@murumets-ee/create 0.1.13 → 0.1.15

package/dist/cli.mjs

@@ -0,0 +1,3481 @@
+#!/usr/bin/env node
+import*as e from"@clack/prompts";import t from"picocolors";import{dirname as n,join as r}from"node:path";import{execSync as i}from"node:child_process";import{appendFile as a,mkdir as o,readFile as s,rm as c,writeFile as l}from"node:fs/promises";var u=Object.defineProperty,d=(e,t)=>{let n={};for(var r in e)u(n,r,{get:e[r],enumerable:!0});return t||u(n,Symbol.toStringTag,{value:`Module`}),n};function f(e){let t={},n=e.slice(2);for(let e=0;e<n.length;e++){let r=n[e];if(r===`--mode`&&n[e+1]){let r=n[++e];(r===`single`||r===`multi`)&&(t.mode=r)}else r===`--install`?t.install=!0:r===`--no-install`?t.install=!1:!r.startsWith(`-`)&&!t.name&&(t.name=r)}return t}async function p(t){let n=f(process.argv),r=n.name??t;if(r&&n.mode&&n.install!==void 0)return{name:r,mode:n.mode,installDeps:n.install};e.intro(`@murumets-ee/create`);let i=r??await e.text({message:`Project name:`,placeholder:`my-project`,validate:e=>{if(!e)return`Project name is required`;if(!/^[a-z0-9-]+$/.test(e))return`Use lowercase letters, numbers, and hyphens only`}});if(e.isCancel(i))return e.cancel(`Cancelled.`),null;let a=n.mode??await e.select({message:`App setup:`,options:[{value:`single`,label:`Single app`,hint:`everything in one Next.js project`},{value:`multi`,label:`Admin + Frontend`,hint:`two apps in a pnpm workspace`}]});if(e.isCancel(a))return e.cancel(`Cancelled.`),null;let o=n.install??await e.confirm({message:`Install dependencies?`,initialValue:!0});return e.isCancel(o)?(e.cancel(`Cancelled.`),null):{name:i,mode:a,installDeps:o}}var m=d({appendToFile:()=>y,deleteFiles:()=>_,mergePackageJson:()=>g,runCommand:()=>v,writeFile:()=>h});async function h(e,t){await o(n(e),{recursive:!0}),await l(e,t,`utf-8`)}async function g(e,t){let n=await s(e,`utf-8`),r=JSON.parse(n);t.type&&(r.type=t.type),t.dependencies&&(r.dependencies={...r.dependencies,...t.dependencies}),t.devDependencies&&(r.devDependencies={...r.devDependencies,...t.devDependencies}),t.scripts&&(r.scripts={...r.scripts,...t.scripts}),await l(e,`${JSON.stringify(r,null,2)}\n`,`utf-8`)}async function _(e,t){for(let n of t)await c(r(e,n),{force:!0,recursive:!0})}function v(e,t){return i(e,{cwd:t?.cwd,stdio:`pipe`,encoding:`utf-8`})}async function y(e,t){await a(e,t,`utf-8`)}async function b(e,t){await h(r(e,`lib/admin-config.ts`),`import { Media } from '@murumets-ee/media'
+import {
+  Ticket,
+  TicketMessage,
+  TicketAttachment,
+  Department,
+  TicketTag,
+} from '@murumets-ee/ticketing'
+import { Article, Category } from '@/entities'
+
+/** All entities available in the admin (drives sidebar nav + CRUD) */
+export const allEntities = [
+  Article, Media, Category,
+  Ticket, TicketMessage, TicketAttachment, Department, TicketTag,
+]
+
+/** Taxonomy entities keyed by name */
+export const taxonomyVocabularies = {
+  category: Category,
+  department: Department,
+  ticket_tag: TicketTag,
+}
+
+/** Entities exposed via generic CRUD API handler */
+export const crudEntities = [Article, Media, Ticket, TicketMessage, TicketAttachment]
+
+/** Plugin resources for the permission catalog */
+export const pluginResources = [
+  { resource: 'storage', actions: ['view', 'create', 'update', 'delete'] },
+  { resource: 'settings', actions: ['view', 'update'] },
+  { resource: 'audit-logs', actions: ['view'] },
+  { resource: 'permissions', actions: ['view', 'create', 'update', 'delete'] },
+  { resource: 'ticketing', actions: ['view', 'create', 'update', 'delete'] },
+]
+`),await h(r(e,`lib/content-locale.ts`),`import { cookies } from 'next/headers'
+import { hasLocale } from 'next-intl'
+import { routing } from '@/i18n/routing'
+
+/**
+ * Get the content editing locale from the cookie, falling back to the interface locale.
+ */
+export async function getContentLocale(interfaceLocale: string): Promise<string> {
+  const jar = await cookies()
+  const raw = jar.get('content-locale')?.value
+  if (raw && hasLocale(routing.locales, raw)) return raw
+  return interfaceLocale
+}
+`),await h(r(e,`lib/with-admin-context.ts`),`import { getContentConfig } from '@murumets-ee/content/plugin'
+import type { RequestContext } from '@murumets-ee/core'
+import { runWithContextAsync } from '@murumets-ee/core'
+import { getToolkitApp } from './app'
+import { getContentLocale } from './content-locale'
+
+export async function withAdminContext<T>(
+  interfaceLocale: string,
+  fn: (ctx: { locale: string; defaultLocale: string }) => Promise<T>,
+): Promise<T> {
+  const app = await getToolkitApp()
+  const contentLocale = await getContentLocale(interfaceLocale)
+  const { defaultLocale } = getContentConfig()
+
+  const context: RequestContext = {
+    locale: contentLocale,
+    defaultLocale,
+    app,
+  }
+
+  return runWithContextAsync(context, () => fn({ locale: contentLocale, defaultLocale }))
+}
+`),await h(r(e,`lib/load-roles.ts`),`import { buildInitialRoleDefinitions } from '@murumets-ee/auth'
+import type { ToolkitApp } from '@murumets-ee/core'
+import { createSettingsClient } from '@murumets-ee/settings'
+import { permissionSettings } from '@/settings/permissions'
+
+export async function loadRoles(
+  app: ToolkitApp,
+): Promise<Record<string, Record<string, string[]>>> {
+  const client = createSettingsClient(permissionSettings, { app })
+  const saved = await client.get('roles')
+
+  if (saved) return saved
+
+  // First run — seed built-in roles with zero permissions
+  const initial = buildInitialRoleDefinitions()
+  await client.set('roles', initial)
+  return initial
+}
+`),await h(r(e,`settings/permissions.ts`),`import { defineSettings, setting } from '@murumets-ee/settings'
+
+export const permissionSettings = defineSettings({
+  namespace: 'permissions',
+  scope: 'global',
+  label: 'Permissions',
+  schema: {
+    roles: setting.json<Record<string, Record<string, string[]>>>(),
+  },
+})
+`),await h(r(e,`settings/site.ts`),`import { defineSettings, setting } from '@murumets-ee/settings'
+
+export const siteSettings = defineSettings({
+  namespace: 'site',
+  scope: 'global',
+  label: 'Site Settings',
+  schema: {
+    siteName: setting.text({ default: 'My Site', label: 'Site Name', translatable: true }),
+    siteDescription: setting.text({ label: 'Site Description', translatable: true }),
+    maintenanceMode: setting.boolean({ default: false, label: 'Maintenance Mode' }),
+    postsPerPage: setting.number({
+      default: 10,
+      min: 1,
+      max: 100,
+      integer: true,
+      label: 'Posts Per Page',
+    }),
+  },
+})
+`),await h(r(e,`app/admin-layout.tsx`),`'use client'
+
+import type { LinkComponent, SidebarNavGroup } from '@murumets-ee/admin-ui'
+import { AdminShell } from '@murumets-ee/admin-ui'
+import type { AdminNavGroup } from '@murumets-ee/admin-ui/server'
+import {
+  Activity,
+  Building2,
+  FileText,
+  FolderTree,
+  Home,
+  Image,
+  ImageDown,
+  Inbox,
+  Kanban,
+  Lock,
+  PenTool,
+  ShieldCheck,
+  Tag,
+  Tags,
+  Ticket,
+  Users,
+  type LucideIcon,
+} from 'lucide-react'
+import type { ReactNode } from 'react'
+import { Link, usePathname } from '@/i18n/navigation'
+
+/** Map from icon name strings (from entity admin config) to Lucide components */
+const ICON_MAP: Record<string, LucideIcon> = {
+  'file-text': FileText,
+  'folder-tree': FolderTree,
+  tags: Tags,
+  ticket: Ticket,
+}
+
+interface AdminLayoutProps {
+  children: ReactNode
+  defaultOpen?: boolean
+  headerActions?: ReactNode
+  sidebarFooter?: ReactNode
+  entityNavGroups?: AdminNavGroup[]
+}
+
+export function AdminLayout({
+  children,
+  defaultOpen,
+  headerActions,
+  sidebarFooter,
+  entityNavGroups,
+}: AdminLayoutProps) {
+  const pathname = usePathname()
+
+  const dynamicGroups: SidebarNavGroup[] = (entityNavGroups ?? []).map((group) => ({
+    label: group.label,
+    items: group.items.map((item) => ({
+      label: item.label,
+      href: item.href,
+      icon: item.iconName ? ICON_MAP[item.iconName] : undefined,
+    })),
+  }))
+
+  const staticBefore: SidebarNavGroup = {
+    items: [
+      { label: 'Home', href: '/', icon: Home },
+      { label: 'Admin', href: '/admin', icon: PenTool },
+    ],
+  }
+
+  const supportGroup: SidebarNavGroup = {
+    label: 'Support',
+    items: [
+      { label: 'Tickets', href: '/admin/tickets', icon: Inbox },
+      { label: 'Board', href: '/admin/tickets/board', icon: Kanban },
+      { label: 'Departments', href: '/admin/departments', icon: Building2 },
+      { label: 'Ticket Tags', href: '/admin/ticket-tags', icon: Tag },
+    ],
+  }
+
+  const systemGroup: SidebarNavGroup = {
+    label: 'System',
+    items: [
+      { label: 'Users', href: '/admin/users', icon: Users },
+      { label: 'Roles', href: '/admin/roles', icon: ShieldCheck },
+      { label: 'Permissions', href: '/admin/permissions', icon: Lock },
+      { label: 'Media', href: '/admin/media', icon: Image },
+      { label: 'Image Styles', href: '/admin/media/image-styles', icon: ImageDown },
+      { label: 'Activity', href: '/admin/activity', icon: Activity },
+    ],
+  }
+
+  const navGroups: SidebarNavGroup[] = [
+    staticBefore,
+    ...dynamicGroups,
+    supportGroup,
+    systemGroup,
+  ]
+
+  return (
+    <AdminShell
+      defaultOpen={defaultOpen}
+      sidebar={{
+        navGroups,
+        pathname,
+        Link: Link as unknown as LinkComponent,
+        logo: (
+          <div className="flex h-8 items-center gap-2 px-2">
+            <span className="font-semibold text-sm text-zinc-700 dark:text-zinc-300 truncate">
+              Admin
+            </span>
+          </div>
+        ),
+        footer: sidebarFooter,
+      }}
+      header={{
+        actions: headerActions,
+      }}
+    >
+      {children}
+    </AdminShell>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/layout.tsx`),`import { buildAdminNav } from '@murumets-ee/admin-ui/server'
+import { cookies, headers } from 'next/headers'
+import { redirect } from 'next/navigation'
+import { Suspense } from 'react'
+import { allEntities } from '@/lib/admin-config'
+import { auth } from '@/lib/auth'
+import { AdminLayout } from '../../admin-layout'
+import { ThemeToggle } from '../../theme-toggle'
+
+async function DynamicShell({
+  children,
+  interfaceLocale,
+}: {
+  children: React.ReactNode
+  interfaceLocale: string
+}) {
+  const h = await headers()
+  const session = await auth.api.getSession({ headers: h })
+  if (!session?.user) {
+    redirect(\`/\${interfaceLocale}/auth/sign-in\`)
+  }
+
+  const jar = await cookies()
+  const sidebarOpen = jar.get('sidebar:state')?.value !== 'false'
+  const entityNavGroups = buildAdminNav(allEntities, { basePath: '/admin' })
+
+  return (
+    <AdminLayout
+      defaultOpen={sidebarOpen}
+      entityNavGroups={entityNavGroups}
+      sidebarFooter={
+        <div className="flex justify-center gap-2">
+          <ThemeToggle />
+        </div>
+      }
+    >
+      {children}
+    </AdminLayout>
+  )
+}
+
+export default async function ShellLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ locale: string }>
+}) {
+  const { locale } = await params
+
+  return (
+    <Suspense>
+      <DynamicShell interfaceLocale={locale}>{children}</DynamicShell>
+    </Suspense>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/layout.tsx`),`import { headers } from 'next/headers'
+import { redirect } from 'next/navigation'
+import { auth } from '@/lib/auth'
+
+const ALLOWED_ROLES = new Set(['admin', 'editor'])
+
+export default async function AdminGuardLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ locale: string }>
+}) {
+  const { locale } = await params
+  const h = await headers()
+  const session = await auth.api.getSession({ headers: h })
+
+  if (!session?.user) {
+    redirect(\`/\${locale}/auth/sign-in\`)
+  }
+
+  const role = (session.user as Record<string, unknown>).role as string | undefined
+  if (!role || !ALLOWED_ROLES.has(role)) {
+    redirect(\`/\${locale}\`)
+  }
+
+  return <>{children}</>
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/page.tsx`),`import { setRequestLocale } from 'next-intl/server'
+
+export default async function AdminDashboard({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  return (
+    <div className="p-6">
+      <h1 className="text-2xl font-bold mb-4">Dashboard</h1>
+      <p className="text-muted-foreground">
+        Welcome to the admin panel. Use the sidebar to manage your content.
+      </p>
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/[entity]/page.tsx`),`import { EntityList } from '@murumets-ee/admin-ui/entity-list'
+import {
+  entityNameToSlug,
+  fetchEntityList,
+  getEntityLabel,
+  resolveEntityFromSlug,
+  toEntityMeta,
+} from '@murumets-ee/admin-ui/server'
+import { getContentConfig } from '@murumets-ee/content/plugin'
+import { notFound } from 'next/navigation'
+import { setRequestLocale } from 'next-intl/server'
+import { allEntities, taxonomyVocabularies } from '@/lib/admin-config'
+import { withAdminContext } from '@/lib/with-admin-context'
+
+interface EntityListPageProps {
+  params: Promise<{ locale: string; entity: string }>
+}
+
+export default async function EntityListPage({ params }: EntityListPageProps) {
+  const { locale, entity: entitySlug } = await params
+  setRequestLocale(locale)
+
+  const entity = resolveEntityFromSlug(entitySlug, allEntities)
+  if (!entity) notFound()
+
+  const admin = entity.admin
+  const meta = toEntityMeta(entity)
+  const urlSlug = entityNameToSlug(entity.name)
+  const hasTranslatable = Object.values(entity.allFields).some((f) => f.translatable)
+  const isPublishable = entity.behaviors?.some((b) => b.name === 'publishable')
+  const isTaxonomy = entity.name in taxonomyVocabularies
+
+  return withAdminContext(locale, async ({ locale: contentLocale, defaultLocale }) => {
+    let locales: Array<{ code: string; label: string }> | undefined
+    if (hasTranslatable) {
+      try {
+        const config = getContentConfig()
+        locales = config.locales
+      } catch {
+        // content plugin not available
+      }
+    }
+
+    const initialData = await fetchEntityList(entity, {
+      sortField: admin?.defaultSort ?? 'createdAt',
+      sortDirection: admin?.defaultSortDirection ?? 'desc',
+      limit: admin?.pageSize ?? 20,
+      locale: contentLocale,
+      includeTranslationStatus: hasTranslatable,
+    })
+
+    return (
+      <div className="p-6">
+        <div className="mb-6">
+          <h1 className="text-2xl font-bold">{getEntityLabel(entity)}</h1>
+          {admin?.description && (
+            <p className="text-sm text-muted-foreground">{admin.description}</p>
+          )}
+        </div>
+        <EntityList
+          entity={meta}
+          allowDelete
+          allowStatusToggle={isPublishable}
+          {...(isTaxonomy ? { apiBasePath: '/api/admin/taxonomy', entityPath: entity.name } : {})}
+          defaultSort={admin?.defaultSort ?? 'createdAt'}
+          defaultSortDirection={admin?.defaultSortDirection ?? 'desc'}
+          hiddenColumns={admin?.hiddenColumns}
+          pageSize={admin?.pageSize}
+          locale={contentLocale}
+          locales={locales}
+          defaultLocale={defaultLocale}
+          showTranslationStatus={hasTranslatable && !!locales}
+          searchPlaceholder={\`Search \${getEntityLabel(entity).toLowerCase()}...\`}
+          editHref={\`/\${locale}/admin/\${urlSlug}/:id\`}
+          createHref={admin?.disableCreate ? undefined : \`/\${locale}/admin/\${urlSlug}/new\`}
+          initialData={initialData}
+        />
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/[entity]/[id]/page.tsx`),`import {
+  entityNameToSlug,
+  fetchReferenceOptions,
+  getBlocksFieldName,
+  getEntityLabelSingular,
+  getReferenceFields,
+  inferRootFields,
+  resolveEntityFromSlug,
+  toEntityMeta,
+} from '@murumets-ee/admin-ui/server'
+import { buildPermissionChecker } from '@murumets-ee/auth'
+import { ContentClient } from '@murumets-ee/content/client'
+import { LockService } from '@murumets-ee/content/lock'
+import { createAdminClient } from '@murumets-ee/core/clients'
+import { getApp } from '@murumets-ee/core'
+import { prepareBlockEditor } from '@murumets-ee/editor/server'
+import { headers } from 'next/headers'
+import { notFound } from 'next/navigation'
+import { setRequestLocale } from 'next-intl/server'
+import { GenericBlockEditor } from '@murumets-ee/admin-ui/content-editor'
+import { GenericEntityForm } from '@murumets-ee/admin-ui/entity-form'
+import { allEntities } from '@/lib/admin-config'
+import { auth } from '@/lib/auth'
+import { loadRoles } from '@/lib/load-roles'
+import { withAdminContext } from '@/lib/with-admin-context'
+
+interface EditEntityPageProps {
+  params: Promise<{ locale: string; entity: string; id: string }>
+}
+
+export default async function EditEntityPage({ params }: EditEntityPageProps) {
+  const { locale, entity: entitySlug, id } = await params
+  setRequestLocale(locale)
+
+  const entity = resolveEntityFromSlug(entitySlug, allEntities)
+  if (!entity) notFound()
+
+  const blocksField = getBlocksFieldName(entity)
+  const urlSlug = entityNameToSlug(entity.name)
+
+  return withAdminContext(locale, async ({ locale: contentLocale, defaultLocale }) => {
+    const client = createAdminClient(entity)
+    const isDefaultLocale = contentLocale === defaultLocale
+    const isNonDefaultLocale = !isDefaultLocale
+
+    const isVersionable = entity.behaviors?.some((b) => b.name === 'versionable') ?? false
+    const isPublishable = entity.behaviors?.some((b) => b.name === 'publishable') ?? false
+
+    let draft: { data: Record<string, unknown>; createdBy: string; createdByName: string | null; updatedAt: Date | string } | undefined
+    let canPublish = false
+    let lockResult: { acquired: boolean; lock?: { lockedBy: string; lockedByName: string | null; lockedAt: Date | string; expiresAt: Date | string } | null } | undefined
+    const enableLocking = isPublishable
+
+    if (isPublishable) {
+      try {
+        const app = getApp()
+        const contentClient = new ContentClient({ entity, db: app.db.readWrite })
+        const lockLocale = isDefaultLocale ? '_' : contentLocale
+
+        const draftEntry = await contentClient.getDraft(id, lockLocale)
+        if (draftEntry) {
+          draft = {
+            data: draftEntry.data,
+            createdBy: draftEntry.createdBy,
+            createdByName: draftEntry.createdByName,
+            updatedAt: draftEntry.updatedAt,
+          }
+        }
+
+        const session = await auth.api.getSession({ headers: await headers() })
+        if (session?.user) {
+          const role = (session.user as Record<string, unknown>).role as string | undefined
+          if (role) {
+            const roles = await loadRoles(app)
+            const checker = buildPermissionChecker(roles)
+            canPublish = checker(role, entity.name, 'publish')
+          }
+
+          const lockService = new LockService({ db: app.db.readWrite })
+          const result = await lockService.acquireLock(
+            entity.name, id, lockLocale,
+            { id: session.user.id, name: session.user.name ?? undefined },
+          )
+          if (result.acquired) {
+            lockResult = { acquired: true }
+          } else {
+            lockResult = { acquired: false, lock: result.lock }
+          }
+        }
+      } catch {
+        // Draft/permission/lock errors — proceed without
+      }
+    }
+
+    // Block editor entity
+    if (blocksField) {
+      const record = isDefaultLocale
+        ? await client.findById(id, { defaultLocale })
+        : await client.findById(id, { locale: contentLocale, defaultLocale })
+      if (!record) notFound()
+
+      const rootFields = inferRootFields(entity, blocksField)
+      const { blocks, initialData, mediaUrls, rootData, rootFieldDefs } =
+        await prepareBlockEditor(
+          entity as Parameters<typeof prepareBlockEditor>[0],
+          blocksField,
+          record,
+          { rootFields },
+        )
+
+      return (
+        <div className="flex h-[calc(100vh-3.5rem)] flex-col">
+          <div className="flex items-center gap-3 border-b px-6 py-3">
+            <h1 className="text-lg font-semibold">
+              {(record.title as string) ?? \`Untitled \${getEntityLabelSingular(entity)}\`}
+            </h1>
+            <span className="rounded bg-muted px-2 py-0.5 text-xs text-muted-foreground uppercase">
+              {contentLocale}
+            </span>
+          </div>
+          <div className="flex-1 overflow-hidden">
+            <GenericBlockEditor
+              key={contentLocale}
+              entityId={id}
+              entityName={entity.name}
+              blocksField={blocksField}
+              blocks={blocks}
+              initialData={initialData}
+              mediaUrls={mediaUrls}
+              rootData={rootData}
+              rootFieldDefs={rootFieldDefs}
+              saveLabel="Save"
+              locale={contentLocale}
+              defaultLocale={defaultLocale}
+              versionable={isVersionable}
+              isPublishable={isPublishable}
+              draft={draft}
+              canPublish={canPublish}
+              enableLocking={enableLocking}
+              lockResult={lockResult}
+            />
+          </div>
+        </div>
+      )
+    }
+
+    // Form entity
+    const [record, defaultLocaleData] = await Promise.all([
+      client.findById(id, { locale: contentLocale }),
+      isNonDefaultLocale ? client.findById(id) : Promise.resolve(null),
+    ])
+    if (!record) notFound()
+
+    const refFields = getReferenceFields(entity)
+    const referenceOptions: Record<string, Array<{ id: string; label: string }>> = {}
+
+    if (refFields.length > 0) {
+      const optionPromises = refFields.map(async ({ fieldName, entityName }) => {
+        const refEntity = allEntities.find((e) => e.name === entityName)
+        if (!refEntity) return { fieldName, options: [] }
+        const options = await fetchReferenceOptions(refEntity, { locale: contentLocale })
+        return { fieldName, options }
+      })
+      const results = await Promise.all(optionPromises)
+      for (const { fieldName, options } of results) {
+        referenceOptions[fieldName] = options
+      }
+    }
+
+    return (
+      <div className="p-6">
+        <div className="mb-6">
+          <h1 className="text-2xl font-bold">Edit {getEntityLabelSingular(entity)}</h1>
+        </div>
+        <GenericEntityForm
+          entity={toEntityMeta(entity)}
+          id={id}
+          locale={contentLocale}
+          defaultLocale={defaultLocale}
+          defaultLocaleData={
+            isNonDefaultLocale && defaultLocaleData
+              ? (defaultLocaleData as Record<string, unknown>)
+              : undefined
+          }
+          initialData={record as Record<string, unknown>}
+          referenceOptions={referenceOptions}
+          listUrl={\`/\${locale}/admin/\${urlSlug}\`}
+          versionable={isVersionable}
+          draft={draft}
+          canPublish={canPublish}
+          enableLocking={enableLocking}
+          lockResult={lockResult}
+        />
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/[entity]/new/page.tsx`),`import {
+  entityNameToSlug,
+  fetchReferenceOptions,
+  getBlocksFieldName,
+  getEntityLabelSingular,
+  getReferenceFields,
+  resolveEntityFromSlug,
+  toEntityMeta,
+} from '@murumets-ee/admin-ui/server'
+import { createAdminClient } from '@murumets-ee/core/clients'
+import { notFound, redirect } from 'next/navigation'
+import { setRequestLocale } from 'next-intl/server'
+import { GenericEntityForm } from '@murumets-ee/admin-ui/entity-form'
+import { allEntities } from '@/lib/admin-config'
+import { withAdminContext } from '@/lib/with-admin-context'
+
+interface NewEntityPageProps {
+  params: Promise<{ locale: string; entity: string }>
+}
+
+export default async function NewEntityPage({ params }: NewEntityPageProps) {
+  const { locale, entity: entitySlug } = await params
+  setRequestLocale(locale)
+
+  const entity = resolveEntityFromSlug(entitySlug, allEntities)
+  if (!entity) notFound()
+  if (entity.admin?.disableCreate) notFound()
+
+  const blocksField = getBlocksFieldName(entity)
+  const urlSlug = entityNameToSlug(entity.name)
+
+  return withAdminContext(locale, async ({ locale: contentLocale }) => {
+    // Block editor entities: create a draft and redirect to the edit page
+    if (blocksField) {
+      const client = createAdminClient(entity)
+      const draft = await client.create({ title: 'Untitled' })
+      const newId = (draft as Record<string, unknown>).id as string
+      redirect(\`/\${locale}/admin/\${urlSlug}/\${newId}\`)
+    }
+
+    // Form entities: render the create form
+    const refFields = getReferenceFields(entity)
+    const referenceOptions: Record<string, Array<{ id: string; label: string }>> = {}
+
+    if (refFields.length > 0) {
+      const optionPromises = refFields.map(async ({ fieldName, entityName }) => {
+        const refEntity = allEntities.find((e) => e.name === entityName)
+        if (!refEntity) return { fieldName, options: [] }
+        const options = await fetchReferenceOptions(refEntity, { locale: contentLocale })
+        return { fieldName, options }
+      })
+      const results = await Promise.all(optionPromises)
+      for (const { fieldName, options } of results) {
+        referenceOptions[fieldName] = options
+      }
+    }
+
+    return (
+      <div className="p-6">
+        <div className="mb-6">
+          <h1 className="text-2xl font-bold">New {getEntityLabelSingular(entity)}</h1>
+        </div>
+        <GenericEntityForm
+          entity={toEntityMeta(entity)}
+          locale={contentLocale}
+          referenceOptions={referenceOptions}
+          listUrl={\`/\${locale}/admin/\${urlSlug}\`}
+        />
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/media/page.tsx`),`import { EntityList } from '@murumets-ee/admin-ui/entity-list'
+import { fetchEntityList, toEntityMeta } from '@murumets-ee/admin-ui/server'
+import { Media } from '@murumets-ee/media'
+import { getMediaClient } from '@murumets-ee/media/client'
+import { setRequestLocale } from 'next-intl/server'
+
+export default async function MediaListPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const initialData = await fetchEntityList(Media, { sortField: 'createdAt' })
+
+  const mediaClient = await getMediaClient()
+  const ids = initialData.items.map((i) => i.id as string)
+  const thumbMap = await mediaClient.getVariantUrls(ids, 'thumbnail')
+  for (const item of initialData.items) {
+    item.thumbnailUrl = thumbMap.get(item.id as string) ?? ''
+  }
+
+  return (
+    <div className="p-6">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold">Media</h1>
+        <p className="text-sm text-muted-foreground">
+          Manage uploaded media files.
+        </p>
+      </div>
+      <EntityList
+        entity={toEntityMeta(Media)}
+        entityPath="media"
+        image={{ field: 'thumbnailUrl', size: 'sm', shape: 'rounded' }}
+        allowDelete
+        defaultSort="createdAt"
+        searchPlaceholder="Search media..."
+        editHref={\`/\${locale}/admin/media/:id\`}
+        initialData={initialData}
+      />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/media/[id]/page.tsx`),`import { toEntityMeta } from '@murumets-ee/admin-ui/server'
+import { getCurrentApp } from '@murumets-ee/core'
+import { createAdminClient } from '@murumets-ee/core/clients'
+import { Media } from '@murumets-ee/media'
+import { findMediaUsages } from '@murumets-ee/media/usage'
+import { notFound } from 'next/navigation'
+import { setRequestLocale } from 'next-intl/server'
+import { withAdminContext } from '@/lib/with-admin-context'
+import { MediaForm } from './media-form'
+import { MediaUsagePanel } from './media-usage-panel'
+
+interface MediaEditPageProps {
+  params: Promise<{ locale: string; id: string }>
+}
+
+export default async function MediaEditPage({ params }: MediaEditPageProps) {
+  const { locale, id } = await params
+  setRequestLocale(locale)
+
+  return withAdminContext(locale, async ({ locale: contentLocale }) => {
+    const app = getCurrentApp()!
+    const client = createAdminClient(Media)
+    const [mediaItem, usages] = await Promise.all([
+      client.findById(id, { locale: contentLocale }),
+      findMediaUsages(id, app.db.readWrite),
+    ])
+    if (!mediaItem) notFound()
+
+    return (
+      <div className="p-6">
+        <div className="mb-6">
+          <h1 className="text-2xl font-bold">Edit Media</h1>
+        </div>
+        <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
+          <div className="lg:col-span-2">
+            <MediaForm
+              entity={toEntityMeta(Media)}
+              id={id}
+              locale={contentLocale}
+              initialData={mediaItem as Record<string, unknown>}
+            />
+          </div>
+          <div>
+            <MediaUsagePanel usages={usages} locale={locale} />
+          </div>
+        </div>
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/media/[id]/media-form.tsx`),`'use client'
+
+import { EntityForm } from '@murumets-ee/admin-ui/entity-form'
+import type { EntityMeta } from '@murumets-ee/admin-ui/entity-list'
+import { useRouter } from 'next/navigation'
+
+interface MediaFormProps {
+  entity: EntityMeta
+  id: string
+  locale?: string
+  initialData?: Record<string, unknown>
+}
+
+export function MediaForm({ entity, id, locale, initialData }: MediaFormProps) {
+  const router = useRouter()
+
+  return (
+    <EntityForm
+      entity={entity}
+      id={id}
+      locale={locale}
+      initialData={initialData}
+      entityPath="media"
+      layout="two-column"
+      fields={['title', 'alt', 'description', 'filename', 'mimeType', 'size', 'mediaType']}
+      fieldOverrides={{
+        filename: { readOnly: true, description: 'Original upload filename (read-only)' },
+        mimeType: { readOnly: true, label: 'MIME Type' },
+        size: { readOnly: true, description: 'File size in bytes' },
+        mediaType: { readOnly: true, label: 'Media Type' },
+        alt: { label: 'Alt Text', description: 'Alternative text for accessibility' },
+      }}
+      onSuccess={() => router.push(\`/\${locale}/admin/media\`)}
+      onCancel={() => router.back()}
+    />
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/media/[id]/media-usage-panel.tsx`),`import type { MediaUsage } from '@murumets-ee/media/usage'
+
+interface MediaUsagePanelProps {
+  usages: MediaUsage[]
+  locale: string
+}
+
+export function MediaUsagePanel({ usages, locale }: MediaUsagePanelProps) {
+  return (
+    <div className="rounded-lg border bg-card p-4">
+      <h3 className="mb-3 text-sm font-semibold">Used by</h3>
+
+      {usages.length === 0 && (
+        <p className="text-sm text-muted-foreground">
+          This media item is not referenced by any entity.
+        </p>
+      )}
+
+      {usages.length > 0 && (
+        <ul className="space-y-2">
+          {usages.map((usage) => {
+            const entitySlug = \`\${usage.entityName}s\`
+            const href = \`/\${locale}/admin/\${entitySlug}/\${usage.entityId}\`
+
+            return (
+              <li key={\`\${usage.entityName}-\${usage.entityId}-\${usage.fieldName}\`}>
+                <a
+                  href={href}
+                  className="block rounded-md border px-3 py-2 text-sm hover:bg-muted transition-colors"
+                >
+                  <span className="font-medium capitalize">{usage.entityName}</span>
+                  <span className="mx-1.5 text-muted-foreground">&middot;</span>
+                  <span className="text-muted-foreground">{usage.fieldName}</span>
+                  {usage.context === 'block' && (
+                    <span className="ml-1.5 rounded bg-muted px-1.5 py-0.5 text-xs text-muted-foreground">
+                      block
+                    </span>
+                  )}
+                </a>
+              </li>
+            )
+          })}
+        </ul>
+      )}
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/media/image-styles/page.tsx`),`import { imageStylesSettings } from '@murumets-ee/media'
+import { ImageStylesManager } from '@murumets-ee/media/image-styles'
+import { createSettingsClient } from '@murumets-ee/settings'
+import { setRequestLocale } from 'next-intl/server'
+import { getToolkitApp } from '@/lib/app'
+
+async function loadImageStyles() {
+  const app = await getToolkitApp()
+  const client = createSettingsClient(imageStylesSettings, { app })
+  const styles = await client.get('imageStyles')
+  return styles ?? {}
+}
+
+export default async function ImageStylesPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  const initialStyles = await loadImageStyles()
+
+  return (
+    <div className="p-6 max-w-4xl">
+      <ImageStylesManager initialStyles={initialStyles} />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/users/page.tsx`),`import type { UsersInitialData } from '@murumets-ee/admin-ui/users'
+import { getAuth } from '@murumets-ee/auth'
+import { headers } from 'next/headers'
+import { setRequestLocale } from 'next-intl/server'
+import { getToolkitApp } from '@/lib/app'
+import { UsersPage } from './users-page'
+
+export default async function UsersAdminPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  await getToolkitApp()
+  const auth = getAuth()
+
+  const result = await auth.api.listUsers({
+    headers: await headers(),
+    query: { limit: 20, sortBy: 'createdAt', sortDirection: 'desc' },
+  })
+
+  const initialData: UsersInitialData = {
+    users: result.users.map((u) => ({
+      id: u.id,
+      name: u.name,
+      email: u.email,
+      emailVerified: u.emailVerified,
+      image: u.image ?? null,
+      createdAt: u.createdAt instanceof Date ? u.createdAt.toISOString() : String(u.createdAt),
+      updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : String(u.updatedAt),
+      role: u.role ?? null,
+      banned: u.banned ?? null,
+      banReason: u.banReason ?? null,
+      banExpires:
+        u.banExpires instanceof Date
+          ? u.banExpires.toISOString()
+          : u.banExpires
+            ? String(u.banExpires)
+            : null,
+    })),
+    total: result.total,
+  }
+
+  return (
+    <div className="p-6">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold">Users</h1>
+        <p className="text-sm text-muted-foreground">Manage user accounts, roles, and access.</p>
+      </div>
+      <UsersPage initialData={initialData} />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/users/users-page.tsx`),`'use client'
+
+import type { UsersInitialData } from '@murumets-ee/admin-ui/users'
+import { UsersManagement } from '@murumets-ee/admin-ui/users'
+import { createUsersApi } from '@murumets-ee/auth/client'
+import { authClient } from '@/lib/auth-client'
+
+const usersApi = createUsersApi(authClient)
+
+export function UsersPage({ initialData }: { initialData: UsersInitialData }) {
+  const session = authClient.useSession()
+
+  return (
+    <UsersManagement
+      api={usersApi}
+      currentUserId={session.data?.user?.id}
+      roles={['admin', 'editor', 'viewer']}
+      initialData={initialData}
+    />
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/permissions/page.tsx`),`import { PermissionsEditor } from '@murumets-ee/admin-ui/permissions'
+import { BUILT_IN_ROLES, buildResourceCatalog } from '@murumets-ee/auth'
+import { setRequestLocale } from 'next-intl/server'
+import { allEntities, pluginResources } from '@/lib/admin-config'
+import { getToolkitApp } from '@/lib/app'
+import { loadRoles } from '@/lib/load-roles'
+
+export default async function PermissionsPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  const app = await getToolkitApp()
+  const savedRoles = await loadRoles(app)
+  const statements = buildResourceCatalog(allEntities, pluginResources)
+
+  return (
+    <div className="p-6">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold">Permissions</h1>
+        <p className="text-sm text-muted-foreground">
+          Configure what each role can do. Admin always has full access.
+        </p>
+      </div>
+      <PermissionsEditor
+        statements={statements}
+        roles={Object.keys(savedRoles)}
+        builtInRoles={[...BUILT_IN_ROLES]}
+        initialPermissions={savedRoles}
+      />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/roles/page.tsx`),`import { RolesEditor } from '@murumets-ee/admin-ui/permissions'
+import { BUILT_IN_ROLES } from '@murumets-ee/auth'
+import { setRequestLocale } from 'next-intl/server'
+import { getToolkitApp } from '@/lib/app'
+import { loadRoles } from '@/lib/load-roles'
+
+export default async function RolesPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  const app = await getToolkitApp()
+  const savedRoles = await loadRoles(app)
+
+  const roles = [
+    { name: 'admin', builtIn: true, permissionCount: 0 },
+    ...Object.entries(savedRoles).map(([name, perms]) => ({
+      name,
+      builtIn: (BUILT_IN_ROLES as readonly string[]).includes(name),
+      permissionCount: Object.values(perms).flat().length,
+    })),
+  ]
+
+  return (
+    <div className="p-6">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold">Roles</h1>
+        <p className="text-sm text-muted-foreground">
+          Manage user roles. Built-in roles cannot be deleted.
+        </p>
+      </div>
+      <RolesEditor roles={roles} permissionsHref={\`/\${locale}/admin/permissions\`} />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/activity/page.tsx`),`import { AuditLog } from '@murumets-ee/admin-ui/audit-log'
+import { fetchAuditLogData } from '@murumets-ee/admin-ui/server'
+import { setRequestLocale } from 'next-intl/server'
+import { withAdminContext } from '@/lib/with-admin-context'
+
+export default async function ActivityPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  return withAdminContext(locale, async () => {
+    const initialData = await fetchAuditLogData()
+
+    return (
+      <div className="p-6">
+        <div className="mb-6">
+          <h1 className="text-2xl font-bold">Activity Log</h1>
+          <p className="text-sm text-muted-foreground">
+            Track all content changes across your CMS.
+          </p>
+        </div>
+        <AuditLog
+          initialData={initialData}
+          editHrefPattern={\`/\${locale}/admin/:entityType/:entityId\`}
+        />
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/tickets/page.tsx`),`import { Ticket, Department, TicketTag } from '@murumets-ee/ticketing'
+import { headers } from 'next/headers'
+import { setRequestLocale } from 'next-intl/server'
+import { withAdminContext } from '@/lib/with-admin-context'
+import { auth } from '@/lib/auth'
+import { TicketsInboxClient } from './tickets-inbox-client'
+import { fetchEntityList } from '@murumets-ee/admin-ui/server'
+import type {
+  TicketData,
+  DepartmentData,
+  TagData,
+} from '@murumets-ee/ticketing-ui'
+
+interface TicketsPageProps {
+  params: Promise<{ locale: string }>
+}
+
+export default async function TicketsPage({ params }: TicketsPageProps) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  const h = await headers()
+  const session = await auth.api.getSession({ headers: h })
+  const currentUserId = session?.user?.id ?? ''
+
+  return withAdminContext(locale, async () => {
+    const ticketData = await fetchEntityList(Ticket, {
+      sortField: 'lastReplyAt',
+      sortDirection: 'desc',
+      limit: 50,
+    })
+
+    const departmentData = await fetchEntityList(Department, {
+      sortField: 'name',
+      sortDirection: 'asc',
+      limit: 100,
+    })
+
+    const tagData = await fetchEntityList(TicketTag, {
+      sortField: 'name',
+      sortDirection: 'asc',
+      limit: 100,
+    })
+
+    return (
+      <TicketsInboxClient
+        initialTickets={ticketData.items as unknown as TicketData[]}
+        initialTotal={ticketData.total}
+        initialDepartments={departmentData.items as unknown as DepartmentData[]}
+        initialTags={tagData.items as unknown as TagData[]}
+        currentUserId={currentUserId}
+        locale={locale}
+      />
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/tickets/tickets-inbox-client.tsx`),`'use client'
+
+import { QueryProvider } from '@murumets-ee/admin-ui'
+import { InboxProvider, TicketInbox } from '@murumets-ee/ticketing-ui/inbox'
+import type {
+  TicketData,
+  DepartmentData,
+  TagData,
+} from '@murumets-ee/ticketing-ui'
+
+interface TicketsInboxClientProps {
+  initialTickets: TicketData[]
+  initialTotal: number
+  initialDepartments: DepartmentData[]
+  initialTags: TagData[]
+  currentUserId: string
+  locale: string
+}
+
+export function TicketsInboxClient({
+  initialTickets,
+  initialTotal,
+  initialDepartments,
+  initialTags,
+  currentUserId,
+}: TicketsInboxClientProps) {
+  return (
+    <QueryProvider>
+      <InboxProvider
+        apiBasePath="/api/admin"
+        initialTickets={initialTickets}
+        initialTotal={initialTotal}
+        initialDepartments={initialDepartments}
+        initialTags={initialTags}
+        currentUserId={currentUserId}
+      >
+        <div className="h-[calc(100vh-3.5rem)]">
+          <TicketInbox currentUserId={currentUserId} />
+        </div>
+      </InboxProvider>
+    </QueryProvider>
+  )
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/tickets/board/page.tsx`),`import { Ticket, Department } from '@murumets-ee/ticketing'
+import { setRequestLocale } from 'next-intl/server'
+import { withAdminContext } from '@/lib/with-admin-context'
+import { fetchEntityList } from '@murumets-ee/admin-ui/server'
+import { TicketBoardClient } from './ticket-board-client'
+import type { TicketData, DepartmentData } from '@murumets-ee/ticketing-ui'
+
+interface TicketBoardPageProps {
+  params: Promise<{ locale: string }>
+}
+
+export default async function TicketBoardPage({ params }: TicketBoardPageProps) {
+  const { locale } = await params
+  setRequestLocale(locale)
+
+  return withAdminContext(locale, async () => {
+    const ticketData = await fetchEntityList(Ticket, {
+      sortField: 'lastReplyAt',
+      sortDirection: 'desc',
+      limit: 200,
+    })
+
+    const departmentData = await fetchEntityList(Department, {
+      sortField: 'name',
+      sortDirection: 'asc',
+      limit: 100,
+    })
+
+    return (
+      <div className="p-6 h-[calc(100vh-3.5rem)]">
+        <div className="mb-4">
+          <h1 className="text-2xl font-bold">Ticket Board</h1>
+          <p className="text-sm text-muted-foreground">
+            Kanban view of tickets by status
+          </p>
+        </div>
+        <TicketBoardClient
+          initialTickets={ticketData.items as unknown as TicketData[]}
+          initialDepartments={departmentData.items as unknown as DepartmentData[]}
+          locale={locale}
+        />
+      </div>
+    )
+  })
+}
+`),await h(r(e,`app/[locale]/(shell)/admin/tickets/board/ticket-board-client.tsx`),`'use client'
+
+import { useMemo } from 'react'
+import { TicketBoard } from '@murumets-ee/ticketing-ui/board'
+import type { TicketData, DepartmentData } from '@murumets-ee/ticketing-ui'
+import { useRouter } from 'next/navigation'
+
+interface TicketBoardClientProps {
+  initialTickets: TicketData[]
+  initialDepartments: DepartmentData[]
+  locale: string
+}
+
+export function TicketBoardClient({
+  initialTickets,
+  initialDepartments,
+  locale,
+}: TicketBoardClientProps) {
+  const router = useRouter()
+  const departmentMap = useMemo(
+    () => new Map(initialDepartments.map((d) => [d.id, d])),
+    [initialDepartments],
+  )
+
+  return (
+    <TicketBoard
+      tickets={initialTickets}
+      departments={departmentMap}
+      onTicketSelect={(ticket) => {
+        router.push(\`/\${locale}/admin/tickets?selected=\${ticket.id}\`)
+      }}
+      className="h-[calc(100%-4rem)]"
+    />
+  )
+}
+`),await h(r(e,`app/api/ticketing/inbound/route.ts`),`/**
+ * Resend inbound email webhook endpoint.
+ *
+ * Public endpoint (no session auth) — protected by webhook signature
+ * verification (HMAC-SHA256). Lives outside the admin API handler
+ * because the admin handler requires authentication.
+ */
+
+import { getToolkitApp } from '@/lib/app'
+
+await getToolkitApp()
+
+export async function POST(req: Request): Promise<Response> {
+  const { handleInboundWebhook } = await import('@murumets-ee/ticketing')
+  const { QueueClient } = await import('@murumets-ee/queue/client')
+  const { getApp } = await import('@murumets-ee/core')
+
+  const db = getApp().db.readWrite
+  const queueClient = new QueueClient({ db })
+
+  return handleInboundWebhook(req, (type, payload) => queueClient.enqueue(type, payload))
+}
+`),await h(r(e,`app/api/admin/[...path]/route.ts`),`import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'
+import { buildPermissionChecker, buildResourceCatalog } from '@murumets-ee/auth'
+import { permissionRoutes } from '@murumets-ee/auth/admin'
+import { ContentClient } from '@murumets-ee/content/client'
+import { LockService } from '@murumets-ee/content/lock'
+import type { PermissionChecker } from '@murumets-ee/core'
+import { getApp } from '@murumets-ee/core'
+import {
+  AuditLogClient,
+  createAuditDbWriter,
+  createAuditLogger,
+  createLogger,
+} from '@murumets-ee/logging'
+import { logRoutes } from '@murumets-ee/logging/admin'
+import { mediaRoutes } from '@murumets-ee/media/admin'
+import { createSettingsClient } from '@murumets-ee/settings'
+import { settingsRoutes } from '@murumets-ee/settings/admin'
+import { storageRoutes } from '@murumets-ee/storage/admin'
+import { taxonomyRoutes } from '@murumets-ee/taxonomy/admin'
+import { ticketingRoutes } from '@murumets-ee/ticketing/admin'
+import {
+  allEntities,
+  crudEntities,
+  pluginResources,
+  taxonomyVocabularies,
+} from '@/lib/admin-config'
+import { getToolkitApp } from '@/lib/app'
+import { auth } from '@/lib/auth'
+import { loadRoles } from '@/lib/load-roles'
+import { permissionSettings } from '@/settings/permissions'
+import { siteSettings } from '@/settings/site'
+
+await getToolkitApp()
+
+let _auditLogger: ReturnType<typeof createAuditLogger> | null = null
+let _checker: PermissionChecker | null = null
+
+const routes = [
+  mediaRoutes(),
+  storageRoutes(),
+  settingsRoutes(siteSettings),
+  taxonomyRoutes(taxonomyVocabularies),
+  ticketingRoutes(),
+  logRoutes(() => new AuditLogClient(getApp().db.readWrite)),
+  permissionRoutes({
+    getStatements: () => buildResourceCatalog(allEntities, pluginResources),
+    loadRoles: async () => loadRoles(getApp()),
+    saveRoles: async (roles) => {
+      const app = getApp()
+      const client = createSettingsClient(permissionSettings, { app })
+      await client.set('roles', roles)
+    },
+    onSave: () => {
+      _checker = null
+    },
+  }),
+]
+
+const handler = createAdminApiHandler({
+  authenticate: async (req) => {
+    const session = await auth.api.getSession({ headers: req.headers })
+    if (!session?.user) return null
+    const role = (session.user as Record<string, unknown>).role as string | undefined
+    return { id: session.user.id, role, name: session.user.name, email: session.user.email }
+  },
+  defaultLocale: 'en',
+  entities: crudEntities,
+  routes,
+  loadPermissions: async () => {
+    if (_checker) return _checker
+    const roles = await loadRoles(getApp())
+    _checker = buildPermissionChecker(roles)
+    return _checker
+  },
+  auditLogger: {
+    log: async (entry) => {
+      if (!_auditLogger) {
+        const app = getApp()
+        _auditLogger = createAuditLogger({
+          logger: createLogger({ name: 'audit' }),
+          dbWriter: createAuditDbWriter(app.db.readWrite),
+        })
+      }
+      return _auditLogger.log(entry)
+    },
+  },
+  contentClientFactory: (entity) =>
+    new ContentClient({ entity, db: getApp().db.readWrite }),
+  lockServiceFactory: () =>
+    new LockService({ db: getApp().db.readWrite }),
+})
+
+export const { GET, POST, PATCH, DELETE } = handler
+`)}async function x(e,t){await h(r(e,`lib/auth.ts`),`import { getToolkitApp } from './app'
+import { getAuth } from '@murumets-ee/auth'
+
+export async function getAuthInstance() {
+  await getToolkitApp()
+  return getAuth()
+}
+`),await h(r(e,`lib/auth-client.ts`),`import { createClient } from '@murumets-ee/auth/client'
+
+export const authClient = createClient()
+`),await h(r(e,`app/api/auth/[...all]/route.ts`),`import { toNextJsHandler } from 'better-auth/next-js'
+import { getAuthInstance } from '../../../../lib/auth'
+
+let _handler: ReturnType<typeof toNextJsHandler> | null = null
+
+async function handler() {
+  if (!_handler) {
+    const auth = await getAuthInstance()
+    _handler = toNextJsHandler(auth)
+  }
+  return _handler
+}
+
+export async function GET(req: Request) {
+  const h = await handler()
+  return h.GET(req)
+}
+
+export async function POST(req: Request) {
+  const h = await handler()
+  return h.POST(req)
+}
+`),await h(r(e,`app/[locale]/auth/layout.tsx`),`import { AuthProviders } from './providers'
+import type { ReactNode } from 'react'
+
+export default function AuthLayout({ children }: { children: ReactNode }) {
+  return (
+    <AuthProviders>
+      <div className="flex min-h-[calc(100vh-3rem)] items-center justify-center px-4">
+        {children}
+      </div>
+    </AuthProviders>
+  )
+}
+`),await h(r(e,`app/[locale]/auth/providers.tsx`),`'use client'
+
+import { AuthUIProvider } from '@murumets-ee/auth-ui'
+import { authClient } from '@/lib/auth-client'
+import Link from 'next/link'
+import { useRouter } from 'next/navigation'
+import { useLocale } from 'next-intl'
+import type { ReactNode } from 'react'
+
+export function AuthProviders({ children }: { children: ReactNode }) {
+  const router = useRouter()
+  const locale = useLocale()
+
+  return (
+    <AuthUIProvider
+      authClient={authClient as never}
+      basePath="/auth"
+      redirectTo="/"
+      Link={Link}
+      navigate={(url) => router.push(url)}
+      resetPasswordUrl={\`/\${locale}/auth/reset-password\`}
+    >
+      {children}
+    </AuthUIProvider>
+  )
+}
+`),await h(r(e,`app/[locale]/auth/sign-in/page.tsx`),`import { SignInForm } from '@murumets-ee/auth-ui'
+
+export default function SignInPage() {
+  return <SignInForm />
+}
+`),await h(r(e,`app/[locale]/auth/sign-up/page.tsx`),`import { SignUpForm } from '@murumets-ee/auth-ui'
+
+export default function SignUpPage() {
+  return <SignUpForm />
+}
+`),await h(r(e,`app/[locale]/auth/forgot-password/page.tsx`),`import { ForgotPasswordForm } from '@murumets-ee/auth-ui'
+
+export default function ForgotPasswordPage() {
+  return <ForgotPasswordForm />
+}
+`),await h(r(e,`app/[locale]/auth/reset-password/page.tsx`),`import { Suspense } from 'react'
+import { ResetPasswordContent } from './content'
+
+export default function ResetPasswordPage() {
+  return (
+    <Suspense>
+      <ResetPasswordContent />
+    </Suspense>
+  )
+}
+`),await h(r(e,`app/[locale]/auth/reset-password/content.tsx`),`'use client'
+
+import { useSearchParams } from 'next/navigation'
+import { ResetPasswordForm } from '@murumets-ee/auth-ui'
+
+export function ResetPasswordContent() {
+  const searchParams = useSearchParams()
+  const token = searchParams.get('token')
+
+  if (!token) {
+    return (
+      <div className="text-center">
+        <h1 className="text-2xl font-bold text-zinc-900 dark:text-zinc-50">
+          Invalid or expired link
+        </h1>
+        <p className="mt-2 text-zinc-500">
+          Please request a new password reset.
+        </p>
+      </div>
+    )
+  }
+
+  return <ResetPasswordForm token={token} />
+}
+`),await h(r(e,`app/[locale]/setup/page.tsx`),`import { redirect } from 'next/navigation'
+import { sql } from 'drizzle-orm'
+import { getToolkitApp } from '@/lib/app'
+import { SetupForm } from './form'
+
+export default async function SetupPage() {
+  const app = await getToolkitApp()
+  const result = await app.db.readOnly.execute<{ count: string }>(
+    sql\`SELECT COUNT(*)::text as count FROM "user"\`,
+  )
+
+  if (Number(result[0]?.count) > 0) {
+    redirect('/')
+  }
+
+  return (
+    <div className="max-w-md mx-auto p-8">
+      <h1 className="text-2xl font-bold mb-2">Create Admin</h1>
+      <p className="text-sm text-zinc-500 dark:text-zinc-400 mb-6">
+        No users found. Create the first admin account.
+      </p>
+      <SetupForm />
+    </div>
+  )
+}
+`),await h(r(e,`app/[locale]/setup/form.tsx`),`'use client'
+
+import { useState } from 'react'
+import { createFirstAdmin } from './actions'
+
+export function SetupForm() {
+  const [result, setResult] = useState<{ ok?: boolean; error?: string; email?: string } | null>(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e: React.FormEvent<HTMLFormElement>) {
+    e.preventDefault()
+    setLoading(true)
+    setResult(null)
+    const res = await createFirstAdmin(new FormData(e.currentTarget))
+    setResult(res)
+    setLoading(false)
+  }
+
+  if (result?.ok) {
+    return (
+      <div className="space-y-2">
+        <p className="text-green-600 dark:text-green-400">Admin created: {result.email}</p>
+        <a href="/auth/sign-in" className="text-blue-600 dark:text-blue-400 hover:underline">
+          Sign in &rarr;
+        </a>
+      </div>
+    )
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="flex flex-col gap-4">
+      <label className="text-sm font-medium">
+        Name
+        <input
+          name="name"
+          required
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+      <label className="text-sm font-medium">
+        Email
+        <input
+          name="email"
+          type="email"
+          required
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+      <label className="text-sm font-medium">
+        Password (min 8 chars)
+        <input
+          name="password"
+          type="password"
+          required
+          minLength={8}
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+
+      {result?.error && <p className="text-red-600 dark:text-red-400 text-sm">{result.error}</p>}
+
+      <button
+        type="submit"
+        disabled={loading}
+        className="px-4 py-2 text-sm rounded-md bg-blue-600 text-white hover:bg-blue-500 disabled:opacity-50 transition-colors"
+      >
+        {loading ? 'Creating...' : 'Create Admin'}
+      </button>
+    </form>
+  )
+}
+`),await h(r(e,`app/[locale]/setup/actions.ts`),`'use server'
+
+import { sql } from 'drizzle-orm'
+import { getToolkitApp } from '@/lib/app'
+import { getAuth } from '@murumets-ee/auth'
+
+/**
+ * Create the first admin user. Locked down:
+ * - Advisory lock prevents race conditions (two simultaneous requests)
+ * - User count check inside the lock ensures only one admin can be created
+ * - Once any user exists, this action permanently refuses
+ */
+export async function createFirstAdmin(formData: FormData) {
+  const email = formData.get('email') as string
+  const password = formData.get('password') as string
+  const name = formData.get('name') as string
+
+  if (!email || !password || !name) {
+    return { error: 'All fields are required' }
+  }
+
+  if (password.length < 8) {
+    return { error: 'Password must be at least 8 characters' }
+  }
+
+  const app = await getToolkitApp()
+
+  // Acquire advisory lock + check atomically in a transaction
+  const canCreate = await app.db.readWrite.transaction(async (tx) => {
+    // Advisory lock 1 = "setup lock". Blocks concurrent setup attempts.
+    await tx.execute(sql\`SELECT pg_advisory_xact_lock(1)\`)
+
+    const result = await tx.execute<{ count: string }>(
+      sql\`SELECT COUNT(*)::text as count FROM "user"\`,
+    )
+    return Number(result[0]?.count) === 0
+  })
+
+  if (!canCreate) {
+    return { error: 'Admin user already exists. Setup is complete.' }
+  }
+
+  const auth = getAuth()
+
+  const adminUser = await auth.api.signUpEmail({
+    body: { email, password, name },
+  })
+
+  await app.db.readWrite.execute(
+    sql\`UPDATE "user" SET role = 'admin' WHERE id = \${adminUser.user.id}\`,
+  )
+
+  return { ok: true, email: adminUser.user.email }
+}
+`)}async function S(e,t){let{name:n}=t;await h(r(e,`.env.example`),`DATABASE_URL=postgresql://${n}:${n}_dev_password@localhost:5432/${n}_dev
+BETTER_AUTH_SECRET=dev-secret-change-me-in-production-min-32-chars
+BETTER_AUTH_URL=http://localhost:3000
+LOG_LEVEL=debug
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+# Queue worker — by default runs embedded in the web process.
+# Set to "false" in production and run "pnpm worker" as a separate process.
+# QUEUE_WORKER=false
+RESEND_API_KEY=
+RESEND_WEBHOOK_SECRET=
+MAIL_FROM=noreply@example.com
+CSAT_SECRET=
+`),await h(r(e,`.dockerignore`),`# Dependencies (installed inside Docker)
+node_modules/
+.pnpm-store/
+
+# Build outputs (rebuilt inside Docker)
+.next/
+out/
+dist/
+
+# Git
+.git/
+.gitignore
+
+# Environment files (pass via docker run --env-file)
+.env
+.env.*
+!.env.example
+
+# Docker files
+Dockerfile*
+.dockerignore
+docker-compose*.yml
+
+# Tests
+coverage/
+**/*.test.*
+**/*.spec.*
+**/vitest.config.*
+docker-compose.test.yml
+
+# Development tooling
+.vscode/
+.idea/
+.turbo/
+.cache/
+*.tsbuildinfo
+
+# Documentation
+*.md
+docs/
+
+# OS files
+.DS_Store
+Thumbs.db
+`),await h(r(e,`Dockerfile`),`# --- Base image ---
+# Node 22 LTS (Debian slim — glibc required for sharp image optimization)
+FROM node:22-slim AS base
+
+# --- Stage 1: Install dependencies ---
+FROM base AS deps
+WORKDIR /app
+RUN corepack enable pnpm
+COPY package.json pnpm-lock.yaml ./
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \\
+    pnpm install --frozen-lockfile
+
+# --- Stage 2: Build the application ---
+FROM base AS builder
+WORKDIR /app
+RUN corepack enable pnpm
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+# Dummy env vars so toolkit.config.ts doesn't throw at build time (no DB connection needed)
+ENV DATABASE_URL=postgresql://build:build@localhost:5432/build
+ENV BETTER_AUTH_SECRET=build-secret-not-used-at-runtime
+RUN pnpm build
+
+# --- Stage 3: Production runner ---
+FROM base AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Copy standalone output (includes server.js + traced node_modules)
+COPY --from=builder --chown=node:node /app/.next/standalone ./
+# Copy static assets (JS/CSS chunks — excluded from standalone trace)
+COPY --from=builder --chown=node:node /app/.next/static ./.next/static
+# Copy public assets (favicon, robots.txt, images)
+COPY --from=builder --chown=node:node /app/public ./public
+# Copy migrations (applied at app startup by the toolkit migration runner)
+COPY --from=builder --chown=node:node /app/migrations ./migrations
+
+# Run as non-root user
+USER node
+EXPOSE 3000
+CMD ["node", "server.js"]
+`),await h(r(e,`docker-compose.yml`),`services:
+  postgres:
+    image: postgres:17-alpine
+    container_name: ${n}-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${n}
+      POSTGRES_PASSWORD: ${n}_dev_password
+      POSTGRES_DB: ${n}_dev
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${n} -d ${n}_dev"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_data:
+    name: ${n}_postgres_data
+`),await h(r(e,`docker-compose.prod.yml`),`services:
+  app:
+    build: .
+    restart: unless-stopped
+    env_file: .env
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "3000:3000"
+    networks:
+      - internal
+
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${n}
+      POSTGRES_PASSWORD: \${DB_PASSWORD}
+      POSTGRES_DB: ${n}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${n} -d ${n}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - internal
+
+volumes:
+  postgres_data:
+
+networks:
+  internal:
+`),await y(r(e,`.gitignore`),`
+# Toolkit generated files
+generated/
+
+# Environment
+.env*
+!.env.example
+`)}async function C(e,t){await h(r(e,`entities/index.ts`),`export { Article } from './article'
+export { Category } from './category'
+`),await h(r(e,`entities/article.ts`),`import { behavior, defineEntity, field } from '@murumets-ee/entity'
+
+export const Article = defineEntity({
+  name: 'article',
+  fields: {
+    title: field.text({ required: true, maxLength: 200, indexed: true, translatable: true }),
+    slug: field.slug({ from: 'title', unique: true }),
+    excerpt: field.text({ maxLength: 500, translatable: true }),
+    body: field.richtext(),
+    viewCount: field.number({ default: 0, integer: true }),
+    featured: field.boolean({ default: false }),
+    publishDate: field.date(),
+    contentType: field.select({ options: ['news', 'tutorial', 'announcement'], default: 'news' }),
+    category: field.reference({ entity: 'category', required: false }),
+    tags: field.reference({ entity: 'category', cardinality: 'many' }),
+    coverImage: field.media({ accept: ['image/*'] }),
+  },
+  behaviors: [
+    behavior.publishable(),
+    behavior.auditable(),
+    behavior.sluggable('title'),
+    behavior.revisionable(),
+  ],
+  scope: 'global',
+  access: {
+    view: 'public',
+    create: 'group.editor',
+    update: 'group.editor',
+    delete: 'group.admin',
+  },
+})
+`),await h(r(e,`entities/category.ts`),`import { defineEntity, field } from '@murumets-ee/entity'
+
+export const Category = defineEntity({
+  name: 'category',
+  fields: {
+    name: field.text({ required: true, maxLength: 100, indexed: true, translatable: true }),
+    slug: field.slug({ from: 'name', unique: true }),
+    description: field.text({ maxLength: 500, translatable: true }),
+  },
+  scope: 'global',
+  access: {
+    view: 'public',
+    create: 'group.editor',
+    update: 'group.editor',
+    delete: 'group.admin',
+  },
+})
+`)}async function w(e,t){await h(r(e,`i18n/routing.ts`),`import { defineRouting } from 'next-intl/routing'
+
+export const routing = defineRouting({
+  locales: ['en'],
+  defaultLocale: 'en',
+})
+`),await h(r(e,`i18n/request.ts`),`import { getRequestConfig } from 'next-intl/server'
+import { hasLocale } from 'next-intl'
+import { routing } from './routing'
+import { getAuthMessages } from '@murumets-ee/auth-ui/i18n'
+
+export default getRequestConfig(async ({ requestLocale }) => {
+  const requested = await requestLocale
+  const locale = hasLocale(routing.locales, requested)
+    ? requested
+    : routing.defaultLocale
+
+  const authMessages = await getAuthMessages(locale)
+
+  return {
+    locale,
+    messages: {
+      ...authMessages,
+    },
+  }
+})
+`)}const T={myorgCore:`0.1.0`,myorgDb:`0.1.0`,myorgEntity:`0.1.0`,myorgLogging:`0.1.0`,myorgAuth:`0.1.0`,myorgAuthUi:`0.1.0`,myorgAdminUi:`0.1.0`,myorgContent:`0.1.0`,myorgContentApi:`0.1.0`,myorgSettings:`0.1.0`,myorgStorage:`0.1.0`,myorgMedia:`0.1.0`,myorgTaxonomy:`0.1.0`,myorgQueue:`0.1.0`,myorgMail:`0.1.0`,myorgTicketing:`0.1.0`,myorgTicketingUi:`0.1.0`,myorgEditor:`0.1.0`,myorgBlocks:`0.1.0`,myorgTokens:`0.1.0`,myorgUi:`0.1.0`,myorgCli:`0.1.0`,betterAuth:`1.4.0`,drizzleOrm:`0.45.1`,nextIntl:`4.8.2`,nextThemes:`0.4.6`,lucideReact:`0.563.0`,postgres:`3.4.5`,reactHookForm:`7.71.1`,hookformResolvers:`5.2.2`,zod:`3.24.1`,tanstackReactQuery:`5.60.5`,tanstackReactTable:`8.21.3`,drizzleKit:`0.31.10`,tsx:`4.19.2`,babelReactCompiler:`1.0.0`};async function E(e,t,n){await D(e,t),n?.(`Workspace root created`),n?.(`Creating admin app...`),await k(e,t),n?.(`Admin app created`),n?.(`Creating web app...`),await A(e,t),n?.(`Web app created`),await O(e,t),n?.(`Shared config package created`)}async function D(e,t){let{name:n}=t;await o(e,{recursive:!0}),await h(r(e,`pnpm-workspace.yaml`),`packages:
+  - 'packages/*'
+  - 'apps/*'
+
+ignoredBuiltDependencies:
+  - sharp
+  - unrs-resolver
+`),await h(r(e,`package.json`),`${JSON.stringify({name:`@${n}/monorepo`,version:`0.0.0`,private:!0,type:`module`,scripts:{dev:`turbo dev`,build:`turbo build`,"db:generate":`tsx --env-file=.env packages/config/scripts/generate-schema.ts`,"db:migrate:generate":`drizzle-kit generate --config packages/config/drizzle.config.ts`,"db:migrate":`tsx --env-file=.env packages/config/scripts/migrate.ts`,"db:reset":`tsx --env-file=.env packages/config/scripts/reset-db.ts`},devDependencies:{turbo:`^2.3.3`,typescript:`^5.7.3`,tsx:`^${T.tsx}`,"drizzle-kit":`^${T.drizzleKit}`}},null,2)}\n`),await h(r(e,`.gitignore`),`# dependencies
+node_modules/
+
+# build
+dist/
+.next/
+.turbo/
+
+# env
+.env*
+!.env.example
+
+# toolkit generated
+generated/
+
+# IDE
+.vscode/
+.idea/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# logs
+*.log
+
+# migrations meta
+migrations/
+
+# turbo
+.turbo/
+`),await h(r(e,`.env.example`),`DATABASE_URL=postgresql://${n}:${n}_dev_password@localhost:5432/${n}_dev
+BETTER_AUTH_SECRET=dev-secret-change-me-in-production-min-32-chars
+BETTER_AUTH_URL=http://localhost:3000
+LOG_LEVEL=debug
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+QUEUE_WORKER=true
+RESEND_API_KEY=
+RESEND_WEBHOOK_SECRET=
+MAIL_FROM=noreply@example.com
+CSAT_SECRET=
+`),await h(r(e,`docker-compose.yml`),`services:
+  postgres:
+    image: postgres:17-alpine
+    container_name: ${n}-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${n}
+      POSTGRES_PASSWORD: ${n}_dev_password
+      POSTGRES_DB: ${n}_dev
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${n} -d ${n}_dev"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_data:
+    name: ${n}_postgres_data
+`)}async function O(e,t){let{name:n}=t,i=r(e,`packages/config`);await h(r(i,`package.json`),`${JSON.stringify({name:`@${n}/config`,version:`0.1.0`,private:!0,type:`module`,exports:{".":`./toolkit.config.ts`,"./entities":`./entities/index.ts`,"./entities/*":`./entities/*`,"./app":`./lib/app.ts`,"./auth":`./lib/auth.ts`,"./auth-client":`./lib/auth-client.ts`},dependencies:{"@murumets-ee/core":`^${T.myorgCore}`,"@murumets-ee/db":`^${T.myorgDb}`,"@murumets-ee/entity":`^${T.myorgEntity}`,"@murumets-ee/logging":`^${T.myorgLogging}`,"@murumets-ee/auth":`^${T.myorgAuth}`,"better-auth":`^${T.betterAuth}`,"drizzle-orm":`^${T.drizzleOrm}`,postgres:`^${T.postgres}`,zod:`^${T.zod}`}},null,2)}\n`),await h(r(i,`tsconfig.json`),`${JSON.stringify({compilerOptions:{target:`ES2022`,module:`ESNext`,moduleResolution:`Bundler`,strict:!0,esModuleInterop:!0,skipLibCheck:!0,resolveJsonModule:!0},include:[`**/*.ts`]},null,2)}\n`),await h(r(i,`toolkit.config.ts`),`import { auth } from '@murumets-ee/auth/plugin'
+import { content } from '@murumets-ee/content/plugin'
+import { defineConfig } from '@murumets-ee/core'
+import { logging } from '@murumets-ee/logging/plugin'
+import { mail, ResendMailProvider } from '@murumets-ee/mail'
+import { media } from '@murumets-ee/media/plugin'
+import { queue } from '@murumets-ee/queue/plugin'
+import { settings } from '@murumets-ee/settings/plugin'
+import { storage } from '@murumets-ee/storage/plugin'
+import { taxonomy } from '@murumets-ee/taxonomy/plugin'
+import { ticketing } from '@murumets-ee/ticketing/plugin'
+import { Article, Category } from './entities'
+import * as authSchema from './generated/auth-schema'
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required')
+}
+
+export default defineConfig({
+  db: {
+    url: process.env.DATABASE_URL,
+    poolMin: 2,
+    poolMax: 10,
+  },
+  logging: {
+    level: (process.env.LOG_LEVEL || 'info') as 'debug' | 'info' | 'warn' | 'error',
+    name: '${n}',
+  },
+  entities: [Category, Article],
+  plugins: [
+    auth({ providers: ['email'], schema: authSchema }),
+    content({
+      locales: [{ code: 'en', label: 'English' }],
+      defaultLocale: 'en',
+    }),
+    logging(),
+    settings(),
+    storage(),
+    media(),
+    taxonomy(),
+    queue(),
+    mail({
+      provider: process.env.RESEND_API_KEY
+        ? new ResendMailProvider({ apiKey: process.env.RESEND_API_KEY })
+        : undefined,
+      defaultFrom: process.env.MAIL_FROM ?? 'noreply@example.com',
+      webhookSecret: process.env.RESEND_WEBHOOK_SECRET,
+    }),
+    ticketing({
+      csatSecret: process.env.CSAT_SECRET,
+    }),
+  ],
+  projectRoot: import.meta.dirname,
+})
+`),await h(r(i,`auth.config.ts`),`import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { admin } from 'better-auth/plugins'
+import { organization } from 'better-auth/plugins/organization'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import postgres from 'postgres'
+
+const sql = postgres(process.env.DATABASE_URL!)
+const db = drizzle(sql)
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: 'pg' }),
+  emailAndPassword: { enabled: true },
+  plugins: [
+    admin(),
+    organization(),
+  ],
+})
+`),await h(r(i,`drizzle.config.ts`),`import type { Config } from 'drizzle-kit'
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required')
+}
+
+export default {
+  schema: ['./generated/schema.ts', './generated/auth-schema.ts'],
+  out: './migrations',
+  dialect: 'postgresql',
+  dbCredentials: {
+    url: process.env.DATABASE_URL,
+  },
+} satisfies Config
+`),await h(r(i,`entities/index.ts`),`export { Article } from './article'
+export { Category } from './category'
+`),await h(r(i,`entities/article.ts`),`import { behavior, defineEntity, field } from '@murumets-ee/entity'
+
+export const Article = defineEntity({
+  name: 'article',
+  fields: {
+    title: field.text({ required: true, maxLength: 200, indexed: true, translatable: true }),
+    slug: field.slug({ from: 'title', unique: true }),
+    excerpt: field.text({ maxLength: 500, translatable: true }),
+    body: field.richtext(),
+    viewCount: field.number({ default: 0, integer: true }),
+    featured: field.boolean({ default: false }),
+    publishDate: field.date(),
+    contentType: field.select({ options: ['news', 'tutorial', 'announcement'], default: 'news' }),
+    category: field.reference({ entity: 'category', required: false }),
+    tags: field.reference({ entity: 'category', cardinality: 'many' }),
+    coverImage: field.media({ accept: ['image/*'] }),
+  },
+  behaviors: [
+    behavior.publishable(),
+    behavior.auditable(),
+    behavior.sluggable('title'),
+    behavior.revisionable(),
+  ],
+  scope: 'global',
+  access: {
+    view: 'public',
+    create: 'group.editor',
+    update: 'group.editor',
+    delete: 'group.admin',
+  },
+})
+`),await h(r(i,`entities/category.ts`),`import { defineEntity, field } from '@murumets-ee/entity'
+
+export const Category = defineEntity({
+  name: 'category',
+  fields: {
+    name: field.text({ required: true, maxLength: 100, indexed: true, translatable: true }),
+    slug: field.slug({ from: 'name', unique: true }),
+    description: field.text({ maxLength: 500, translatable: true }),
+  },
+  scope: 'global',
+  access: {
+    view: 'public',
+    create: 'group.editor',
+    update: 'group.editor',
+    delete: 'group.admin',
+  },
+})
+`),await h(r(i,`lib/app.ts`),`import { createApp, setApp, type ToolkitApp } from '@murumets-ee/core'
+import config from '../toolkit.config'
+
+let appInstance: ToolkitApp | null = null
+
+export async function getToolkitApp(): Promise<ToolkitApp> {
+  if (!appInstance) {
+    appInstance = await createApp(config)
+    setApp(appInstance)
+  }
+  return appInstance
+}
+`),await h(r(i,`lib/auth.ts`),`import { getToolkitApp } from './app'
+import { getAuth } from '@murumets-ee/auth'
+
+export async function getAuthInstance() {
+  await getToolkitApp()
+  return getAuth()
+}
+`),await h(r(i,`lib/auth-client.ts`),`import { createClient } from '@murumets-ee/auth/client'
+
+export const authClient = createClient()
+`),await h(r(i,`generated/auth-schema.ts`),`// This file is generated by better-auth CLI.
+// Run: npx @better-auth/cli generate --config auth.config.ts -y
+export {}
+`),await h(r(i,`scripts/generate-schema.ts`),`/**
+ * Generate Drizzle schemas from entity definitions
+ */
+
+import { mkdir, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { generateSchemaCode, generateTranslationSchemaCode } from '@murumets-ee/entity'
+import config from '../toolkit.config'
+
+async function generateSchemas() {
+  console.log('Generating Drizzle schemas from entity definitions...')
+
+  const schemaDir = join(import.meta.dirname, '..', 'generated')
+  await mkdir(schemaDir, { recursive: true })
+
+  const imports: string[] = []
+  const schemas: string[] = []
+  let hasTranslations = false
+
+  for (const entity of config.entities) {
+    console.log(\`  - Generating schema for \${entity.name}\`)
+
+    const schemaCode = generateSchemaCode(entity)
+    schemas.push(\`\\n// \${entity.name} table\`)
+    schemas.push(schemaCode)
+
+    const translationCode = generateTranslationSchemaCode(entity)
+    if (translationCode) {
+      hasTranslations = true
+      schemas.push(\`\\n// \${entity.name} translations\`)
+      schemas.push(translationCode)
+    }
+  }
+
+  const pgCoreTypes = ['pgTable', 'varchar', 'text', 'boolean', 'timestamp', 'integer', 'doublePrecision', 'jsonb', 'uuid', 'index']
+  if (hasTranslations) pgCoreTypes.push('unique')
+  const pgCoreImports = \`import { \${pgCoreTypes.join(', ')} } from 'drizzle-orm/pg-core'\\n\`
+  imports.push(pgCoreImports)
+
+  const schemaFile = join(schemaDir, 'schema.ts')
+  await writeFile(schemaFile, [...imports, ...schemas].join('\\n'))
+
+  console.log(\`\\nSchemas written to: \${schemaFile}\`)
+  console.log('Run \\\`pnpm db:migrate:generate\\\` to create migrations')
+}
+
+generateSchemas().catch(console.error)
+`),await h(r(i,`scripts/migrate.ts`),`/**
+ * Run pending migrations
+ */
+
+import { createDbClient, runMigrations } from '@murumets-ee/db'
+
+async function migrate() {
+  console.log('Running migrations...')
+
+  try {
+    if (!process.env.DATABASE_URL) {
+      throw new Error('DATABASE_URL environment variable is required')
+    }
+
+    const db = createDbClient({ url: process.env.DATABASE_URL })
+    await runMigrations(db, import.meta.dirname + '/..')
+
+    console.log('Migrations completed successfully')
+    process.exit(0)
+  } catch (error) {
+    console.error('Migration failed:', error)
+    process.exit(1)
+  }
+}
+
+migrate()
+`),await h(r(i,`scripts/reset-db.ts`),`/**
+ * Reset database (DROP all tables)
+ * WARNING: Only for development
+ */
+
+import postgres from 'postgres'
+
+async function resetDb() {
+  const DATABASE_URL = process.env.DATABASE_URL
+
+  if (!DATABASE_URL) {
+    throw new Error('DATABASE_URL not set')
+  }
+
+  console.warn('WARNING: This will DROP ALL TABLES')
+  console.log('Database:', DATABASE_URL.split('@')[1])
+
+  const sql = postgres(DATABASE_URL)
+
+  try {
+    await sql\`
+      DROP SCHEMA public CASCADE;
+      CREATE SCHEMA public;
+      GRANT ALL ON SCHEMA public TO PUBLIC;
+    \`
+
+    console.log('Database reset complete')
+  } finally {
+    await sql.end()
+  }
+}
+
+resetDb().catch(console.error)
+`)}async function k(e,t){let{name:n}=t,i=r(e,`apps/admin`);await o(r(e,`apps`),{recursive:!0}),v(`pnpm create next-app@16 ${i} --typescript --tailwind --no-eslint --app --no-src-dir --turbopack --react-compiler --skip-install --import-alias "@/*"`),await _(i,[`app/page.tsx`,`app/page.module.css`,`app/fonts`,`README.md`,`pnpm-workspace.yaml`]),await g(r(i,`package.json`),{dependencies:{[`@${n}/config`]:`workspace:*`,"@murumets-ee/auth-ui":`^${T.myorgAuthUi}`,"better-auth":`^${T.betterAuth}`,"next-intl":`^${T.nextIntl}`,"next-themes":`^${T.nextThemes}`,"lucide-react":`^${T.lucideReact}`,"react-hook-form":`^${T.reactHookForm}`,"@hookform/resolvers":`^${T.hookformResolvers}`,zod:`^${T.zod}`},devDependencies:{"babel-plugin-react-compiler":T.babelReactCompiler}});let{appendToFile:a}=await Promise.resolve().then(()=>m);await a(r(i,`.gitignore`),`
+# Environment
+.env*
+!.env.example
+`),await h(r(i,`next.config.ts`),`import type { NextConfig } from 'next'
+import createNextIntlPlugin from 'next-intl/plugin'
+
+const withNextIntl = createNextIntlPlugin('./i18n/request.ts')
+
+const nextConfig: NextConfig = {
+  reactCompiler: true,
+  transpilePackages: [
+    '@${n}/config',
+    '@murumets-ee/core',
+    '@murumets-ee/entity',
+    '@murumets-ee/db',
+    '@murumets-ee/logging',
+    '@murumets-ee/auth-ui',
+  ],
+  serverExternalPackages: ['drizzle-orm', 'postgres'],
+  experimental: {
+    serverActions: {
+      bodySizeLimit: '2mb',
+    },
+  },
+}
+
+export default withNextIntl(nextConfig)
+`),await h(r(i,`proxy.ts`),`import { NextRequest, NextResponse } from 'next/server'
+import { getSessionCookie } from 'better-auth/cookies'
+import createMiddleware from 'next-intl/middleware'
+import { routing } from './i18n/routing'
+
+const intlMiddleware = createMiddleware(routing)
+
+const protectedPaths = ['/setup']
+
+export function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  const localePattern = new RegExp(\`^/(\${routing.locales.join('|')})\`)
+  const pathWithoutLocale = pathname.replace(localePattern, '') || '/'
+
+  if (protectedPaths.some((p) => pathWithoutLocale.startsWith(p))) {
+    const session = getSessionCookie(request)
+    if (!session) {
+      const locale = pathname.match(localePattern)?.[1] || routing.defaultLocale
+      return NextResponse.redirect(new URL(\`/\${locale}/auth/sign-in\`, request.url))
+    }
+  }
+
+  return intlMiddleware(request)
+}
+
+export const config = {
+  matcher: '/((?!api|_next|_vercel|.*\\\\..*).*)',
+}
+`),await h(r(i,`i18n/routing.ts`),`import { defineRouting } from 'next-intl/routing'
+
+export const routing = defineRouting({
+  locales: ['en'],
+  defaultLocale: 'en',
+})
+`),await h(r(i,`i18n/request.ts`),`import { getRequestConfig } from 'next-intl/server'
+import { hasLocale } from 'next-intl'
+import { routing } from './routing'
+import { getAuthMessages } from '@murumets-ee/auth-ui/i18n'
+
+export default getRequestConfig(async ({ requestLocale }) => {
+  const requested = await requestLocale
+  const locale = hasLocale(routing.locales, requested)
+    ? requested
+    : routing.defaultLocale
+
+  const authMessages = await getAuthMessages(locale)
+
+  return {
+    locale,
+    messages: {
+      ...authMessages,
+    },
+  }
+})
+`),await h(r(i,`app/globals.css`),`@import "tailwindcss";
+@source "../node_modules/@murumets-ee/auth-ui/dist";
+
+@custom-variant dark (&:where(.dark, .dark *));
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+.dark {
+  --background: #0a0a0a;
+  --foreground: #ededed;
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: Arial, Helvetica, sans-serif;
+}
+`),await h(r(i,`app/theme-provider.tsx`),`'use client'
+
+import { ThemeProvider as NextThemesProvider } from 'next-themes'
+import type { ReactNode } from 'react'
+
+export function ThemeProvider({ children }: { children: ReactNode }) {
+  return (
+    <NextThemesProvider
+      attribute="class"
+      defaultTheme="system"
+      enableSystem
+      disableTransitionOnChange
+    >
+      {children}
+    </NextThemesProvider>
+  )
+}
+`),await h(r(i,`app/theme-toggle.tsx`),`'use client'
+
+import { useTheme } from 'next-themes'
+import { useState, useEffect } from 'react'
+import { Sun, Moon } from 'lucide-react'
+
+export function ThemeToggle() {
+  const [mounted, setMounted] = useState(false)
+  const { resolvedTheme, setTheme } = useTheme()
+
+  useEffect(() => { setMounted(true) }, [])
+
+  if (!mounted) {
+    return <div className="h-8 w-8" />
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => setTheme(resolvedTheme === 'dark' ? 'light' : 'dark')}
+      className="rounded-md p-1.5 text-zinc-400 transition-colors hover:bg-zinc-100 hover:text-zinc-600 dark:hover:bg-zinc-800 dark:hover:text-zinc-200 cursor-pointer"
+      aria-label={resolvedTheme === 'dark' ? 'Switch to light mode' : 'Switch to dark mode'}
+    >
+      {resolvedTheme === 'dark' ? <Sun className="h-5 w-5" /> : <Moon className="h-5 w-5" />}
+    </button>
+  )
+}
+`),await h(r(i,`app/nav-header.tsx`),`'use client'
+
+import Link from 'next/link'
+import { usePathname } from 'next/navigation'
+import { ThemeToggle } from './theme-toggle'
+
+const links = [
+  { href: '/', label: 'Home' },
+  { href: '/auth/sign-in', label: 'Sign In' },
+  { href: '/setup', label: 'Setup' },
+]
+
+export function NavHeader() {
+  const pathname = usePathname()
+
+  function isActive(href: string) {
+    return href === '/' ? pathname === '/' : pathname.startsWith(href)
+  }
+
+  const linkClass = (href: string) =>
+    \`px-3 py-1.5 rounded-md text-sm transition-colors \${
+      isActive(href)
+        ? 'bg-zinc-200 text-zinc-900 dark:bg-zinc-800 dark:text-zinc-50'
+        : 'text-zinc-500 hover:text-zinc-700 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800/50'
+    }\`
+
+  return (
+    <header className="sticky top-0 z-50 backdrop-blur-md border-b bg-white/80 border-zinc-200 dark:bg-zinc-950/80 dark:border-zinc-800">
+      <nav className="max-w-6xl mx-auto flex items-center gap-1 px-4 h-12">
+        <span className="font-semibold text-sm text-zinc-700 dark:text-zinc-300 mr-3 select-none">
+          ${n} Admin
+        </span>
+        {links.map(({ href, label }) => (
+          <Link key={href} href={href} className={linkClass(href)}>
+            {label}
+          </Link>
+        ))}
+        <div className="ml-auto">
+          <ThemeToggle />
+        </div>
+      </nav>
+    </header>
+  )
+}
+`),await h(r(i,`app/layout.tsx`),`import './globals.css'
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return children
+}
+`),await h(r(i,`app/[locale]/layout.tsx`),`import type { Metadata } from 'next'
+import { Geist, Geist_Mono } from 'next/font/google'
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { notFound } from 'next/navigation'
+import { routing } from '@/i18n/routing'
+import { ThemeProvider } from '../theme-provider'
+import { NavHeader } from '../nav-header'
+
+const geistSans = Geist({
+  variable: '--font-geist-sans',
+  subsets: ['latin'],
+})
+
+const geistMono = Geist_Mono({
+  variable: '--font-geist-mono',
+  subsets: ['latin'],
+})
+
+export const metadata: Metadata = {
+  title: '${n} Admin',
+  description: 'Built with Lumi CMS Toolkit',
+}
+
+export default async function LocaleLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ locale: string }>
+}) {
+  const { locale } = await params
+  if (!routing.locales.includes(locale as any)) notFound()
+
+  const messages = await getMessages()
+
+  return (
+    <html lang={locale} suppressHydrationWarning>
+      <body className={\`\${geistSans.variable} \${geistMono.variable} antialiased\`}>
+        <ThemeProvider>
+          <NextIntlClientProvider locale={locale} messages={messages}>
+            <NavHeader />
+            {children}
+          </NextIntlClientProvider>
+        </ThemeProvider>
+      </body>
+    </html>
+  )
+}
+`),await h(r(i,`app/[locale]/page.tsx`),`import { createQueryClient } from '@murumets-ee/core/clients'
+import { Article, Category } from '@${n}/config/entities'
+import { getToolkitApp } from '@${n}/config/app'
+
+export default async function HomePage() {
+  await getToolkitApp()
+  const articles = createQueryClient(Article)
+  const categories = createQueryClient(Category)
+
+  const [articleList, categoryList] = await Promise.all([
+    articles.findMany({ limit: 10 }),
+    categories.findMany({}),
+  ])
+
+  return (
+    <div className="min-h-screen p-8">
+      <div className="max-w-4xl mx-auto">
+        <h1 className="text-4xl font-bold mb-8">Welcome to ${n}</h1>
+
+        <section className="mb-12">
+          <h2 className="text-2xl font-semibold mb-4">
+            Categories ({categoryList.length})
+          </h2>
+          <div className="grid gap-4 md:grid-cols-2">
+            {categoryList.map((cat) => (
+              <div
+                key={cat.id}
+                className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-4"
+              >
+                <h3 className="font-semibold text-lg">{cat.name}</h3>
+                <p className="text-sm text-zinc-600 dark:text-zinc-400">
+                  {cat.description}
+                </p>
+              </div>
+            ))}
+          </div>
+        </section>
+
+        <section>
+          <h2 className="text-2xl font-semibold mb-4">
+            Articles ({articleList.length})
+          </h2>
+          {articleList.length === 0 ? (
+            <p className="text-zinc-500">No published articles yet.</p>
+          ) : (
+            <div className="space-y-4">
+              {articleList.map((article) => (
+                <div
+                  key={article.id}
+                  className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-6"
+                >
+                  <h3 className="text-xl font-bold">{article.title}</h3>
+                  <p className="text-zinc-600 dark:text-zinc-400 mt-2">
+                    {article.excerpt}
+                  </p>
+                </div>
+              ))}
+            </div>
+          )}
+        </section>
+      </div>
+    </div>
+  )
+}
+`),await h(r(i,`app/api/auth/[...all]/route.ts`),`import { toNextJsHandler } from 'better-auth/next-js'
+import { getAuthInstance } from '@${n}/config/auth'
+
+let _handler: ReturnType<typeof toNextJsHandler> | null = null
+
+async function handler() {
+  if (!_handler) {
+    const auth = await getAuthInstance()
+    _handler = toNextJsHandler(auth)
+  }
+  return _handler
+}
+
+export async function GET(req: Request) {
+  return (await handler()).GET(req)
+}
+
+export async function POST(req: Request) {
+  return (await handler()).POST(req)
+}
+`),await h(r(i,`app/[locale]/auth/layout.tsx`),`import { AuthProviders } from './providers'
+import type { ReactNode } from 'react'
+
+export default function AuthLayout({ children }: { children: ReactNode }) {
+  return (
+    <AuthProviders>
+      <div className="flex min-h-[calc(100vh-3rem)] items-center justify-center px-4">
+        {children}
+      </div>
+    </AuthProviders>
+  )
+}
+`),await h(r(i,`app/[locale]/auth/providers.tsx`),`'use client'
+
+import { AuthUIProvider } from '@murumets-ee/auth-ui'
+import { authClient } from '@${n}/config/auth-client'
+import Link from 'next/link'
+import { useRouter } from 'next/navigation'
+import { useLocale } from 'next-intl'
+import type { ReactNode } from 'react'
+
+export function AuthProviders({ children }: { children: ReactNode }) {
+  const router = useRouter()
+  const locale = useLocale()
+
+  return (
+    <AuthUIProvider
+      authClient={authClient as never}
+      basePath="/auth"
+      redirectTo="/"
+      Link={Link}
+      navigate={(url) => router.push(url)}
+      resetPasswordUrl={\`/\${locale}/auth/reset-password\`}
+    >
+      {children}
+    </AuthUIProvider>
+  )
+}
+`),await h(r(i,`app/[locale]/auth/sign-in/page.tsx`),`import { SignInForm } from '@murumets-ee/auth-ui'
+
+export default function SignInPage() {
+  return <SignInForm />
+}
+`),await h(r(i,`app/[locale]/auth/sign-up/page.tsx`),`import { SignUpForm } from '@murumets-ee/auth-ui'
+
+export default function SignUpPage() {
+  return <SignUpForm />
+}
+`),await h(r(i,`app/[locale]/auth/forgot-password/page.tsx`),`import { ForgotPasswordForm } from '@murumets-ee/auth-ui'
+
+export default function ForgotPasswordPage() {
+  return <ForgotPasswordForm />
+}
+`),await h(r(i,`app/[locale]/auth/reset-password/page.tsx`),`import { Suspense } from 'react'
+import { ResetPasswordContent } from './content'
+
+export default function ResetPasswordPage() {
+  return (
+    <Suspense>
+      <ResetPasswordContent />
+    </Suspense>
+  )
+}
+`),await h(r(i,`app/[locale]/auth/reset-password/content.tsx`),`'use client'
+
+import { useSearchParams } from 'next/navigation'
+import { ResetPasswordForm } from '@murumets-ee/auth-ui'
+
+export function ResetPasswordContent() {
+  const searchParams = useSearchParams()
+  const token = searchParams.get('token')
+
+  if (!token) {
+    return (
+      <div className="text-center">
+        <h1 className="text-2xl font-bold text-zinc-900 dark:text-zinc-50">
+          Invalid or expired link
+        </h1>
+        <p className="mt-2 text-zinc-500">
+          Please request a new password reset.
+        </p>
+      </div>
+    )
+  }
+
+  return <ResetPasswordForm token={token} />
+}
+`),await h(r(i,`app/[locale]/setup/page.tsx`),`import { redirect } from 'next/navigation'
+import { sql } from 'drizzle-orm'
+import { getToolkitApp } from '@${n}/config/app'
+import { SetupForm } from './form'
+
+export default async function SetupPage() {
+  const app = await getToolkitApp()
+  const result = await app.db.readOnly.execute<{ count: string }>(
+    sql\`SELECT COUNT(*)::text as count FROM "user"\`,
+  )
+
+  if (Number(result[0]?.count) > 0) {
+    redirect('/')
+  }
+
+  return (
+    <div className="max-w-md mx-auto p-8">
+      <h1 className="text-2xl font-bold mb-2">Create Admin</h1>
+      <p className="text-sm text-zinc-500 dark:text-zinc-400 mb-6">
+        No users found. Create the first admin account.
+      </p>
+      <SetupForm />
+    </div>
+  )
+}
+`),await h(r(i,`app/[locale]/setup/form.tsx`),`'use client'
+
+import { useState } from 'react'
+import { createFirstAdmin } from './actions'
+
+export function SetupForm() {
+  const [result, setResult] = useState<{ ok?: boolean; error?: string; email?: string } | null>(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e: React.FormEvent<HTMLFormElement>) {
+    e.preventDefault()
+    setLoading(true)
+    setResult(null)
+    const res = await createFirstAdmin(new FormData(e.currentTarget))
+    setResult(res)
+    setLoading(false)
+  }
+
+  if (result?.ok) {
+    return (
+      <div className="space-y-2">
+        <p className="text-green-600 dark:text-green-400">Admin created: {result.email}</p>
+        <a href="/auth/sign-in" className="text-blue-600 dark:text-blue-400 hover:underline">
+          Sign in &rarr;
+        </a>
+      </div>
+    )
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="flex flex-col gap-4">
+      <label className="text-sm font-medium">
+        Name
+        <input
+          name="name"
+          required
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+      <label className="text-sm font-medium">
+        Email
+        <input
+          name="email"
+          type="email"
+          required
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+      <label className="text-sm font-medium">
+        Password (min 8 chars)
+        <input
+          name="password"
+          type="password"
+          required
+          minLength={8}
+          className="mt-1 block w-full px-3 py-2 bg-zinc-100 dark:bg-zinc-900 border border-zinc-300 dark:border-zinc-700 rounded-md text-sm focus:outline-none focus:ring-1 focus:ring-blue-500"
+        />
+      </label>
+
+      {result?.error && <p className="text-red-600 dark:text-red-400 text-sm">{result.error}</p>}
+
+      <button
+        type="submit"
+        disabled={loading}
+        className="px-4 py-2 text-sm rounded-md bg-blue-600 text-white hover:bg-blue-500 disabled:opacity-50 transition-colors"
+      >
+        {loading ? 'Creating...' : 'Create Admin'}
+      </button>
+    </form>
+  )
+}
+`),await h(r(i,`app/[locale]/setup/actions.ts`),`'use server'
+
+import { sql } from 'drizzle-orm'
+import { getToolkitApp } from '@${n}/config/app'
+import { getAuth } from '@murumets-ee/auth'
+
+export async function createFirstAdmin(formData: FormData) {
+  const email = formData.get('email') as string
+  const password = formData.get('password') as string
+  const name = formData.get('name') as string
+
+  if (!email || !password || !name) {
+    return { error: 'All fields are required' }
+  }
+
+  if (password.length < 8) {
+    return { error: 'Password must be at least 8 characters' }
+  }
+
+  const app = await getToolkitApp()
+
+  const canCreate = await app.db.readWrite.transaction(async (tx) => {
+    await tx.execute(sql\`SELECT pg_advisory_xact_lock(1)\`)
+
+    const result = await tx.execute<{ count: string }>(
+      sql\`SELECT COUNT(*)::text as count FROM "user"\`,
+    )
+    return Number(result[0]?.count) === 0
+  })
+
+  if (!canCreate) {
+    return { error: 'Admin user already exists. Setup is complete.' }
+  }
+
+  const auth = getAuth()
+
+  const adminUser = await auth.api.signUpEmail({
+    body: { email, password, name },
+  })
+
+  await app.db.readWrite.execute(
+    sql\`UPDATE "user" SET role = 'admin' WHERE id = \${adminUser.user.id}\`,
+  )
+
+  return { ok: true, email: adminUser.user.email }
+}
+`)}async function A(e,t){let{name:n}=t,i=r(e,`apps/web`);v(`pnpm create next-app@16 ${i} --typescript --tailwind --no-eslint --app --no-src-dir --turbopack --react-compiler --skip-install --import-alias "@/*"`),await _(i,[`app/page.tsx`,`app/page.module.css`,`app/fonts`,`README.md`,`pnpm-workspace.yaml`]),await g(r(i,`package.json`),{dependencies:{[`@${n}/config`]:`workspace:*`,"@murumets-ee/core":`^${T.myorgCore}`,"@murumets-ee/auth-ui":`^${T.myorgAuthUi}`,"next-intl":`^${T.nextIntl}`,"next-themes":`^${T.nextThemes}`,"lucide-react":`^${T.lucideReact}`},devDependencies:{"babel-plugin-react-compiler":T.babelReactCompiler}});let{appendToFile:a}=await Promise.resolve().then(()=>m);await a(r(i,`.gitignore`),`
+# Environment
+.env*
+!.env.example
+`),await h(r(i,`next.config.ts`),`import type { NextConfig } from 'next'
+import createNextIntlPlugin from 'next-intl/plugin'
+
+const withNextIntl = createNextIntlPlugin('./i18n/request.ts')
+
+const nextConfig: NextConfig = {
+  reactCompiler: true,
+  transpilePackages: [
+    '@${n}/config',
+    '@murumets-ee/core',
+    '@murumets-ee/entity',
+    '@murumets-ee/db',
+    '@murumets-ee/logging',
+    '@murumets-ee/auth-ui',
+  ],
+  serverExternalPackages: ['drizzle-orm', 'postgres'],
+}
+
+export default withNextIntl(nextConfig)
+`),await h(r(i,`proxy.ts`),`import createMiddleware from 'next-intl/middleware'
+import { routing } from './i18n/routing'
+
+export default createMiddleware(routing)
+
+export const config = {
+  matcher: '/((?!api|_next|_vercel|.*\\\\..*).*)',
+}
+`),await h(r(i,`i18n/routing.ts`),`import { defineRouting } from 'next-intl/routing'
+
+export const routing = defineRouting({
+  locales: ['en'],
+  defaultLocale: 'en',
+})
+`),await h(r(i,`i18n/request.ts`),`import { getRequestConfig } from 'next-intl/server'
+import { hasLocale } from 'next-intl'
+import { routing } from './routing'
+import { getAuthMessages } from '@murumets-ee/auth-ui/i18n'
+
+export default getRequestConfig(async ({ requestLocale }) => {
+  const requested = await requestLocale
+  const locale = hasLocale(routing.locales, requested)
+    ? requested
+    : routing.defaultLocale
+
+  const authMessages = await getAuthMessages(locale)
+
+  return {
+    locale,
+    messages: {
+      ...authMessages,
+    },
+  }
+})
+`),await h(r(i,`app/globals.css`),`@import "tailwindcss";
+@source "../node_modules/@murumets-ee/auth-ui/dist";
+
+@custom-variant dark (&:where(.dark, .dark *));
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+.dark {
+  --background: #0a0a0a;
+  --foreground: #ededed;
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: Arial, Helvetica, sans-serif;
+}
+`),await h(r(i,`app/theme-provider.tsx`),`'use client'
+
+import { ThemeProvider as NextThemesProvider } from 'next-themes'
+import type { ReactNode } from 'react'
+
+export function ThemeProvider({ children }: { children: ReactNode }) {
+  return (
+    <NextThemesProvider
+      attribute="class"
+      defaultTheme="system"
+      enableSystem
+      disableTransitionOnChange
+    >
+      {children}
+    </NextThemesProvider>
+  )
+}
+`),await h(r(i,`app/theme-toggle.tsx`),`'use client'
+
+import { useTheme } from 'next-themes'
+import { useState, useEffect } from 'react'
+import { Sun, Moon } from 'lucide-react'
+
+export function ThemeToggle() {
+  const [mounted, setMounted] = useState(false)
+  const { resolvedTheme, setTheme } = useTheme()
+
+  useEffect(() => { setMounted(true) }, [])
+
+  if (!mounted) {
+    return <div className="h-8 w-8" />
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => setTheme(resolvedTheme === 'dark' ? 'light' : 'dark')}
+      className="rounded-md p-1.5 text-zinc-400 transition-colors hover:bg-zinc-100 hover:text-zinc-600 dark:hover:bg-zinc-800 dark:hover:text-zinc-200 cursor-pointer"
+      aria-label={resolvedTheme === 'dark' ? 'Switch to light mode' : 'Switch to dark mode'}
+    >
+      {resolvedTheme === 'dark' ? <Sun className="h-5 w-5" /> : <Moon className="h-5 w-5" />}
+    </button>
+  )
+}
+`),await h(r(i,`app/nav-header.tsx`),`'use client'
+
+import Link from 'next/link'
+import { usePathname } from 'next/navigation'
+import { ThemeToggle } from './theme-toggle'
+
+const links = [
+  { href: '/', label: 'Home' },
+]
+
+export function NavHeader() {
+  const pathname = usePathname()
+
+  function isActive(href: string) {
+    return href === '/' ? pathname === '/' : pathname.startsWith(href)
+  }
+
+  const linkClass = (href: string) =>
+    \`px-3 py-1.5 rounded-md text-sm transition-colors \${
+      isActive(href)
+        ? 'bg-zinc-200 text-zinc-900 dark:bg-zinc-800 dark:text-zinc-50'
+        : 'text-zinc-500 hover:text-zinc-700 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800/50'
+    }\`
+
+  return (
+    <header className="sticky top-0 z-50 backdrop-blur-md border-b bg-white/80 border-zinc-200 dark:bg-zinc-950/80 dark:border-zinc-800">
+      <nav className="max-w-6xl mx-auto flex items-center gap-1 px-4 h-12">
+        <span className="font-semibold text-sm text-zinc-700 dark:text-zinc-300 mr-3 select-none">
+          ${n}
+        </span>
+        {links.map(({ href, label }) => (
+          <Link key={href} href={href} className={linkClass(href)}>
+            {label}
+          </Link>
+        ))}
+        <div className="ml-auto">
+          <ThemeToggle />
+        </div>
+      </nav>
+    </header>
+  )
+}
+`),await h(r(i,`app/layout.tsx`),`import './globals.css'
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return children
+}
+`),await h(r(i,`app/[locale]/layout.tsx`),`import type { Metadata } from 'next'
+import { Geist, Geist_Mono } from 'next/font/google'
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { notFound } from 'next/navigation'
+import { routing } from '@/i18n/routing'
+import { ThemeProvider } from '../theme-provider'
+import { NavHeader } from '../nav-header'
+
+const geistSans = Geist({
+  variable: '--font-geist-sans',
+  subsets: ['latin'],
+})
+
+const geistMono = Geist_Mono({
+  variable: '--font-geist-mono',
+  subsets: ['latin'],
+})
+
+export const metadata: Metadata = {
+  title: '${n}',
+  description: 'Built with Lumi CMS Toolkit',
+}
+
+export default async function LocaleLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ locale: string }>
+}) {
+  const { locale } = await params
+  if (!routing.locales.includes(locale as any)) notFound()
+
+  const messages = await getMessages()
+
+  return (
+    <html lang={locale} suppressHydrationWarning>
+      <body className={\`\${geistSans.variable} \${geistMono.variable} antialiased\`}>
+        <ThemeProvider>
+          <NextIntlClientProvider locale={locale} messages={messages}>
+            <NavHeader />
+            {children}
+          </NextIntlClientProvider>
+        </ThemeProvider>
+      </body>
+    </html>
+  )
+}
+`),await h(r(i,`app/[locale]/page.tsx`),`import { createQueryClient } from '@murumets-ee/core/clients'
+import { Article, Category } from '@${n}/config/entities'
+import { getToolkitApp } from '@${n}/config/app'
+
+export default async function HomePage() {
+  await getToolkitApp()
+  const articles = createQueryClient(Article)
+  const categories = createQueryClient(Category)
+
+  const [articleList, categoryList] = await Promise.all([
+    articles.findMany({ limit: 10 }),
+    categories.findMany({}),
+  ])
+
+  return (
+    <div className="min-h-screen p-8">
+      <div className="max-w-4xl mx-auto">
+        <h1 className="text-4xl font-bold mb-8">Welcome to ${n}</h1>
+
+        <section className="mb-12">
+          <h2 className="text-2xl font-semibold mb-4">
+            Categories ({categoryList.length})
+          </h2>
+          <div className="grid gap-4 md:grid-cols-2">
+            {categoryList.map((cat) => (
+              <div
+                key={cat.id}
+                className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-4"
+              >
+                <h3 className="font-semibold text-lg">{cat.name}</h3>
+                <p className="text-sm text-zinc-600 dark:text-zinc-400">
+                  {cat.description}
+                </p>
+              </div>
+            ))}
+          </div>
+        </section>
+
+        <section>
+          <h2 className="text-2xl font-semibold mb-4">
+            Articles ({articleList.length})
+          </h2>
+          {articleList.length === 0 ? (
+            <p className="text-zinc-500">No published articles yet.</p>
+          ) : (
+            <div className="space-y-4">
+              {articleList.map((article) => (
+                <div
+                  key={article.id}
+                  className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-6"
+                >
+                  <h3 className="text-xl font-bold">{article.title}</h3>
+                  <p className="text-zinc-600 dark:text-zinc-400 mt-2">
+                    {article.excerpt}
+                  </p>
+                </div>
+              ))}
+            </div>
+          )}
+        </section>
+      </div>
+    </div>
+  )
+}
+`)}async function j(e,t){let{name:n}=t;await h(r(e,`next.config.ts`),`import type { NextConfig } from 'next'
+import createNextIntlPlugin from 'next-intl/plugin'
+
+const withNextIntl = createNextIntlPlugin('./i18n/request.ts')
+
+const nextConfig: NextConfig = {
+  output: 'standalone',
+  reactCompiler: true,
+  transpilePackages: [
+    '@murumets-ee/core', '@murumets-ee/entity', '@murumets-ee/db',
+    '@murumets-ee/logging', '@murumets-ee/auth', '@murumets-ee/auth-ui',
+    '@murumets-ee/admin-ui', '@murumets-ee/content', '@murumets-ee/settings',
+    '@murumets-ee/storage', '@murumets-ee/media', '@murumets-ee/taxonomy',
+    '@murumets-ee/queue', '@murumets-ee/mail', '@murumets-ee/ticketing',
+    '@murumets-ee/ticketing-ui', '@murumets-ee/tokens', '@murumets-ee/ui',
+  ],
+  serverExternalPackages: ['drizzle-orm', 'postgres', 'pino', 'file-type'],
+  experimental: {
+    serverActions: {
+      bodySizeLimit: '2mb',
+    },
+  },
+}
+
+export default withNextIntl(nextConfig)
+`),await h(r(e,`proxy.ts`),`import { NextRequest, NextResponse } from 'next/server'
+import { getSessionCookie } from 'better-auth/cookies'
+import createMiddleware from 'next-intl/middleware'
+import { routing } from './i18n/routing'
+
+const intlMiddleware = createMiddleware(routing)
+
+const protectedPaths = ['/setup']
+
+export function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  // Strip locale prefix to check actual path
+  const localePattern = new RegExp(\`^/(\${routing.locales.join('|')})\`)
+  const pathWithoutLocale = pathname.replace(localePattern, '') || '/'
+
+  // Auth check for protected paths
+  if (protectedPaths.some((p) => pathWithoutLocale.startsWith(p))) {
+    const session = getSessionCookie(request)
+    if (!session) {
+      const locale = pathname.match(localePattern)?.[1] || routing.defaultLocale
+      return NextResponse.redirect(new URL(\`/\${locale}/auth/sign-in\`, request.url))
+    }
+  }
+
+  // Locale routing
+  return intlMiddleware(request)
+}
+
+export const config = {
+  matcher: '/((?!api|_next|_vercel|.*\\\\..*).*)',
+}
+`),await h(r(e,`app/layout.tsx`),`import './globals.css'
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return children
+}
+`),await h(r(e,`app/[locale]/layout.tsx`),`import type { Metadata } from 'next'
+import { Geist, Geist_Mono } from 'next/font/google'
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { notFound } from 'next/navigation'
+import { routing } from '@/i18n/routing'
+import { ThemeProvider } from '../theme-provider'
+import { NavHeader } from '../nav-header'
+
+const geistSans = Geist({
+  variable: '--font-geist-sans',
+  subsets: ['latin'],
+})
+
+const geistMono = Geist_Mono({
+  variable: '--font-geist-mono',
+  subsets: ['latin'],
+})
+
+export const metadata: Metadata = {
+  title: '${n}',
+  description: 'Built with Lumi CMS Toolkit',
+}
+
+export default async function LocaleLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ locale: string }>
+}) {
+  const { locale } = await params
+  if (!routing.locales.includes(locale as any)) notFound()
+
+  const messages = await getMessages()
+
+  return (
+    <html lang={locale} suppressHydrationWarning>
+      <body className={\`\${geistSans.variable} \${geistMono.variable} antialiased\`}>
+        <ThemeProvider>
+          <NextIntlClientProvider locale={locale} messages={messages}>
+            <NavHeader />
+            {children}
+          </NextIntlClientProvider>
+        </ThemeProvider>
+      </body>
+    </html>
+  )
+}
+`),await h(r(e,`app/[locale]/page.tsx`),`import { createQueryClient } from '@murumets-ee/core/clients'
+import { Article, Category } from '@/entities'
+import { getToolkitApp } from '@/lib/app'
+
+export default async function HomePage() {
+  await getToolkitApp()
+  const articles = createQueryClient(Article)
+  const categories = createQueryClient(Category)
+
+  const [articleList, categoryList] = await Promise.all([
+    articles.findMany({ limit: 10 }),
+    categories.findMany({}),
+  ])
+
+  return (
+    <div className="min-h-screen p-8">
+      <div className="max-w-4xl mx-auto">
+        <h1 className="text-4xl font-bold mb-8">Welcome to ${n}</h1>
+
+        <section className="mb-12">
+          <h2 className="text-2xl font-semibold mb-4">
+            Categories ({categoryList.length})
+          </h2>
+          <div className="grid gap-4 md:grid-cols-2">
+            {categoryList.map((cat) => (
+              <div
+                key={cat.id}
+                className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-4"
+              >
+                <h3 className="font-semibold text-lg">{cat.name}</h3>
+                <p className="text-sm text-zinc-600 dark:text-zinc-400">
+                  {cat.description}
+                </p>
+              </div>
+            ))}
+          </div>
+        </section>
+
+        <section>
+          <h2 className="text-2xl font-semibold mb-4">
+            Articles ({articleList.length})
+          </h2>
+          {articleList.length === 0 ? (
+            <p className="text-zinc-500">No published articles yet.</p>
+          ) : (
+            <div className="space-y-4">
+              {articleList.map((article) => (
+                <div
+                  key={article.id}
+                  className="border border-zinc-200 dark:border-zinc-800 rounded-lg p-6"
+                >
+                  <h3 className="text-xl font-bold">{article.title}</h3>
+                  <p className="text-zinc-600 dark:text-zinc-400 mt-2">
+                    {article.excerpt}
+                  </p>
+                </div>
+              ))}
+            </div>
+          )}
+        </section>
+      </div>
+    </div>
+  )
+}
+`)}async function M(e,t){await h(r(e,`scripts/generate-schema.ts`),`import { execSync } from 'node:child_process'
+execSync('npx @murumets-ee/cli generate', { stdio: 'inherit', cwd: import.meta.dirname + '/..' })
+`),await h(r(e,`scripts/migrate.ts`),`import { execSync } from 'node:child_process'
+execSync('npx @murumets-ee/cli migrate', { stdio: 'inherit', cwd: import.meta.dirname + '/..' })
+`),await h(r(e,`scripts/reset-db.ts`),`import { execSync } from 'node:child_process'
+execSync('npx @murumets-ee/cli reset --force', { stdio: 'inherit', cwd: import.meta.dirname + '/..' })
+`),await h(r(e,`scripts/worker.ts`),`/**
+ * Standalone queue worker process.
+ *
+ * Run separately from the Next.js web server:
+ *   pnpm worker          (or: tsx --env-file=.env scripts/worker.ts)
+ *
+ * The web server should set QUEUE_WORKER=false so it only enqueues jobs.
+ * This process handles job execution.
+ */
+
+import { createApp, setApp } from '@murumets-ee/core'
+import config from '../toolkit.config'
+
+process.env.QUEUE_WORKER = 'true'
+
+const app = await createApp(config)
+setApp(app)
+
+app.logger.info('Queue worker process running. Press Ctrl+C to stop.')
+
+const shutdown = async () => {
+  app.logger.info('Shutting down queue worker...')
+
+  const worker = (globalThis as Record<symbol, unknown>)[
+    Symbol.for('@murumets-ee/queue:worker')
+  ] as { stop: () => Promise<void> } | undefined
+
+  if (worker) {
+    await worker.stop()
+  }
+
+  process.exit(0)
+}
+
+process.on('SIGINT', shutdown)
+process.on('SIGTERM', shutdown)
+`)}async function N(e,t){let{name:n}=t;await h(r(e,`app/globals.css`),`@import "tailwindcss";
+@source "../node_modules/@murumets-ee/auth-ui/dist";
+
+@custom-variant dark (&:where(.dark, .dark *));
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+.dark {
+  --background: #0a0a0a;
+  --foreground: #ededed;
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: Arial, Helvetica, sans-serif;
+}
+`),await h(r(e,`app/theme-provider.tsx`),`'use client'
+
+import { ThemeProvider as NextThemesProvider } from 'next-themes'
+import type { ReactNode } from 'react'
+
+export function ThemeProvider({ children }: { children: ReactNode }) {
+  return (
+    <NextThemesProvider
+      attribute="class"
+      defaultTheme="system"
+      enableSystem
+      disableTransitionOnChange
+    >
+      {children}
+    </NextThemesProvider>
+  )
+}
+`),await h(r(e,`app/theme-toggle.tsx`),`'use client'
+
+import { useTheme } from 'next-themes'
+import { useState, useEffect } from 'react'
+import { Sun, Moon } from 'lucide-react'
+
+export function ThemeToggle() {
+  const [mounted, setMounted] = useState(false)
+  const { resolvedTheme, setTheme } = useTheme()
+
+  useEffect(() => { setMounted(true) }, [])
+
+  if (!mounted) {
+    return <div className="h-8 w-8" />
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => setTheme(resolvedTheme === 'dark' ? 'light' : 'dark')}
+      className="rounded-md p-1.5 text-zinc-400 transition-colors hover:bg-zinc-100 hover:text-zinc-600 dark:hover:bg-zinc-800 dark:hover:text-zinc-200 cursor-pointer"
+      aria-label={resolvedTheme === 'dark' ? 'Switch to light mode' : 'Switch to dark mode'}
+    >
+      {resolvedTheme === 'dark' ? <Sun className="h-5 w-5" /> : <Moon className="h-5 w-5" />}
+    </button>
+  )
+}
+`),await h(r(e,`app/nav-header.tsx`),`'use client'
+
+import Link from 'next/link'
+import { usePathname } from 'next/navigation'
+import { ThemeToggle } from './theme-toggle'
+
+const links = [
+  { href: '/', label: 'Home' },
+  { href: '/auth/sign-in', label: 'Sign In' },
+  { href: '/setup', label: 'Setup' },
+]
+
+export function NavHeader() {
+  const pathname = usePathname()
+
+  function isActive(href: string) {
+    return href === '/' ? pathname === '/' : pathname.startsWith(href)
+  }
+
+  const linkClass = (href: string) =>
+    \`px-3 py-1.5 rounded-md text-sm transition-colors \${
+      isActive(href)
+        ? 'bg-zinc-200 text-zinc-900 dark:bg-zinc-800 dark:text-zinc-50'
+        : 'text-zinc-500 hover:text-zinc-700 hover:bg-zinc-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800/50'
+    }\`
+
+  return (
+    <header className="sticky top-0 z-50 backdrop-blur-md border-b bg-white/80 border-zinc-200 dark:bg-zinc-950/80 dark:border-zinc-800">
+      <nav className="max-w-6xl mx-auto flex items-center gap-1 px-4 h-12">
+        <span className="font-semibold text-sm text-zinc-700 dark:text-zinc-300 mr-3 select-none">
+          ${n}
+        </span>
+        {links.map(({ href, label }) => (
+          <Link key={href} href={href} className={linkClass(href)}>
+            {label}
+          </Link>
+        ))}
+        <div className="ml-auto">
+          <ThemeToggle />
+        </div>
+      </nav>
+    </header>
+  )
+}
+`)}async function P(e,t){let{name:n}=t;await h(r(e,`toolkit.config.ts`),`import { auth } from '@murumets-ee/auth/plugin'
+import { content } from '@murumets-ee/content/plugin'
+import { defineConfig } from '@murumets-ee/core'
+import { logging } from '@murumets-ee/logging/plugin'
+import { mail, ResendMailProvider } from '@murumets-ee/mail'
+import { media } from '@murumets-ee/media/plugin'
+import { queue } from '@murumets-ee/queue/plugin'
+import { settings } from '@murumets-ee/settings/plugin'
+import { storage } from '@murumets-ee/storage/plugin'
+import { taxonomy } from '@murumets-ee/taxonomy/plugin'
+import { ticketing } from '@murumets-ee/ticketing/plugin'
+import { Article, Category } from './entities'
+import * as authSchema from './generated/auth-schema'
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required')
+}
+
+export default defineConfig({
+  db: {
+    url: process.env.DATABASE_URL,
+    poolMin: 2,
+    poolMax: 10,
+  },
+  logging: {
+    level: (process.env.LOG_LEVEL || 'info') as 'debug' | 'info' | 'warn' | 'error',
+    name: '${n}',
+  },
+  entities: [Category, Article],
+  plugins: [
+    auth({ providers: ['email'], schema: authSchema }),
+    content({
+      locales: [{ code: 'en', label: 'English' }],
+      defaultLocale: 'en',
+    }),
+    logging(),
+    settings(),
+    storage(),
+    media(),
+    taxonomy(),
+    queue(),
+    mail({
+      provider: process.env.RESEND_API_KEY
+        ? new ResendMailProvider({ apiKey: process.env.RESEND_API_KEY })
+        : undefined,
+      defaultFrom: process.env.MAIL_FROM ?? 'noreply@example.com',
+      webhookSecret: process.env.RESEND_WEBHOOK_SECRET,
+    }),
+    ticketing({
+      csatSecret: process.env.CSAT_SECRET,
+    }),
+  ],
+  projectRoot: import.meta.dirname,
+})
+`),await h(r(e,`lib/app.ts`),`import { createApp, setApp, type ToolkitApp } from '@murumets-ee/core'
+import config from '../toolkit.config'
+
+let appInstance: ToolkitApp | null = null
+
+export async function getToolkitApp(): Promise<ToolkitApp> {
+  if (!appInstance) {
+    appInstance = await createApp(config)
+    setApp(appInstance)
+  }
+  return appInstance
+}
+`),await h(r(e,`drizzle.config.ts`),`import type { Config } from 'drizzle-kit'
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required')
+}
+
+export default {
+  schema: ['./generated/schema.ts', './generated/auth-schema.ts'],
+  out: './migrations',
+  dialect: 'postgresql',
+  dbCredentials: {
+    url: process.env.DATABASE_URL,
+  },
+} satisfies Config
+`),await h(r(e,`auth.config.ts`),`import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { admin } from 'better-auth/plugins'
+import { organization } from 'better-auth/plugins/organization'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import postgres from 'postgres'
+
+const sql = postgres(process.env.DATABASE_URL!)
+const db = drizzle(sql)
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: 'pg' }),
+  emailAndPassword: { enabled: true },
+  plugins: [
+    admin(),
+    organization(),
+  ],
+})
+`),await h(r(e,`generated/auth-schema.ts`),`// This file is generated by better-auth CLI.
+// Run: npx @better-auth/cli generate --config auth.config.ts -y
+export {}
+`)}async function F(e,t){e.mode===`single`?await I(e,t):await L(e,t)}async function I(e,t){let n=r(process.cwd(),e.name);t?.(`Creating Next.js app...`),v(`pnpm create next-app@16 ${e.name} --typescript --tailwind --no-eslint --app --no-src-dir --turbopack --react-compiler --skip-install --import-alias "@/*"`),await _(n,[`app/page.tsx`,`app/page.module.css`,`app/fonts`,`README.md`]),await g(r(n,`package.json`),{type:`module`,dependencies:{"@murumets-ee/core":`^${T.myorgCore}`,"@murumets-ee/db":`^${T.myorgDb}`,"@murumets-ee/entity":`^${T.myorgEntity}`,"@murumets-ee/logging":`^${T.myorgLogging}`,"@murumets-ee/auth":`^${T.myorgAuth}`,"@murumets-ee/auth-ui":`^${T.myorgAuthUi}`,"@murumets-ee/admin-ui":`^${T.myorgAdminUi}`,"@murumets-ee/content":`^${T.myorgContent}`,"@murumets-ee/settings":`^${T.myorgSettings}`,"@murumets-ee/storage":`^${T.myorgStorage}`,"@murumets-ee/media":`^${T.myorgMedia}`,"@murumets-ee/taxonomy":`^${T.myorgTaxonomy}`,"@murumets-ee/queue":`^${T.myorgQueue}`,"@murumets-ee/mail":`^${T.myorgMail}`,"@murumets-ee/ticketing":`^${T.myorgTicketing}`,"@murumets-ee/ticketing-ui":`^${T.myorgTicketingUi}`,"@murumets-ee/tokens":`^${T.myorgTokens}`,"@murumets-ee/editor":`^${T.myorgEditor}`,"@murumets-ee/blocks":`^${T.myorgBlocks}`,"@murumets-ee/ui":`^${T.myorgUi}`,"better-auth":`^${T.betterAuth}`,"drizzle-orm":`^${T.drizzleOrm}`,"next-intl":`^${T.nextIntl}`,"next-themes":`^${T.nextThemes}`,"lucide-react":`^${T.lucideReact}`,postgres:`^${T.postgres}`,"@tanstack/react-query":`^${T.tanstackReactQuery}`,"@tanstack/react-table":`^${T.tanstackReactTable}`,"react-hook-form":`^${T.reactHookForm}`,"@hookform/resolvers":`^${T.hookformResolvers}`,zod:`^${T.zod}`},devDependencies:{"drizzle-kit":`^${T.drizzleKit}`,tsx:`^${T.tsx}`,"babel-plugin-react-compiler":T.babelReactCompiler},scripts:{"db:generate":`tsx --env-file=.env scripts/generate-schema.ts`,"db:migrate:generate":`drizzle-kit generate`,"db:migrate":`tsx --env-file=.env scripts/migrate.ts`,"db:reset":`tsx --env-file=.env scripts/reset-db.ts`,worker:`tsx --env-file=.env scripts/worker.ts`}}),t?.(`Adding toolkit files...`),await S(n,e),await C(n,e),await P(n,e),await x(n,e),await w(n,e),await j(n,e),await N(n,e),await b(n,e),await M(n,e),e.installDeps&&(t?.(`Installing dependencies...`),v(`pnpm install`,{cwd:n}))}async function L(e,t){let n=r(process.cwd(),e.name);t?.(`Creating workspace...`),await E(n,e,t),e.installDeps&&(t?.(`Installing dependencies...`),v(`pnpm install`,{cwd:n}))}async function R(){let n=process.argv[2],r=await p(n);if(!r)return;let i=e.spinner();try{i.start(`Creating Next.js app...`),await F(r,e=>{i.stop(`${t.green(`✓`)} Done`),i.start(e)}),i.stop(`${t.green(`✓`)} Done`);let n=[`cd ${r.name}`,`cp .env.example .env`,`docker compose up -d`,`npx @murumets-ee/cli setup`,`pnpm db:migrate`,`pnpm dev`,`# Visit /setup to create your first admin user`];e.note(n.join(`
+`),`Next steps`),e.outro(`${t.green(`Success!`)} Your project is ready.`)}catch(n){i.stop(t.red(`Failed.`)),e.log.error(n instanceof Error?n.message:String(n)),process.exit(1)}}R();export{};