@idevconn/create-icore 0.7.2 → 0.9.0

package/dist/index.js

@@ -4,9 +4,9 @@ function pmRun(pm, script) {
 }
 
 // src/lib/scaffold.ts
-import { copyFile, mkdir as mkdir2, readdir as readdir2, readFile as readFile4, stat, writeFile as writeFile4, rm as rm2 } from "fs/promises";
+import { copyFile, mkdir as mkdir2, readdir as readdir2, readFile as readFile6, stat, writeFile as writeFile8, rm as rm4 } from "fs/promises";
 import { readFileSync } from "fs";
-import { join as join4 } from "path";
+import { join as join8 } from "path";
 import { spawnSync } from "child_process";
 
 // src/lib/scaffold-env.ts
@@ -47,6 +47,31 @@ async function stripGatewayTransport(targetDir, prefix) {
   } catch {
   }
 }
+var ROOT_PROVIDER_SDKS = {
+  supabase: ["@supabase/supabase-js"],
+  cloudinary: ["cloudinary"],
+  mongodb: ["mongoose"],
+  firebase: ["firebase-admin"]
+};
+async function pruneRootProviderDeps(targetDir, opts) {
+  const chosen = /* @__PURE__ */ new Set([opts.authProvider, opts.dbProvider, opts.upload]);
+  const drop = /* @__PURE__ */ new Set();
+  for (const [provider, sdks] of Object.entries(ROOT_PROVIDER_SDKS)) {
+    if (!chosen.has(provider)) for (const sdk of sdks) drop.add(sdk);
+  }
+  if (drop.size === 0) return;
+  const pkgPath = join(targetDir, "package.json");
+  try {
+    const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+    for (const field of ["dependencies", "devDependencies"]) {
+      const deps = pkg[field];
+      if (!deps) continue;
+      for (const sdk of drop) delete deps[sdk];
+    }
+    await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  } catch {
+  }
+}
 async function rewriteRootPackageJson(targetDir, opts) {
   const pkgPath = join(targetDir, "package.json");
   const raw = await readFile(pkgPath, "utf8");
@@ -64,6 +89,11 @@ async function rewriteRootPackageJson(targetDir, opts) {
     const deps = pkg["dependencies"] ??= {};
     Object.assign(deps, MONGODB_DEPS);
   }
+  if (opts.authProvider === "mongodb") {
+    const devDeps = pkg["devDependencies"] ??= {};
+    devDeps["@types/bcrypt"] = "^6.0.0";
+    devDeps["@types/jsonwebtoken"] = "^9.0.10";
+  }
   if (opts.packageManager !== "yarn") {
     delete pkg.packageManager;
   } else {
@@ -186,326 +216,75 @@ async function stripTsconfigPath(targetDir, alias) {
   } catch {
   }
 }
-async function removeJobsStack(targetDir) {
-  const paths = [
-    "apps/microservices/jobs",
-    "libs/jobs-client",
-    "apps/api/src/app/admin",
-    "Dockerfile.ms-jobs"
-  ];
-  for (const p2 of paths) {
-    await rm(join2(targetDir, p2), { recursive: true, force: true });
-  }
-  const appModulePath = join2(targetDir, "apps/api/src/app/app.module.ts");
-  try {
-    const appModule = await readFile2(appModulePath, "utf8");
-    const next = appModule.replace(/^import \{ AdminModule \} from '\.\/admin\/admin\.module';\n/m, "").replace(/,\s*AdminModule/g, "");
-    await writeFile2(appModulePath, next);
-  } catch {
-  }
-  await stripDeps(join2(targetDir, "apps/api/package.json"), [
-    "@icore/jobs-client",
-    "@bull-board/api",
-    "@bull-board/express"
+async function removeFirebaseAdminLib(targetDir) {
+  await rm(join2(targetDir, "libs/firebase-admin"), { recursive: true, force: true });
+  await stripTsconfigPath(targetDir, "@icore/firebase-admin");
+  await stripDeps(join2(targetDir, "apps/microservices/auth/package.json"), [
+    "@icore/firebase-admin"
   ]);
-  const composePath = join2(targetDir, "docker-compose.yml");
-  try {
-    const compose = await readFile2(composePath, "utf8");
-    const next = compose.replace(/\n {2}jobs:[\s\S]+?(?=\n {2}\w+:|\nnetworks:)/m, "\n").replace(/\n {6}jobs:\n {8}condition: service_started/g, "").replace(/\n {6}JOBS_REDIS_URL:[^\n]*/g, "");
-    await writeFile2(composePath, next);
-  } catch {
-  }
-}
-async function removePaymentStack(targetDir) {
-  const paths = [
-    "apps/microservices/payment",
-    "apps/microservices/payment-e2e",
-    "libs/payment-client",
-    "apps/api/src/app/payment"
-  ];
-  for (const p2 of paths) {
-    await rm(join2(targetDir, p2), { recursive: true, force: true });
-  }
-  const appModulePath = join2(targetDir, "apps/api/src/app/app.module.ts");
-  try {
-    const appModule = await readFile2(appModulePath, "utf8");
-    const next = appModule.replace(/^import \{ PaymentModule \} from '\.\/payment\/payment\.module';\n/m, "").replace(/,\s*PaymentModule/g, "");
-    await writeFile2(appModulePath, next);
-  } catch {
-  }
-  await stripDeps(join2(targetDir, "apps/api/package.json"), [
-    "@icore/payment-client",
-    "@idevconn/payment"
+  await stripDeps(join2(targetDir, "apps/microservices/upload/package.json"), [
+    "@icore/firebase-admin"
+  ]);
+  await stripDeps(join2(targetDir, "apps/microservices/notes/package.json"), [
+    "@icore/firebase-admin"
   ]);
-  await stripGatewayTransport(targetDir, "PAYMENT");
-  const mainTsPath = join2(targetDir, "apps/api/src/main.ts");
-  try {
-    const src = await readFile2(mainTsPath, "utf8");
-    const next = src.replace(/\n\s*\{ name: 'payment', prefix: 'PAYMENT' \},/, "");
-    await writeFile2(mainTsPath, next);
-  } catch {
-  }
 }
-async function removeNotesStack(targetDir) {
-  for (const p2 of [
-    "apps/microservices/notes",
-    "apps/microservices/notes-e2e",
-    "libs/notes-client",
-    "apps/api/src/app/notes",
-    "apps/client/src/components/notes"
-  ]) {
+async function removeAuthStack(targetDir) {
+  const rmPaths = [
+    "apps/microservices/auth",
+    "libs/auth-strategies",
+    "libs/auth-client",
+    "Dockerfile.ms-auth",
+    "apps/api/src/app/auth",
+    "apps/api/src/app/profile",
+    "apps/api/src/app/abilities",
+    "apps/client/src/components/auth",
+    "apps/client/src/routes/login.tsx",
+    "apps/client/src/routes/auth.callback.tsx",
+    "apps/client/src/routes/auth.oauth.callback.tsx",
+    "apps/client/src/routes/_dashboard/profile.tsx"
+  ];
+  for (const p2 of rmPaths) {
     await rm(join2(targetDir, p2), { recursive: true, force: true });
   }
-  await rm(join2(targetDir, "apps/client/src/routes/_dashboard/notes.tsx"), { force: true });
-  await rm(join2(targetDir, "apps/client/src/queries/notes.ts"), { force: true });
   const appModulePath = join2(targetDir, "apps/api/src/app/app.module.ts");
   try {
     const src = await readFile2(appModulePath, "utf8");
-    const next = src.replace(/^import \{ NotesModule \} from '\.\/notes\/notes\.module';\n/m, "").replace(/,\s*NotesModule/g, "");
+    const next = src.replace(/^import \{ AuthModule \} from '\.\/auth\/auth\.module';\n/m, "").replace(/^import \{ ProfileModule \} from '\.\/profile\/profile\.module';\n/m, "").replace(/^import \{ AbilitiesModule \} from '\.\/abilities\/abilities\.module';\n/m, "").replace(/\bAuthModule,\s*/g, "").replace(/,\s*AuthModule\b/g, "").replace(/\bProfileModule,\s*/g, "").replace(/,\s*ProfileModule\b/g, "").replace(/\bAbilitiesModule,\s*/g, "").replace(/,\s*AbilitiesModule\b/g, "");
     await writeFile2(appModulePath, next);
   } catch {
   }
-  await stripDeps(join2(targetDir, "apps/api/package.json"), [
-    "@icore/notes-client",
-    "@casl/ability"
-  ]);
-  await stripGatewayTransport(targetDir, "NOTES");
-  const mainTsPath = join2(targetDir, "apps/api/src/main.ts");
+  const dashboardPath = join2(targetDir, "apps/client/src/routes/_dashboard.tsx");
   try {
-    const src = await readFile2(mainTsPath, "utf8");
-    const next = src.replace(/\n\s*\{ name: 'notes', prefix: 'NOTES' \},/, "");
-    await writeFile2(mainTsPath, next);
+    const src = await readFile2(dashboardPath, "utf8");
+    const next = src.replace(/^import \{ useAuthStore \} from '@icore\/template-shared';\n/m, "").replace(/, redirect/g, "").replace(/\n {2}beforeLoad: \(\) => \{[\s\S]*?\n {2}\},/m, "");
+    await writeFile2(dashboardPath, next);
   } catch {
   }
-  const tsconfigPath = join2(targetDir, "tsconfig.base.json");
-  try {
-    const src = await readFile2(tsconfigPath, "utf8");
-    const next = src.replace(/^\s*"@icore\/notes-client": \[[^\]]*\],?\n/m, "");
-    await writeFile2(tsconfigPath, next);
-  } catch {
-  }
-  const siderPath = join2(targetDir, "apps/client/src/components/layout/LayoutSider.tsx");
-  try {
-    const src = await readFile2(siderPath, "utf8");
-    const next = src.replace(", StickyNote", "").replace(/\n {8}<Link\n {10}to="\/(?:_dashboard\/)?notes"[\s\S]*?<\/Link>/, "").replace(", FileTextOutlined", "").replace(
-      "const selectedKey = pathname.includes('/notes')\n    ? 'notes'\n    : pathname.includes('/profile')",
-      "const selectedKey = pathname.includes('/profile')"
-    ).replace(
-      /\n {4}\{\n {6}key: 'notes',\n {6}icon: <FileTextOutlined \/>,\n {6}label: <Link to="\/(?:_dashboard\/)?notes">\{t\('notes\.title'\)\}<\/Link>,\n {4}\},/,
-      ""
-    ).replace("import NoteOutlinedIcon from '@mui/icons-material/NoteOutlined';\n", "").replace(
-      /\n {8}<ListItemButton\n {10}component=\{Link\}\n {10}to="\/(?:_dashboard\/)?notes"[\s\S]*?<\/ListItemButton>/,
-      ""
-    ).replace(/\n\s*<Link to="\/(?:_dashboard\/)?notes">[\s\S]*?<\/Link>/m, "");
-    await writeFile2(siderPath, next);
-  } catch {
+  for (const alias of [
+    "@icore/auth-client",
+    "@icore/auth-supabase",
+    "@icore/auth-firebase",
+    "@icore/auth-mongodb"
+  ]) {
+    await stripTsconfigPath(targetDir, alias);
   }
-  const keysPath = join2(targetDir, "libs/template-shared/src/lib/i18n/keys.ts");
+  await stripDeps(join2(targetDir, "apps/api/package.json"), ["@icore/auth-client"]);
+  const gatewayEnv = join2(targetDir, "apps/api/.env");
   try {
-    const src = await readFile2(keysPath, "utf8");
-    const next = src.replace(/^\s{4}notes: \{\n(?:\s+.*\n)*?\s{4}\},\n/m, "");
-    await writeFile2(keysPath, next);
+    const env = await readFile2(gatewayEnv, "utf8");
+    const next = env.split("\n").filter((line) => !line.startsWith("AUTH_") && !line.startsWith("# AUTH_")).join("\n");
+    await writeFile2(gatewayEnv, next);
   } catch {
   }
-}
-async function removeUnusedAuthStrategies(targetDir, authProvider) {
-  const modulePath = join2(targetDir, "apps/microservices/auth/src/app/app.module.ts");
-  const AUTH_BRANCH = /if \(provider === 'supabase'\) return makeSupabaseAuth\(cfg\);\n\s*if \(provider === 'mongodb'\) return makeMongoDbAuth\(connection, cfg\);\n\s*return makeFirebaseAuth\(cfg\);/m;
-  if (authProvider === "supabase") {
-    await rm(join2(targetDir, "libs/auth-strategies/firebase"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/auth-strategies/mongodb"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/auth/package.json"), [
-      "@icore/auth-firebase",
-      "@icore/firebase-admin",
-      "@icore/auth-mongodb"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/auth-firebase");
-    await stripTsconfigPath(targetDir, "@icore/auth-mongodb");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{[^}]*\} from '@icore\/firebase-admin';\n/gm, "").replace(/^import \{[^}]*FirebaseAuthStrategy[^}]*\} from '@icore\/auth-firebase';\n/gm, "").replace(/^import \{[^}]*MongoDbAuthStrategy[^}]*\} from '@icore\/auth-mongodb';\n/gm, "").replace(
-        /^import \{ MongooseModule, getConnectionToken \} from '@nestjs\/mongoose';\n/gm,
-        ""
-      ).replace(/^import \{ Connection \} from 'mongoose';\n/gm, "").replace(/^ {2}firebase: \[[^\]]*\],\n/gm, "").replace(/^ {2}mongodb: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeFirebaseAuth[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeMongoDbAuth[\s\S]*?\n}\n/gm, "").replace(/^ {4}MongooseModule\.forRootAsync[\s\S]*?\n {4}\}\),\n/gm, "").replace(AUTH_BRANCH, "return makeSupabaseAuth(cfg);").replace(/, connection: Connection/, "").replace(/, getConnectionToken\(\)/, "");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-  if (authProvider === "firebase") {
-    await rm(join2(targetDir, "libs/auth-strategies/supabase"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/auth-strategies/mongodb"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/auth/package.json"), [
-      "@icore/auth-supabase",
-      "@icore/auth-mongodb"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/auth-supabase");
-    await stripTsconfigPath(targetDir, "@icore/auth-mongodb");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{ createClient \} from '@supabase\/supabase-js';\n/gm, "").replace(/^import \{[^}]*SupabaseAuthStrategy[^}]*\} from '@icore\/auth-supabase';\n/gm, "").replace(/^import \{[^}]*MongoDbAuthStrategy[^}]*\} from '@icore\/auth-mongodb';\n/gm, "").replace(
-        /^import \{ MongooseModule, getConnectionToken \} from '@nestjs\/mongoose';\n/gm,
-        ""
-      ).replace(/^import \{ Connection \} from 'mongoose';\n/gm, "").replace(/^ {2}supabase: \[[^\]]*\],\n/gm, "").replace(/^ {2}mongodb: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeSupabaseAuth[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeMongoDbAuth[\s\S]*?\n}\n/gm, "").replace(/^ {4}MongooseModule\.forRootAsync[\s\S]*?\n {4}\}\),\n/gm, "").replace(AUTH_BRANCH, "return makeFirebaseAuth(cfg);").replace(/, connection: Connection/, "").replace(/, getConnectionToken\(\)/, "");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-  if (authProvider === "mongodb") {
-    await rm(join2(targetDir, "libs/auth-strategies/supabase"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/auth-strategies/firebase"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/auth/package.json"), [
-      "@icore/auth-supabase",
-      "@icore/auth-firebase",
-      "@icore/firebase-admin"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/auth-supabase");
-    await stripTsconfigPath(targetDir, "@icore/auth-firebase");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{ createClient \} from '@supabase\/supabase-js';\n/gm, "").replace(/^import \{[^}]*SupabaseAuthStrategy[^}]*\} from '@icore\/auth-supabase';\n/gm, "").replace(/^import \{[^}]*\} from '@icore\/firebase-admin';\n/gm, "").replace(/^import \{[^}]*FirebaseAuthStrategy[^}]*\} from '@icore\/auth-firebase';\n/gm, "").replace(/^ {2}supabase: \[[^\]]*\],\n/gm, "").replace(/^ {2}firebase: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeSupabaseAuth[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeFirebaseAuth[\s\S]*?\n}\n/gm, "").replace(AUTH_BRANCH, "return makeMongoDbAuth(connection, cfg);");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-}
-async function removeUnusedStorageStrategies(targetDir, uploadProvider) {
-  if (uploadProvider === "none") return;
-  const modulePath = join2(targetDir, "apps/microservices/upload/src/app/app.module.ts");
-  const STORAGE_BRANCH = /if \(provider === 'supabase'\) return makeSupabaseStorage\(cfg\);\n\s*if \(provider === 'firebase'\) return makeFirebaseStorage\(cfg\);\n\s*if \(provider === 'mongodb'\) return makeMongoDbStorage\(connection\);\n\s*return makeCloudinaryStorage\(cfg\);/m;
-  if (uploadProvider !== "firebase") {
-    await rm(join2(targetDir, "libs/storage-strategies/firebase"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/upload/package.json"), [
-      "@icore/storage-firebase",
-      "@icore/firebase-admin"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/storage-firebase");
-  }
-  if (uploadProvider !== "cloudinary") {
-    await rm(join2(targetDir, "libs/storage-strategies/cloudinary"), {
-      recursive: true,
-      force: true
-    });
-    await stripDeps(join2(targetDir, "apps/microservices/upload/package.json"), [
-      "@icore/storage-cloudinary"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/storage-cloudinary");
-  }
-  if (uploadProvider !== "supabase") {
-    await rm(join2(targetDir, "libs/storage-strategies/supabase"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/upload/package.json"), [
-      "@icore/storage-supabase"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/storage-supabase");
-  }
-  if (uploadProvider !== "mongodb") {
-    await rm(join2(targetDir, "libs/storage-strategies/mongodb"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/upload/package.json"), [
-      "@icore/storage-mongodb"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/storage-mongodb");
-  }
+  const composePath = join2(targetDir, "docker-compose.yml");
   try {
-    let src = await readFile2(modulePath, "utf8");
-    if (uploadProvider !== "firebase") {
-      src = src.replace(/^import \{[^}]*\} from '@icore\/firebase-admin';\n/gm, "").replace(
-        /^import \{[^}]*FirebaseStorageStrategy[^}]*\} from '@icore\/storage-firebase';\n/gm,
-        ""
-      ).replace(/^ {2}firebase: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeFirebaseStorage[\s\S]*?\n}\n/gm, "");
-    }
-    if (uploadProvider !== "cloudinary") {
-      src = src.replace(/^import \{ v2 as cloudinary \} from 'cloudinary';\n/gm, "").replace(
-        /^import \{[^}]*CloudinaryStorageStrategy[^}]*\} from '@icore\/storage-cloudinary';\n/gm,
-        ""
-      ).replace(/\nfunction makeCloudinaryStorage[\s\S]*?\n}\n/gm, "");
-    }
-    if (uploadProvider !== "supabase") {
-      src = src.replace(/^import \{ createClient \} from '@supabase\/supabase-js';\n/gm, "").replace(
-        /^import \{[^}]*SupabaseStorageStrategy[^}]*\} from '@icore\/storage-supabase';\n/gm,
-        ""
-      ).replace(/\nfunction makeSupabaseStorage[\s\S]*?\n}\n/gm, "");
-    }
-    if (uploadProvider !== "mongodb") {
-      src = src.replace(
-        /^import \{[^}]*MongoDbStorageStrategy[^}]*\} from '@icore\/storage-mongodb';\n/gm,
-        ""
-      ).replace(
-        /^import \{ MongooseModule, getConnectionToken \} from '@nestjs\/mongoose';\n/gm,
-        ""
-      ).replace(/^import \{ Connection \} from 'mongoose';\n/gm, "").replace(/^ {2}mongodb: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeMongoDbStorage[\s\S]*?\n}\n/gm, "").replace(/^ {4}MongooseModule\.forRootAsync[\s\S]*?\n {4}\}\),\n/gm, "");
-    }
-    const chosenReturn = uploadProvider === "mongodb" ? `return makeMongoDbStorage(connection);` : `return make${uploadProvider.charAt(0).toUpperCase() + uploadProvider.slice(1)}Storage(cfg);`;
-    src = src.replace(STORAGE_BRANCH, chosenReturn);
-    if (uploadProvider !== "mongodb") {
-      src = src.replace(/, connection: Connection/, "").replace(/, getConnectionToken\(\)/, "");
-    }
-    await writeFile2(modulePath, src);
+    const compose = await readFile2(composePath, "utf8");
+    const next = compose.replace(/\n {2}auth:[\s\S]+?(?=\n {2}\w|\nnetworks:)/m, "\n").replace(/\n {6}auth:\n {8}condition: service_started/g, "").replace(/\n {6}AUTH_TRANSPORT:[^\n]*/g, "").replace(/\n {6}AUTH_REDIS_URL:[^\n]*/g, "");
+    await writeFile2(composePath, next);
   } catch {
   }
 }
-async function removeUnusedDbStrategies(targetDir, dbProvider) {
-  const modulePath = join2(targetDir, "apps/microservices/notes/src/app/app.module.ts");
-  const DB_BRANCH = /if \(provider === 'supabase'\) return makeSupabaseDB\(cfg\);\n\s*if \(provider === 'mongodb'\) return makeMongoDb\(connection\);\n\s*return makeFirestoreDB\(cfg\);/m;
-  if (dbProvider === "supabase") {
-    await rm(join2(targetDir, "libs/db-strategies/firestore"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/db-strategies/mongodb"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/notes/package.json"), [
-      "@icore/db-firestore",
-      "@icore/firebase-admin",
-      "@icore/db-mongodb"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/db-firestore");
-    await stripTsconfigPath(targetDir, "@icore/db-mongodb");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{[^}]*\} from '@icore\/firebase-admin';\n/gm, "").replace(/^import \{[^}]*FirestoreDBStrategy[^}]*\} from '@icore\/db-firestore';\n/gm, "").replace(/^import \{[^}]*MongoDbDBStrategy[^}]*\} from '@icore\/db-mongodb';\n/gm, "").replace(
-        /^import \{ MongooseModule, getConnectionToken \} from '@nestjs\/mongoose';\n/gm,
-        ""
-      ).replace(/^import \{ Connection \} from 'mongoose';\n/gm, "").replace(/^ {2}firestore: \[[^\]]*\],\n/gm, "").replace(/^ {2}firebase: \[[^\]]*\],\n/gm, "").replace(/^ {2}mongodb: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeFirestoreDB[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeMongoDb[\s\S]*?\n}\n/gm, "").replace(/^ {4}MongooseModule\.forRootAsync[\s\S]*?\n {4}\}\),\n/gm, "").replace(DB_BRANCH, "return makeSupabaseDB(cfg);").replace(/, connection: Connection/, "").replace(/, getConnectionToken\(\)/, "");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-  if (dbProvider === "firebase") {
-    await rm(join2(targetDir, "libs/db-strategies/supabase"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/db-strategies/mongodb"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/notes/package.json"), [
-      "@icore/db-supabase",
-      "@icore/db-mongodb"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/db-supabase");
-    await stripTsconfigPath(targetDir, "@icore/db-mongodb");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{ createClient \} from '@supabase\/supabase-js';\n/gm, "").replace(/^import \{[^}]*SupabaseDBStrategy[^}]*\} from '@icore\/db-supabase';\n/gm, "").replace(/^import \{[^}]*MongoDbDBStrategy[^}]*\} from '@icore\/db-mongodb';\n/gm, "").replace(
-        /^import \{ MongooseModule, getConnectionToken \} from '@nestjs\/mongoose';\n/gm,
-        ""
-      ).replace(/^import \{ Connection \} from 'mongoose';\n/gm, "").replace(/^ {2}supabase: \[[^\]]*\],\n/gm, "").replace(/^ {2}mongodb: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeSupabaseDB[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeMongoDb[\s\S]*?\n}\n/gm, "").replace(/^ {4}MongooseModule\.forRootAsync[\s\S]*?\n {4}\}\),\n/gm, "").replace(/\nfunction requireEnv[\s\S]*?\n}\n/gm, "").replace(DB_BRANCH, "return makeFirestoreDB(cfg);").replace(/, connection: Connection/, "").replace(/, getConnectionToken\(\)/, "");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-  if (dbProvider === "mongodb") {
-    await rm(join2(targetDir, "libs/db-strategies/supabase"), { recursive: true, force: true });
-    await rm(join2(targetDir, "libs/db-strategies/firestore"), { recursive: true, force: true });
-    await stripDeps(join2(targetDir, "apps/microservices/notes/package.json"), [
-      "@icore/db-supabase",
-      "@icore/db-firestore",
-      "@icore/firebase-admin"
-    ]);
-    await stripTsconfigPath(targetDir, "@icore/db-supabase");
-    await stripTsconfigPath(targetDir, "@icore/db-firestore");
-    try {
-      const src = await readFile2(modulePath, "utf8");
-      const next = src.replace(/^import \{ createClient \} from '@supabase\/supabase-js';\n/gm, "").replace(/^import \{[^}]*SupabaseDBStrategy[^}]*\} from '@icore\/db-supabase';\n/gm, "").replace(/^import \{[^}]*\} from '@icore\/firebase-admin';\n/gm, "").replace(/^import \{[^}]*FirestoreDBStrategy[^}]*\} from '@icore\/db-firestore';\n/gm, "").replace(/^ {2}supabase: \[[^\]]*\],\n/gm, "").replace(/^ {2}firestore: \[[^\]]*\],\n/gm, "").replace(/^ {2}firebase: \[[^\]]*\],\n/gm, "").replace(/\nfunction makeSupabaseDB[\s\S]*?\n}\n/gm, "").replace(/\nfunction makeFirestoreDB[\s\S]*?\n}\n/gm, "").replace(/\nfunction requireEnv[\s\S]*?\n}\n/gm, "").replace(DB_BRANCH, "return makeMongoDb(connection);");
-      await writeFile2(modulePath, next);
-    } catch {
-    }
-  }
-}
-async function removeFirebaseAdminLib(targetDir) {
-  await rm(join2(targetDir, "libs/firebase-admin"), { recursive: true, force: true });
-  await stripTsconfigPath(targetDir, "@icore/firebase-admin");
-}
 async function removeUploadStack(targetDir) {
   const paths = [
     "apps/microservices/upload",
@@ -539,12 +318,443 @@ async function removeUploadStack(targetDir) {
   ]);
 }
 
-// src/lib/scaffold-pkg.ts
-import { readFile as readFile3, writeFile as writeFile3, mkdir, readdir } from "fs/promises";
+// src/manifest/wire-features.ts
+import { readFile as readFile4, writeFile as writeFile4, rm as rm3 } from "fs/promises";
+import { join as join4 } from "path";
+
+// src/manifest/index.ts
+var EMPTY = { libDirs: [], deps: {}, tsPaths: {} };
+var MANIFEST = {
+  auth: {
+    supabase: {
+      libDirs: ["libs/auth-strategies/supabase"],
+      deps: { "@supabase/supabase-js": "^2.106.2" },
+      tsPaths: { "@icore/auth-supabase": ["libs/auth-strategies/supabase/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/auth-supabase",
+        symbol: "SupabaseAuthModule",
+        into: "auth"
+      },
+      appTests: [
+        "apps/microservices/auth/src/app/__tests__/auth.controller.supabase.integration.unit.test.ts"
+      ]
+    },
+    firebase: {
+      libDirs: ["libs/auth-strategies/firebase"],
+      deps: {},
+      tsPaths: { "@icore/auth-firebase": ["libs/auth-strategies/firebase/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/auth-firebase",
+        symbol: "FirebaseAuthModule",
+        into: "auth"
+      },
+      appTests: [
+        "apps/microservices/auth/src/app/__tests__/auth.controller.firebase.integration.unit.test.ts"
+      ]
+    },
+    mongodb: {
+      libDirs: ["libs/auth-strategies/mongodb"],
+      deps: { mongoose: "^9.6.3" },
+      tsPaths: { "@icore/auth-mongodb": ["libs/auth-strategies/mongodb/src/index.ts"] },
+      nestModule: { importFrom: "@icore/auth-mongodb", symbol: "MongoDbAuthModule", into: "auth" }
+    }
+  },
+  storage: {
+    supabase: {
+      libDirs: ["libs/storage-strategies/supabase"],
+      deps: { "@supabase/supabase-js": "^2.106.2" },
+      tsPaths: { "@icore/storage-supabase": ["libs/storage-strategies/supabase/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/storage-supabase",
+        symbol: "SupabaseStorageModule",
+        into: "upload"
+      }
+    },
+    firebase: {
+      libDirs: ["libs/storage-strategies/firebase"],
+      deps: {},
+      tsPaths: { "@icore/storage-firebase": ["libs/storage-strategies/firebase/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/storage-firebase",
+        symbol: "FirebaseStorageModule",
+        into: "upload"
+      }
+    },
+    cloudinary: {
+      libDirs: ["libs/storage-strategies/cloudinary"],
+      deps: { cloudinary: "^2.10.0" },
+      tsPaths: { "@icore/storage-cloudinary": ["libs/storage-strategies/cloudinary/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/storage-cloudinary",
+        symbol: "CloudinaryStorageModule",
+        into: "upload"
+      }
+    },
+    mongodb: {
+      libDirs: ["libs/storage-strategies/mongodb"],
+      deps: { mongoose: "^9.6.3" },
+      tsPaths: { "@icore/storage-mongodb": ["libs/storage-strategies/mongodb/src/index.ts"] },
+      nestModule: {
+        importFrom: "@icore/storage-mongodb",
+        symbol: "MongoDbStorageModule",
+        into: "upload"
+      }
+    }
+  },
+  db: {
+    supabase: {
+      libDirs: ["libs/db-strategies/supabase"],
+      deps: { "@supabase/supabase-js": "^2.106.2" },
+      tsPaths: { "@icore/db-supabase": ["libs/db-strategies/supabase/src/index.ts"] },
+      nestModule: { importFrom: "@icore/db-supabase", symbol: "SupabaseDbModule", into: "notes" }
+    },
+    firebase: {
+      libDirs: ["libs/db-strategies/firestore"],
+      deps: {},
+      tsPaths: { "@icore/db-firestore": ["libs/db-strategies/firestore/src/index.ts"] },
+      nestModule: { importFrom: "@icore/db-firestore", symbol: "FirestoreDbModule", into: "notes" }
+    },
+    mongodb: {
+      libDirs: ["libs/db-strategies/mongodb"],
+      deps: { mongoose: "^9.6.3" },
+      tsPaths: { "@icore/db-mongodb": ["libs/db-strategies/mongodb/src/index.ts"] },
+      nestModule: { importFrom: "@icore/db-mongodb", symbol: "MongoDbDbModule", into: "notes" }
+    }
+  },
+  feature: {
+    notes: {
+      libDirs: [
+        "apps/microservices/notes",
+        "apps/microservices/notes-e2e",
+        "libs/notes-client",
+        "libs/db-strategies",
+        "apps/api/src/app/notes",
+        "apps/client/src/components/notes",
+        "apps/client/src/routes/_dashboard/notes.tsx",
+        "apps/client/src/queries/notes.ts"
+      ],
+      deps: { "@icore/notes-client": "*", "@casl/ability": "^7.0.0" },
+      tsPaths: { "@icore/notes-client": ["libs/notes-client/src/index.ts"] },
+      gatewayModule: { importFrom: "./notes/notes.module", symbol: "NotesModule" },
+      gatewayService: { name: "notes", prefix: "NOTES" },
+      clientNav: { route: "/notes", labelKey: "nav.notes", iconName: "notes" }
+    },
+    payment: {
+      libDirs: [
+        "apps/microservices/payment",
+        "apps/microservices/payment-e2e",
+        "libs/payment-client",
+        "apps/api/src/app/payment"
+      ],
+      deps: { "@icore/payment-client": "*", "@idevconn/payment": "^1.2.0" },
+      tsPaths: { "@icore/payment-client": ["libs/payment-client/src/index.ts"] },
+      gatewayModule: { importFrom: "./payment/payment.module", symbol: "PaymentModule" },
+      gatewayService: { name: "payment", prefix: "PAYMENT" }
+    },
+    jobs: {
+      libDirs: [
+        "apps/microservices/jobs",
+        "libs/jobs-client",
+        "apps/api/src/app/admin",
+        "Dockerfile.ms-jobs"
+      ],
+      deps: {
+        "@icore/jobs-client": "*",
+        "@bull-board/api": "^7.1.5",
+        "@bull-board/express": "^7.1.5"
+      },
+      tsPaths: { "@icore/jobs-client": ["libs/jobs-client/src/index.ts"] },
+      gatewayModule: { importFrom: "./admin/admin.module", symbol: "AdminModule" },
+      dockerService: "jobs"
+    }
+  },
+  ui: { shadcn: EMPTY, antd: EMPTY, mui: EMPTY },
+  transport: { tcp: EMPTY, redis: EMPTY, nats: EMPTY, mqtt: EMPTY, rmq: EMPTY, kafka: EMPTY },
+  shared: {
+    firebaseAdmin: {
+      libDirs: ["libs/firebase-admin"],
+      deps: { "firebase-admin": "^13.10.0" },
+      tsPaths: { "@icore/firebase-admin": ["libs/firebase-admin/src/index.ts"] }
+    }
+  }
+};
+
+// src/manifest/wire-provider.ts
+import { readFile as readFile3, writeFile as writeFile3, rm as rm2 } from "fs/promises";
 import { join as join3 } from "path";
+async function writeProvider(targetDir, axis, provider) {
+  const nestModule = axis.section[provider]?.nestModule;
+  if (!nestModule) throw new Error(`provider "${provider}" has no nestModule in the manifest`);
+  const { importFrom, symbol } = nestModule;
+  const content = `import { ${symbol} } from '${importFrom}';
+
+const ENV_PATH = '${axis.envPath}';
+
+export const ${axis.exportConst} = ${symbol}.forRoot(ENV_PATH);
+`;
+  await writeFile3(join3(targetDir, axis.providerFile), content);
+}
+async function stripJsonKeys(path, drop) {
+  try {
+    const pkg = JSON.parse(await readFile3(path, "utf8"));
+    for (const field of ["dependencies", "devDependencies"]) {
+      const deps = pkg[field];
+      if (!deps) continue;
+      for (const k of Object.keys(deps)) if (drop(k)) delete deps[k];
+    }
+    await writeFile3(path, JSON.stringify(pkg, null, 2) + "\n");
+  } catch {
+  }
+}
+async function stripTsconfigKeys(targetDir, aliases) {
+  const path = join3(targetDir, "tsconfig.base.json");
+  try {
+    const parsed = JSON.parse(await readFile3(path, "utf8"));
+    const paths = parsed.compilerOptions?.paths;
+    if (paths) for (const a of aliases) delete paths[a];
+    await writeFile3(path, JSON.stringify(parsed, null, 2) + "\n");
+  } catch {
+  }
+}
+async function cleanupUnusedAxis(targetDir, axis, chosen) {
+  for (const provider of Object.keys(axis.section)) {
+    if (provider === chosen) continue;
+    const unit = axis.section[provider];
+    for (const dir of unit.libDirs)
+      await rm2(join3(targetDir, dir), { recursive: true, force: true });
+    for (const t of unit.appTests ?? []) await rm2(join3(targetDir, t), { force: true });
+    const dropKeys = /* @__PURE__ */ new Set([...Object.keys(unit.tsPaths), ...Object.keys(unit.deps)]);
+    await stripJsonKeys(join3(targetDir, axis.msPackageJson), (k) => dropKeys.has(k));
+    await stripTsconfigKeys(targetDir, Object.keys(unit.tsPaths));
+  }
+}
+
+// src/manifest/wire-features.ts
+var FEATURES_MODULE = "apps/api/src/app/features.module.ts";
+var GATEWAY_SERVICES = "apps/api/src/app/gateway-services.ts";
+var API_PKG = "apps/api/package.json";
+var FEATURES = MANIFEST.feature;
+function selectedFeatures(opts) {
+  const out = [];
+  if (opts.example === "notes") out.push("notes");
+  if (opts.payment !== "none") out.push("payment");
+  if (opts.jobs !== "none") out.push("jobs");
+  return out;
+}
+async function writeFeaturesWiring(targetDir, opts) {
+  const chosen = selectedFeatures(opts);
+  const mods = chosen.map((k) => FEATURES[k].gatewayModule).filter((m) => !!m);
+  const imports = mods.map((m) => `import { ${m.symbol} } from '${m.importFrom}';`).join("\n");
+  const symbols = mods.map((m) => m.symbol).join(", ");
+  const featuresModule = `import { Module } from '@nestjs/common';
+` + (imports ? imports + "\n" : "") + `
+@Module({
+  imports: [${symbols}],
+})
+export class FeaturesModule {}
+`;
+  await writeFile4(join4(targetDir, FEATURES_MODULE), featuresModule);
+  const services = [];
+  if (opts.authProvider !== "none") services.push({ name: "auth", prefix: "AUTH" });
+  if (opts.upload !== "none") services.push({ name: "upload", prefix: "UPLOAD" });
+  for (const k of chosen) {
+    const svc = FEATURES[k].gatewayService;
+    if (svc) services.push(svc);
+  }
+  const entries = services.map((s) => `  { name: '${s.name}', prefix: '${s.prefix}' },`).join("\n");
+  const gatewayServices = `/** Microservices the gateway proxies. Generated by create-icore. */
+export const GATEWAY_SERVICES = [
+${entries}
+];
+`;
+  await writeFile4(join4(targetDir, GATEWAY_SERVICES), gatewayServices);
+}
+async function stripJobsDockerCompose(targetDir) {
+  const composePath = join4(targetDir, "docker-compose.yml");
+  try {
+    const compose = await readFile4(composePath, "utf8");
+    const next = compose.replace(/\n {2}jobs:[\s\S]+?(?=\n {2}\w+:|\nnetworks:)/m, "\n").replace(/\n {6}jobs:\n {8}condition: service_started/g, "").replace(/\n {6}JOBS_REDIS_URL:[^\n]*/g, "");
+    await writeFile4(composePath, next);
+  } catch {
+  }
+}
+async function cleanupUnusedFeatures(targetDir, opts) {
+  const chosen = new Set(selectedFeatures(opts));
+  for (const key of ["notes", "payment", "jobs"]) {
+    if (chosen.has(key)) continue;
+    const unit = FEATURES[key];
+    for (const dir of unit.libDirs)
+      await rm3(join4(targetDir, dir), { recursive: true, force: true });
+    const dropKeys = /* @__PURE__ */ new Set([...Object.keys(unit.tsPaths), ...Object.keys(unit.deps)]);
+    await stripJsonKeys(join4(targetDir, API_PKG), (k) => dropKeys.has(k));
+    await stripTsconfigKeys(targetDir, Object.keys(unit.tsPaths));
+    if (unit.gatewayService) await stripGatewayTransport(targetDir, unit.gatewayService.prefix);
+    if (unit.dockerService === "jobs") await stripJobsDockerCompose(targetDir);
+  }
+}
+
+// src/manifest/wire-client.ts
+import { writeFile as writeFile5 } from "fs/promises";
+import { join as join5 } from "path";
+var NAV_CONFIG_FILE = "apps/client/src/nav.config.ts";
+var BASE_NAV = [
+  { to: "/dashboard", labelKey: "nav.dashboard", iconName: "dashboard", exact: true }
+];
+var PROFILE_NAV = { to: "/profile", labelKey: "nav.profile", iconName: "profile" };
+function renderEntry(n) {
+  const parts = [`to: '${n.to}'`, `labelKey: '${n.labelKey}'`, `iconName: '${n.iconName}'`];
+  if (n.exact) parts.push("exact: true");
+  return `  { ${parts.join(", ")} },`;
+}
+async function writeNavConfig(targetDir, opts) {
+  const entries = [...BASE_NAV];
+  const notesNav = MANIFEST.feature.notes.clientNav;
+  if (opts.example === "notes" && notesNav) {
+    entries.push({
+      to: notesNav.route,
+      labelKey: notesNav.labelKey,
+      iconName: notesNav.iconName,
+      exact: notesNav.exact
+    });
+  }
+  entries.push(PROFILE_NAV);
+  const content = `/**
+ * Sidebar navigation. UI-agnostic: each LayoutSider maps \`iconName\` to its own
+ * icon library. Generated by create-icore.
+ */
+export interface NavItem {
+  to: string;
+  labelKey: string;
+  iconName: 'dashboard' | 'notes' | 'profile';
+  exact?: boolean;
+}
+
+export const NAV_CONFIG: NavItem[] = [
+` + entries.map(renderEntry).join("\n") + `
+];
+`;
+  await writeFile5(join5(targetDir, NAV_CONFIG_FILE), content);
+}
+
+// src/manifest/blueprint.ts
+import { writeFile as writeFile6 } from "fs/promises";
+import { join as join6 } from "path";
+async function writeBlueprintJson(targetDir, opts) {
+  const blueprint = {
+    schemaVersion: 1,
+    projectName: opts.projectName,
+    authProvider: opts.authProvider,
+    dbProvider: opts.dbProvider,
+    upload: opts.upload,
+    payment: opts.payment,
+    jobs: opts.jobs,
+    example: opts.example,
+    ui: opts.ui,
+    transport: opts.transport,
+    packageManager: opts.packageManager
+  };
+  await writeFile6(join6(targetDir, "blueprint.json"), JSON.stringify(blueprint, null, 2) + "\n");
+}
+async function writeJson(targetDir, rel, data) {
+  await writeFile6(join6(targetDir, rel, "blueprint.json"), JSON.stringify(data, null, 2) + "\n");
+}
+async function writeServiceBlueprints(targetDir, opts) {
+  const t = opts.transport;
+  if (opts.authProvider !== "none") {
+    await writeJson(targetDir, "apps/microservices/auth", {
+      schemaVersion: 1,
+      service: "auth",
+      authProvider: opts.authProvider,
+      transport: t
+    });
+  }
+  if (opts.upload !== "none") {
+    await writeJson(targetDir, "apps/microservices/upload", {
+      schemaVersion: 1,
+      service: "upload",
+      storageProvider: opts.upload,
+      transport: t
+    });
+  }
+  if (opts.example !== "none") {
+    await writeJson(targetDir, "apps/microservices/notes", {
+      schemaVersion: 1,
+      service: "notes",
+      dbProvider: opts.dbProvider,
+      transport: t
+    });
+  }
+  if (opts.payment !== "none") {
+    await writeJson(targetDir, "apps/microservices/payment", {
+      schemaVersion: 1,
+      service: "payment",
+      paymentProvider: opts.payment,
+      transport: t
+    });
+  }
+  if (opts.jobs !== "none") {
+    await writeJson(targetDir, "apps/microservices/jobs", {
+      schemaVersion: 1,
+      service: "jobs",
+      jobsProvider: opts.jobs
+    });
+  }
+  const features = [];
+  if (opts.example !== "none") features.push("notes");
+  if (opts.payment !== "none") features.push("payment");
+  if (opts.jobs !== "none") features.push("jobs");
+  await writeJson(targetDir, "apps/api", {
+    schemaVersion: 1,
+    service: "api",
+    features,
+    transport: t
+  });
+  await writeJson(targetDir, "apps/client", {
+    schemaVersion: 1,
+    service: "client",
+    ui: opts.ui
+  });
+}
+
+// src/manifest/wire-auth.ts
+var AUTH = {
+  section: MANIFEST.auth,
+  providerFile: "apps/microservices/auth/src/app/auth.provider.ts",
+  exportConst: "AuthProviderModule",
+  msPackageJson: "apps/microservices/auth/package.json",
+  envPath: "apps/microservices/auth/.env"
+};
+var writeAuthProvider = (targetDir, provider) => writeProvider(targetDir, AUTH, provider);
+var cleanupUnusedAuth = (targetDir, chosen) => cleanupUnusedAxis(targetDir, AUTH, chosen);
+
+// src/manifest/wire-storage.ts
+var STORAGE = {
+  section: MANIFEST.storage,
+  providerFile: "apps/microservices/upload/src/app/storage.provider.ts",
+  exportConst: "StorageProviderModule",
+  msPackageJson: "apps/microservices/upload/package.json",
+  envPath: "apps/microservices/upload/.env"
+};
+var writeStorageProvider = (targetDir, provider) => writeProvider(targetDir, STORAGE, provider);
+var cleanupUnusedStorage = (targetDir, chosen) => cleanupUnusedAxis(targetDir, STORAGE, chosen);
+
+// src/manifest/wire-db.ts
+var DB = {
+  section: MANIFEST.db,
+  providerFile: "apps/microservices/notes/src/app/db.provider.ts",
+  exportConst: "DbProviderModule",
+  msPackageJson: "apps/microservices/notes/package.json",
+  envPath: "apps/microservices/notes/.env"
+};
+var writeDbProvider = (targetDir, provider) => writeProvider(targetDir, DB, provider);
+var cleanupUnusedDb = (targetDir, chosen) => cleanupUnusedAxis(targetDir, DB, chosen);
+
+// src/lib/scaffold-pkg.ts
+import { readFile as readFile5, writeFile as writeFile7, mkdir, readdir } from "fs/promises";
+import { join as join7 } from "path";
 async function writePnpmWorkspace(targetDir) {
-  const pkgPath = join3(targetDir, "package.json");
-  const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
+  const pkgPath = join7(targetDir, "package.json");
+  const pkg = JSON.parse(await readFile5(pkgPath, "utf8"));
   const workspaces = pkg.workspaces ?? [];
   const packagesBlock = workspaces.map((p2) => `  - '${p2}'`).join("\n");
   const allowBuilds = [
@@ -553,7 +763,9 @@ async function writePnpmWorkspace(targetDir) {
     "@parcel/watcher",
     "@scarf/scarf",
     "@swc/core",
+    "bcrypt",
     "less",
+    "mongodb-memory-server",
     "msgpackr-extract",
     "nx",
     "protobufjs",
@@ -565,10 +777,10 @@ ${packagesBlock}
 allowBuilds:
 ${allowBuilds}
 `;
-  await writeFile3(join3(targetDir, "pnpm-workspace.yaml"), content);
+  await writeFile7(join7(targetDir, "pnpm-workspace.yaml"), content);
 }
 async function rewritePnpmWorkspaceDeps(targetDir) {
-  async function walk(dir) {
+  async function walk2(dir) {
     const found = [];
     let entries;
     try {
@@ -578,27 +790,27 @@ async function rewritePnpmWorkspaceDeps(targetDir) {
     }
     for (const e of entries) {
       if (e.isDirectory() && e.name !== "node_modules") {
-        found.push(...await walk(join3(dir, e.name)));
+        found.push(...await walk2(join7(dir, e.name)));
       } else if (e.isFile() && e.name === "package.json") {
-        found.push(join3(dir, e.name));
+        found.push(join7(dir, e.name));
       }
     }
     return found;
   }
-  const pkgFiles = await walk(targetDir);
+  const pkgFiles = await walk2(targetDir);
   for (const f of pkgFiles) {
     try {
-      const raw = await readFile3(f, "utf8");
+      const raw = await readFile5(f, "utf8");
       const next = raw.replace(/"(@icore\/[^"]+)":\s*"\*"/g, '"$1": "workspace:*"');
-      if (next !== raw) await writeFile3(f, next);
+      if (next !== raw) await writeFile7(f, next);
     } catch {
     }
   }
 }
 async function patchGitignoreForPm(targetDir, pm) {
-  const giPath = join3(targetDir, ".gitignore");
+  const giPath = join7(targetDir, ".gitignore");
   try {
-    let src = await readFile3(giPath, "utf8");
+    let src = await readFile5(giPath, "utf8");
     src = src.replace(/^# Build artifacts.*\ntools\/create-icore\/templates\/\s*\n/m, "");
     if (pm !== "yarn") {
       src = src.replace(/^\.yarn\/\*\s*\n/m, "").replace(/^!\.yarn\/patches\s*\n/m, "").replace(/^!\.yarn\/plugins\s*\n/m, "").replace(/^!\.yarn\/releases\s*\n/m, "").replace(/^!\.yarn\/sdks\s*\n/m, "").replace(/^!\.yarn\/versions\s*\n/m, "").replace(/^\.pnp\.\*\s*\n/m, "");
@@ -613,7 +825,7 @@ async function patchGitignoreForPm(targetDir, pm) {
         src += "\n# npm\nnpm-debug.log*\n";
       }
     }
-    await writeFile3(giPath, src);
+    await writeFile7(giPath, src);
   } catch {
   }
 }
@@ -628,7 +840,7 @@ async function writeAiFiles(targetDir, opts) {
   if (opts.jobs !== "none") activeMSes.push(`jobs (standalone)`);
   const usesSupabase = opts.authProvider === "supabase" || opts.dbProvider === "supabase" || opts.upload === "supabase";
   const usesFirebase = opts.authProvider === "firebase" || opts.dbProvider === "firebase" || opts.upload === "firebase";
-  await writeFile3(join3(targetDir, "CLAUDE.md"), "@AGENTS.md\n");
+  await writeFile7(join7(targetDir, "CLAUDE.md"), "@AGENTS.md\n");
   const uiLabel = { shadcn: "shadcn/ui + Tailwind", antd: "Ant Design 6", mui: "MUI 6" }[opts.ui];
   const readme = `# ${opts.projectName}
 
@@ -678,7 +890,7 @@ ${pm === "yarn" ? "yarn remove-notes" : pm === "pnpm" ? "pnpm remove-notes" : "n
 
 Apache-2.0
 `;
-  await writeFile3(join3(targetDir, "README.md"), readme);
+  await writeFile7(join7(targetDir, "README.md"), readme);
   const agents = `# ${opts.projectName} \u2014 Agent Instructions
 
 ## Stack snapshot
@@ -759,8 +971,8 @@ ${opts.upload !== "none" ? `| \`apps/microservices/upload/.env\` | \`STORAGE_PRO
 - Test behaviour, not implementation. Fake strategies from \`@icore/shared\` (FakeAuthStrategy etc.) serve as test doubles.
 - Run: \`${nx} test <project>\`
 `;
-  await writeFile3(join3(targetDir, "AGENTS.md"), agents);
-  await mkdir(join3(targetDir, ".claude"), { recursive: true });
+  await writeFile7(join7(targetDir, "AGENTS.md"), agents);
+  await mkdir(join7(targetDir, ".claude"), { recursive: true });
   const mcpServers = {
     nx: {
       command: "npx",
@@ -801,8 +1013,8 @@ ${opts.upload !== "none" ? `| \`apps/microservices/upload/.env\` | \`STORAGE_PRO
       ]
     }
   };
-  await writeFile3(
-    join3(targetDir, ".claude", "settings.json"),
+  await writeFile7(
+    join7(targetDir, ".claude", "settings.json"),
     JSON.stringify(settings, null, 2) + "\n"
   );
 }
@@ -826,16 +1038,16 @@ async function copyTree(src, dest) {
   const entries = await readdir2(src, { withFileTypes: true });
   for (const entry of entries) {
     if (IGNORE_TOP.has(entry.name)) continue;
-    const s = join4(src, entry.name);
-    const d = join4(dest, entry.name);
+    const s = join8(src, entry.name);
+    const d = join8(dest, entry.name);
     if (entry.isDirectory()) await copyTree(s, d);
     else if (entry.isFile()) await copyFile(s, d);
   }
 }
 async function selectClientTemplate(targetDir, opts) {
-  const templatesRoot = join4(targetDir, "apps/templates");
-  const chosen = join4(templatesRoot, `client-${opts.ui}`);
-  const destClient = join4(targetDir, "apps/client");
+  const templatesRoot = join8(targetDir, "apps/templates");
+  const chosen = join8(templatesRoot, `client-${opts.ui}`);
+  const destClient = join8(targetDir, "apps/client");
   let chosenUi = opts.ui;
   try {
     const s = await stat(chosen);
@@ -843,9 +1055,9 @@ async function selectClientTemplate(targetDir, opts) {
     await copyTree(chosen, destClient);
   } catch {
     chosenUi = "shadcn";
-    await copyTree(join4(templatesRoot, "client-shadcn"), destClient);
+    await copyTree(join8(templatesRoot, "client-shadcn"), destClient);
   }
-  await rm2(templatesRoot, { recursive: true, force: true });
+  await rm4(templatesRoot, { recursive: true, force: true });
   await rewriteClientPaths(destClient, chosenUi);
 }
 async function rewriteClientPaths(clientDir, ui) {
@@ -858,11 +1070,11 @@ async function rewriteClientPaths(clientDir, ui) {
     "eslint.config.mjs"
   ];
   for (const rel of candidates) {
-    const path = join4(clientDir, rel);
+    const path = join8(clientDir, rel);
     try {
-      const raw = await readFile4(path, "utf8");
+      const raw = await readFile6(path, "utf8");
       const next = raw.replaceAll("../../../", "../../").replaceAll(`apps/templates/client-${ui}`, "apps/client").replaceAll(`client-${ui}`, "client");
-      if (next !== raw) await writeFile4(path, next);
+      if (next !== raw) await writeFile8(path, next);
     } catch {
     }
   }
@@ -878,12 +1090,12 @@ function gitInit(cwd, projectName) {
 }
 function resolveYarnBin(cwd) {
   try {
-    const yarnrc = readFileSync(join4(cwd, ".yarnrc.yml"), "utf8");
+    const yarnrc = readFileSync(join8(cwd, ".yarnrc.yml"), "utf8");
     const match = yarnrc.match(/^yarnPath:\s*(.+)$/m);
-    if (match?.[1]) return join4(cwd, match[1].trim());
+    if (match?.[1]) return join8(cwd, match[1].trim());
   } catch {
   }
-  return join4(cwd, ".yarn", "releases", "yarn-4.5.0.cjs");
+  return join8(cwd, ".yarn", "releases", "yarn-4.5.0.cjs");
 }
 function runInstall(cwd, pm) {
   if (pm === "yarn") {
@@ -897,7 +1109,7 @@ function runInstall(cwd, pm) {
 async function scaffold(opts, templatesDir) {
   await copyTree(templatesDir, opts.targetDir);
   await rewriteRootPackageJson(opts.targetDir, opts);
-  await writeAuthEnv(opts.targetDir, opts);
+  if (opts.authProvider !== "none") await writeAuthEnv(opts.targetDir, opts);
   await writeUploadEnv(opts.targetDir, opts);
   await writeNotesEnv(opts.targetDir, opts);
   await writePaymentEnv(opts.targetDir, opts);
@@ -906,19 +1118,33 @@ async function scaffold(opts, templatesDir) {
   await selectClientTemplate(opts.targetDir, opts);
   await writeClientEnv(opts.targetDir);
   if (opts.upload === "none") await removeUploadStack(opts.targetDir);
-  if (opts.payment === "none") await removePaymentStack(opts.targetDir);
-  if (opts.jobs === "none") await removeJobsStack(opts.targetDir);
-  if (opts.example === "none") await removeNotesStack(opts.targetDir);
-  await removeUnusedAuthStrategies(opts.targetDir, opts.authProvider);
-  await removeUnusedStorageStrategies(opts.targetDir, opts.upload);
-  await removeUnusedDbStrategies(opts.targetDir, opts.dbProvider);
+  await cleanupUnusedFeatures(opts.targetDir, opts);
+  await writeFeaturesWiring(opts.targetDir, opts);
+  await writeNavConfig(opts.targetDir, opts);
+  if (opts.authProvider !== "none") {
+    await cleanupUnusedAuth(opts.targetDir, opts.authProvider);
+    await writeAuthProvider(opts.targetDir, opts.authProvider);
+  } else {
+    await removeAuthStack(opts.targetDir);
+  }
+  if (opts.upload !== "none") {
+    await cleanupUnusedStorage(opts.targetDir, opts.upload);
+    await writeStorageProvider(opts.targetDir, opts.upload);
+  }
   const firebaseUsed = opts.authProvider === "firebase" || opts.dbProvider === "firebase" || opts.upload === "firebase";
   if (!firebaseUsed) await removeFirebaseAdminLib(opts.targetDir);
+  await cleanupUnusedDb(opts.targetDir, opts.dbProvider);
+  if (opts.dbProvider !== "none" && opts.example !== "none") {
+    await writeDbProvider(opts.targetDir, opts.dbProvider);
+  }
+  await pruneRootProviderDeps(opts.targetDir, opts);
+  await writeBlueprintJson(opts.targetDir, opts);
+  await writeServiceBlueprints(opts.targetDir, opts);
   if (opts.packageManager === "yarn") {
-    await writeFile4(join4(opts.targetDir, "yarn.lock"), "");
+    await writeFile8(join8(opts.targetDir, "yarn.lock"), "");
   } else {
-    await rm2(join4(opts.targetDir, ".yarn"), { recursive: true, force: true });
-    await rm2(join4(opts.targetDir, ".yarnrc.yml"), { force: true });
+    await rm4(join8(opts.targetDir, ".yarn"), { recursive: true, force: true });
+    await rm4(join8(opts.targetDir, ".yarnrc.yml"), { force: true });
   }
   if (opts.packageManager === "pnpm") {
     await writePnpmWorkspace(opts.targetDir);
@@ -933,9 +1159,98 @@ async function scaffold(opts, templatesDir) {
 // src/lib/prompts.ts
 import * as p from "@clack/prompts";
 import { resolve } from "path";
-import { readFile as readFile5 } from "fs/promises";
-import { dirname, join as join5 } from "path";
+import { readFile as readFile8 } from "fs/promises";
+import { dirname, join as join9 } from "path";
 import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { readFile as readFile7 } from "fs/promises";
+var ConfigFileError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigFileError";
+  }
+};
+var AUTH_PROVIDERS = ["supabase", "firebase", "mongodb", "none"];
+var DB_PROVIDERS = ["supabase", "firebase", "mongodb", "none"];
+var UPLOAD_PROVIDERS = [
+  "supabase",
+  "firebase",
+  "cloudinary",
+  "mongodb",
+  "none"
+];
+var PAYMENT_PROVIDERS = ["paypal", "none"];
+var JOBS_PROVIDERS = ["bullmq", "none"];
+var EXAMPLE_MODES = ["notes", "none"];
+var UI_LIBRARIES = ["shadcn", "antd", "mui"];
+var MS_TRANSPORTS = ["tcp", "redis", "nats", "mqtt", "rmq", "kafka"];
+var PACKAGE_MANAGERS = ["yarn", "npm", "pnpm"];
+function assertEnum(field, value, valid) {
+  if (typeof value !== "string" || !valid.includes(value)) {
+    throw new ConfigFileError(
+      `config field "${field}" got "${String(value)}", expected one of: ${valid.join(", ")}`
+    );
+  }
+  return value;
+}
+function assertBoolean(field, value) {
+  if (typeof value !== "boolean") {
+    throw new ConfigFileError(`config field "${field}" must be a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+function validateConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new ConfigFileError("config file must be a JSON object");
+  }
+  const obj = raw;
+  const result = {};
+  if ("projectName" in obj) {
+    const v = obj["projectName"];
+    if (typeof v !== "string" || !/^[a-z0-9-]+$/i.test(v)) {
+      throw new ConfigFileError(
+        `config field "projectName" must match /^[a-z0-9-]+$/i, got "${String(v)}"`
+      );
+    }
+    result.projectName = v;
+  }
+  if ("authProvider" in obj)
+    result.authProvider = assertEnum("authProvider", obj["authProvider"], AUTH_PROVIDERS);
+  if ("dbProvider" in obj)
+    result.dbProvider = assertEnum("dbProvider", obj["dbProvider"], DB_PROVIDERS);
+  if ("upload" in obj) result.upload = assertEnum("upload", obj["upload"], UPLOAD_PROVIDERS);
+  if ("payment" in obj) result.payment = assertEnum("payment", obj["payment"], PAYMENT_PROVIDERS);
+  if ("jobs" in obj) result.jobs = assertEnum("jobs", obj["jobs"], JOBS_PROVIDERS);
+  if ("example" in obj) result.example = assertEnum("example", obj["example"], EXAMPLE_MODES);
+  if ("ui" in obj) result.ui = assertEnum("ui", obj["ui"], UI_LIBRARIES);
+  if ("transport" in obj)
+    result.transport = assertEnum("transport", obj["transport"], MS_TRANSPORTS);
+  if ("packageManager" in obj)
+    result.packageManager = assertEnum("packageManager", obj["packageManager"], PACKAGE_MANAGERS);
+  if ("initGit" in obj) result.initGit = assertBoolean("initGit", obj["initGit"]);
+  if ("install" in obj) result.install = assertBoolean("install", obj["install"]);
+  return result;
+}
+async function loadConfig(filePath) {
+  let raw;
+  try {
+    raw = await readFile7(filePath, "utf8");
+  } catch {
+    throw new ConfigFileError(`config file not found: ${filePath}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new ConfigFileError(
+      `config file is not valid JSON: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  return validateConfig(parsed);
+}
+
+// src/lib/prompts.ts
 function detectPackageManager() {
   const ua = process.env["npm_config_user_agent"] ?? "";
   if (ua.startsWith("yarn/")) return "yarn";
@@ -946,7 +1261,7 @@ function detectPackageManager() {
 async function readSelfVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
-    const pkgRaw = await readFile5(join5(here, "..", "package.json"), "utf8");
+    const pkgRaw = await readFile8(join9(here, "..", "package.json"), "utf8");
     const pkg = JSON.parse(pkgRaw);
     return pkg.version ?? null;
   } catch {
@@ -1020,12 +1335,21 @@ function parseFlags(argv) {
       case "no-install":
         out.install = false;
         break;
+      case "config":
+        out._configPath = v;
+        break;
     }
   }
   return out;
 }
 async function collectOptions({ argv, cwd }) {
   const flags = parseFlags(argv);
+  const configPath = flags._configPath;
+  delete flags._configPath;
+  if (configPath) {
+    const configValues = await loadConfig(configPath);
+    Object.assign(flags, { ...configValues, ...flags });
+  }
   const [selfVersion, latestVersion] = await Promise.all([readSelfVersion(), fetchLatestVersion()]);
   const versionTag = selfVersion ? ` v${selfVersion}` : "";
   p.intro(`iCore${versionTag} \u2014 bootstrap a new project`);
@@ -1048,11 +1372,12 @@ Re-run with @latest to refresh:
     options: [
       { value: "supabase", label: "Supabase" },
       { value: "firebase", label: "Firebase" },
-      { value: "mongodb", label: "MongoDB (Custom Auth)" }
+      { value: "mongodb", label: "MongoDB (Custom Auth)" },
+      { value: "none", label: "None \u2014 no login, open API (simple SPA)" }
     ]
   });
   if (p.isCancel(authProvider)) throw new Error("cancelled");
-  const dbProvider = flags.dbProvider ?? await p.select({
+  const dbProvider = authProvider === "none" ? "none" : flags.dbProvider ?? await p.select({
     message: "Database backend",
     options: [
       { value: "supabase", label: "Supabase Postgres" },
@@ -1091,7 +1416,7 @@ Re-run with @latest to refresh:
     initialValue: "none"
   });
   if (p.isCancel(jobs)) throw new Error("cancelled");
-  const example = flags.example ?? await p.select({
+  const example = authProvider === "none" ? "none" : flags.example ?? await p.select({
     message: "Include notes sample feature? (CRUD demo \u2014 remove before production)",
     options: [
       { value: "notes", label: "Yes \u2014 include notes sample" },
@@ -1116,7 +1441,8 @@ Re-run with @latest to refresh:
     initialValue: "shadcn"
   });
   if (p.isCancel(ui)) throw new Error("cancelled");
-  const transport = flags.transport ?? await p.select({
+  const noMicroservices = authProvider === "none" && upload === "none" && payment === "none";
+  const transport = flags.transport ?? (noMicroservices ? "tcp" : await p.select({
     message: "Microservice transport",
     options: [
       { value: "tcp", label: "TCP (default, no broker required)" },
@@ -1127,7 +1453,7 @@ Re-run with @latest to refresh:
       { value: "kafka", label: "Kafka" }
     ],
     initialValue: "tcp"
-  });
+  }));
   if (p.isCancel(transport)) throw new Error("cancelled");
   const packageManager = flags.packageManager ?? detectPackageManager();
   if (packageManager === "yarn") {
@@ -1157,7 +1483,128 @@ Re-run with @latest to refresh:
     install
   };
 }
+
+// src/manifest/audit.ts
+import { readFile as readFile9, readdir as readdir3 } from "fs/promises";
+import { join as join10 } from "path";
+var IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".nx"]);
+async function walk(dir, out = []) {
+  const entries = await readdir3(dir, { withFileTypes: true });
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      if (!IGNORE_DIRS.has(e.name)) await walk(join10(dir, e.name), out);
+    } else if (/\.(ts|tsx|mjs)$/.test(e.name)) {
+      out.push(join10(dir, e.name));
+    }
+  }
+  return out;
+}
+async function tsconfigAliases(dir) {
+  try {
+    const raw = await readFile9(join10(dir, "tsconfig.base.json"), "utf8");
+    const aliases = /* @__PURE__ */ new Set();
+    for (const m of raw.matchAll(/"(@icore\/[a-z0-9.-]+)"\s*:/g)) {
+      if (m[1]) aliases.add(m[1]);
+    }
+    return aliases;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+var PROVIDER_SDKS = {
+  supabase: ["@supabase/supabase-js"],
+  cloudinary: ["cloudinary"],
+  mongodb: ["mongoose"],
+  firebase: ["firebase-admin", "@icore/firebase-admin"]
+};
+async function readBlueprint(dir) {
+  try {
+    return JSON.parse(await readFile9(join10(dir, "blueprint.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function forbiddenFromBlueprint(bp) {
+  const chosen = new Set(
+    [bp.authProvider, bp.dbProvider, bp.upload].filter((p2) => Boolean(p2))
+  );
+  const forbidden = [];
+  for (const [provider, sdks] of Object.entries(PROVIDER_SDKS)) {
+    if (!chosen.has(provider)) forbidden.push(...sdks);
+  }
+  return forbidden;
+}
+async function allPackageJsons(dir) {
+  const out = [];
+  const root = join10(dir, "package.json");
+  out.push(root);
+  async function walk2(d) {
+    let entries;
+    try {
+      entries = await readdir3(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        if (!IGNORE_DIRS.has(e.name)) await walk2(join10(d, e.name));
+      } else if (e.name === "package.json") {
+        out.push(join10(d, e.name));
+      }
+    }
+  }
+  await walk2(join10(dir, "apps"));
+  return out;
+}
+async function depKeys(pkgPath) {
+  try {
+    const pkg = JSON.parse(await readFile9(pkgPath, "utf8"));
+    return /* @__PURE__ */ new Set([
+      ...Object.keys(pkg.dependencies ?? {}),
+      ...Object.keys(pkg.devDependencies ?? {})
+    ]);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+var ICORE_IMPORT = /(?:from|import\()\s*['"](@icore\/[a-z0-9.-]+)/g;
+async function auditProject(dir, opts = {}) {
+  const violations = [];
+  const aliases = await tsconfigAliases(dir);
+  for (const file of await walk(dir)) {
+    const src = await readFile9(file, "utf8");
+    for (const m of src.matchAll(ICORE_IMPORT)) {
+      const alias = m[1];
+      if (alias && !aliases.has(alias)) {
+        violations.push({
+          kind: "import-of-absent-lib",
+          detail: `${file} imports ${alias} (no tsconfig path \u2192 lib absent)`
+        });
+      }
+    }
+  }
+  const bp = await readBlueprint(dir);
+  const forbidden = /* @__PURE__ */ new Set([
+    ...opts.forbiddenDeps ?? [],
+    ...bp ? forbiddenFromBlueprint(bp) : []
+  ]);
+  if (forbidden.size > 0) {
+    for (const pkgPath of await allPackageJsons(dir)) {
+      const deps = await depKeys(pkgPath);
+      for (const f of forbidden) {
+        if (deps.has(f)) {
+          violations.push({
+            kind: "forbidden-dep",
+            detail: `${pkgPath} keeps forbidden dep ${f}`
+          });
+        }
+      }
+    }
+  }
+  return violations;
+}
 export {
+  auditProject,
   collectOptions,
   pmRun,
   scaffold