue() { return oldValue; }
+    public String getNewValue() { return newValue; }
+    public String getCorrelationId() { return correlationId; }
+    public SourceContext getSourceContext() { return sourceContext; }
+    public Instant getRecordedAt() { return recordedAt; }
+
+    /** Builder — enforces required fields at construction time (R-35). */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static final class Builder {
+        private String actorId;
+        private String action;
+        private String entityType;
+        private String entityId;
+        private String oldValue;
+        private String newValue;
+        private String correlationId;
+        private SourceContext sourceContext = SourceContext.HUMAN;
+
+        public Builder actorId(String actorId) { this.actorId = actorId; return this; }
+        public Builder action(String action) { this.action = action; return this; }
+        public Builder entityType(String entityType) { this.entityType = entityType; return this; }
+        public Builder entityId(String entityId) { this.entityId = entityId; return this; }
+        public Builder oldValue(String oldValue) { this.oldValue = oldValue; return this; }
+        public Builder newValue(String newValue) { this.newValue = newValue; return this; }
+        public Builder correlationId(String correlationId) { this.correlationId = correlationId; return this; }
+        public Builder sourceContext(SourceContext ctx) { this.sourceContext = ctx; return this; }
+
+        public AuditEvent build() {
+            if (actorId == null || actorId.isBlank()) throw new IllegalStateException("actorId required (R-35)");
+            if (action == null || action.isBlank()) throw new IllegalStateException("action required (R-35)");
+            if (entityType == null || entityType.isBlank()) throw new IllegalStateException("entityType required (R-35)");
+            if (entityId == null || entityId.isBlank()) throw new IllegalStateException("entityId required (R-35)");
+            return new AuditEvent(this);
+        }
+    }
+}

package/dist/templates/java/pharma/AuditMapper.java.ejs

@@ -0,0 +1,60 @@
+package <%= basePackage ? basePackage + '.audit' : 'audit' %>;
+
+import org.mapstruct.Mapper;
+import org.mapstruct.Mapping;
+import org.mapstruct.factory.Mappers;
+
+/**
+ * MapStruct audit trail mapper — KIT dim 75.
+ *
+ * Converts domain audit request DTOs to AuditEvent JPA entities.
+ * MapStruct generates the implementation at compile time — no runtime reflection.
+ *
+ * Usage (Spring injection):
+ *   {@code @Autowired AuditMapper auditMapper; }
+ *
+ * Usage (static, non-Spring):
+ *   {@code AuditMapper.INSTANCE.toEntity(request); }
+ *
+ * Generated by arbiter pharma overlay (#888).
+ * See PharmaArchUnitTest.java R-38 — AuditMapper must reside in the audit package.
+ */
+@Mapper(componentModel = "spring")
+public interface AuditMapper {
+
+    /** Singleton for non-Spring contexts (e.g. unit tests). */
+    AuditMapper INSTANCE = Mappers.getMapper(AuditMapper.class);
+
+    /**
+     * Map an audit request to an AuditEvent entity.
+     *
+     * @param request populated audit request from domain service
+     * @return a new AuditEvent ready to be persisted
+     */
+    @Mapping(target = "id", ignore = true)
+    @Mapping(target = "recordedAt", ignore = true)
+    AuditEvent toEntity(AuditRequest request);
+
+    /**
+     * Lightweight DTO carrying the fields needed to construct an AuditEvent.
+     * Domain services create and populate this; the mapper converts it.
+     */
+    record AuditRequest(
+        /** Required: authenticated user ID or system identity. */
+        String actorId,
+        /** Required: action label, e.g. "CREATE", "APPROVE". */
+        String action,
+        /** Required: qualified entity class name. */
+        String entityType,
+        /** Required: primary key of the mutated entity. */
+        String entityId,
+        /** Optional: JSON snapshot before mutation. Null for new entities. */
+        String oldValue,
+        /** Optional: JSON snapshot after mutation. Null for deletions. */
+        String newValue,
+        /** Optional: HTTP correlation ID or job ID. */
+        String correlationId,
+        /** Required: HUMAN for user actions, SYSTEM for automated mutations (R-37). */
+        AuditEvent.SourceContext sourceContext
+    ) {}
+}