@nakedev/go-scaffold 0.1.2 → 0.1.4

package/dist/commands/rbac.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addRbac = addRbac;
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const config_1 = require("../utils/config");
+const template_renderer_1 = require("../utils/template-renderer");
+const rbac_manifest_1 = require("../templates/rbac-manifest");
+const migrations_1 = require("../utils/migrations");
+const rbac_patcher_1 = require("../utils/rbac-patcher");
+const openapi_patcher_1 = require("../utils/openapi-patcher");
+// URL (relative to the api prefix) -> docs file (relative to docs/) for every
+// route `add rbac` registers or adds onto the user handler.
+const RBAC_OPENAPI_PATHS = [
+    { urlPath: "/roles", file: "./rbac/roles.yaml" },
+    { urlPath: "/roles/{code}/permissions", file: "./rbac/role-permissions.yaml" },
+    { urlPath: "/roles/{code}", file: "./rbac/role.yaml" },
+    { urlPath: "/permissions", file: "./rbac/permissions.yaml" },
+    { urlPath: "/users", file: "./rbac/users.yaml" },
+    { urlPath: "/users/{id}", file: "./rbac/user.yaml" },
+    { urlPath: "/users/{id}/set-role", file: "./rbac/user-set-role.yaml" },
+];
+// addRbac layers role-based access control on top of `add auth`: a role
+// domain (roles/permissions/role_permissions, admin-manageable), an Authz
+// middleware with a cached role->permission lookup, a Role claim threaded
+// through the JWT, and the admin endpoints that actually need it: listing/
+// viewing other users (GET /users, GET /users/:id) and changing a user's
+// role (PATCH /users/:id/set-role). Opt-in on top of an opt-in — most
+// projects need "is this caller logged in" long before they need "can this
+// caller do X".
+async function addRbac(projectDir = process.cwd()) {
+    const config = (0, config_1.readConfig)(projectDir);
+    if (!config.features.auth) {
+        throw new Error("`go-scaffold add rbac` requires `go-scaffold add auth` first — there's no Role claim to check permissions against otherwise");
+    }
+    const roleDir = path_1.default.join(projectDir, "internal", "app", "role");
+    if (fs_extra_1.default.existsSync(roleDir)) {
+        throw new Error(`${roleDir} already exists — RBAC looks like it's already been added`);
+    }
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, rbac_manifest_1.RBAC_FILES, { goModule: config.goModule });
+    const migrationsDir = path_1.default.join(projectDir, "migrations");
+    fs_extra_1.default.ensureDirSync(migrationsDir);
+    const version = (0, migrations_1.newMigrationVersion)(migrationsDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+        { template: "add/rbac/migrations/add_roles.up.sql.hbs", output: path_1.default.join("migrations", `${version}_add_roles.up.sql`) },
+        { template: "add/rbac/migrations/add_roles.down.sql.hbs", output: path_1.default.join("migrations", `${version}_add_roles.down.sql`) },
+    ], {});
+    (0, rbac_patcher_1.patchConfigForRbac)(path_1.default.join(projectDir, "internal", "shared", "config", "config.go"));
+    (0, rbac_patcher_1.patchUserModelForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "model", "user.go"));
+    (0, rbac_patcher_1.patchMiddlewareAuthForRbac)(path_1.default.join(projectDir, "internal", "shared", "middleware", "auth.go"));
+    (0, rbac_patcher_1.patchUserJWTForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "jwt.go"));
+    (0, rbac_patcher_1.patchUserServiceForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "service.go"));
+    (0, rbac_patcher_1.patchUserServiceTestForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "service_test.go"));
+    (0, rbac_patcher_1.patchUserDTOForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "dto.go"));
+    (0, rbac_patcher_1.patchUserHandlerForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "handler.go"), config.goModule);
+    (0, rbac_patcher_1.patchUserErrorsForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "errors.go"));
+    (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "main.go"), config.goModule);
+    (0, rbac_patcher_1.patchCmdSeedForRbac)(path_1.default.join(projectDir, "cmd", "seed", "main.go"), config.goModule);
+    patchEnvExample(path_1.default.join(projectDir, ".env.example"));
+    let docsMessage = "";
+    const openapiPath = path_1.default.join(projectDir, "docs", "openapi.yaml");
+    if (config.features.openapiDocs && fs_extra_1.default.existsSync(openapiPath)) {
+        const docsEntries = [
+            { template: "add/rbac/docs/schemas.yaml.hbs", output: path_1.default.join("docs", "rbac", "schemas.yaml") },
+            ...RBAC_OPENAPI_PATHS.map(({ file }) => ({
+                template: `add/rbac/docs/${path_1.default.basename(file)}.hbs`,
+                output: path_1.default.join("docs", "rbac", path_1.default.basename(file)),
+            })),
+        ];
+        await (0, template_renderer_1.applyTemplateEntries)(projectDir, docsEntries, {});
+        (0, openapi_patcher_1.patchOpenapiIndexRaw)(openapiPath, config.apiPrefix, RBAC_OPENAPI_PATHS);
+        (0, rbac_patcher_1.patchAuthDocsForRbac)(path_1.default.join(projectDir, "docs", "auth", "schemas.yaml"));
+        docsMessage = "\ndocs: docs/rbac/*.yaml, wired into docs/openapi.yaml";
+    }
+    (0, template_renderer_1.gofmtTree)(projectDir);
+    (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, rbac: true } });
+    console.log(picocolors_1.default.green("\nadded internal/app/role/ and internal/shared/middleware/authz.go"));
+    console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/main.go" + docsMessage);
+    console.log(picocolors_1.default.yellow("\n⚠ AUTO_MIGRATE=true does NOT seed the role/permission data — it only creates the\n" +
+        "  tables from the Go structs. The \"staff\"/\"admin\" roles and their permissions live\n" +
+        "  in the migration's SQL (INSERT statements), which AutoMigrate never runs. Without\n" +
+        "  applying it for real, `make seed` fails with \"unknown role code\" and nobody can be\n" +
+        "  granted anything. Apply it before relying on RBAC, even in dev:\n" +
+        "    migrate -path migrations -database \"$DB_DSN\" up   (or: make migrate-up)"));
+    console.log(picocolors_1.default.dim("\nnext: go mod tidy, then SEED_ADMIN_EMAIL=... SEED_ADMIN_PASSWORD=... make seed to get an admin"));
+}
+function patchEnvExample(envExamplePath) {
+    if (!fs_extra_1.default.existsSync(envExamplePath))
+        return;
+    let content = fs_extra_1.default.readFileSync(envExamplePath, "utf8");
+    if (content.includes("AUTHZ_CACHE_TTL_MIN"))
+        return; // already added
+    content =
+        content.replace(/\n?$/, "\n") +
+            "\n# how long a role's permission set is cached before Authz.Require re-checks the DB —\n" +
+            "# a permission change takes effect for already-issued tokens within this window\n" +
+            "AUTHZ_CACHE_TTL_MIN=1\n";
+    fs_extra_1.default.writeFileSync(envExamplePath, content);
+}

package/dist/commands/remove.js

@@ -9,18 +9,17 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const picocolors_1 = __importDefault(require("picocolors"));
 const prompts_1 = require("@inquirer/prompts");
 const config_1 = require("../utils/config");
-const naming_1 = require("../utils/naming");
+const module_location_1 = require("../utils/module-location");
 const main_patcher_1 = require("../utils/main-patcher");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
 const template_renderer_1 = require("../utils/template-renderer");
 const generate_wizard_1 = require("../prompts/generate-wizard");
-// removeModule is the inverse of generateModule: deletes the domain package and
-// pulls its wiring back out of main.go / openapi.yaml / migrations, so dropping
-// a domain is one command instead of hand-editing 3+ files (the error-prone
-// path that produced the duplicate-registration bug in the first place).
+// removeModule deletes application code and reverses generated wiring while
+// preserving immutable migration history and table data. Destructive schema
+// removal must be an explicit new migration, never a deletion of an applied one.
 async function removeModule(rawName, opts, projectDir = process.cwd()) {
     const config = (0, config_1.readConfig)(projectDir);
-    const naming = (0, naming_1.resolveModuleNaming)(rawName ?? (await (0, generate_wizard_1.promptModuleName)()));
+    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, rawName ?? (await (0, generate_wizard_1.promptModuleName)()));
     const modulePath = naming.pkg;
     const moduleDir = path_1.default.join(projectDir, "internal", "app", modulePath);
     if (!fs_extra_1.default.existsSync(moduleDir)) {
@@ -28,12 +27,24 @@ async function removeModule(rawName, opts, projectDir = process.cwd()) {
     }
     if (!opts.yes) {
         const ok = await (0, prompts_1.confirm)({
-            message: `Remove module "${naming.pkg}"? Deletes internal/app/${modulePath}/, its migration, and un-wires main.go/openapi.yaml`,
+            message: `Remove module "${naming.pkg}"? Deletes internal/app/${modulePath}/ and its docs, ` +
+                `then un-wires main.go/openapi.yaml. Existing migrations, table, and data are preserved.`,
             default: false,
         });
         if (!ok)
             throw new Error("removal cancelled");
     }
+    // detect --auth/--permission from the generated handler.go itself (not
+    // stored anywhere else) — unpatchMainGo needs the exact same flags used at
+    // generate-time to reconstruct the identical line it's removing.
+    const handlerGoPath = path_1.default.join(moduleDir, "handler.go");
+    let auth;
+    let permission;
+    if (fs_extra_1.default.existsSync(handlerGoPath)) {
+        const handlerContent = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
+        auth = /jwtSecret\s+string/.test(handlerContent);
+        permission = handlerContent.match(/h\.authz\.Require\("([^"]+)"\)/)?.[1];
+    }
     // 1. the domain package
     fs_extra_1.default.removeSync(moduleDir);
     // 2. main.go wiring
@@ -42,6 +53,8 @@ async function removeModule(rawName, opts, projectDir = process.cwd()) {
         modulePath,
         pkg: naming.pkg,
         pascalName: naming.pascalName,
+        auth,
+        permission,
     });
     // 3. openapi index + per-module docs
     const openapiPath = path_1.default.join(projectDir, "docs", "openapi.yaml");
@@ -49,24 +62,27 @@ async function removeModule(rawName, opts, projectDir = process.cwd()) {
         (0, openapi_patcher_1.unpatchOpenapiIndex)(openapiPath, naming, config.apiPrefix);
         fs_extra_1.default.removeSync(path_1.default.join(projectDir, "docs", naming.plural));
     }
-    // 4. migration files (up + down)
+    // 4. Migration history is immutable. A migration may already be recorded in
+    // schema_migrations on production databases, so deleting its file would make
+    // existing and fresh environments disagree and can prevent the app booting.
+    // Re-generating the same module reuses this create migration.
     const migrationsDir = path_1.default.join(projectDir, "migrations");
-    const removedMigrations = [];
-    if (fs_extra_1.default.existsSync(migrationsDir)) {
-        for (const f of fs_extra_1.default.readdirSync(migrationsDir)) {
-            if (f.endsWith(`_create_${naming.plural}.up.sql`) || f.endsWith(`_create_${naming.plural}.down.sql`)) {
-                fs_extra_1.default.removeSync(path_1.default.join(migrationsDir, f));
-                removedMigrations.push(f);
-            }
-        }
-    }
+    const preservedMigrations = fs_extra_1.default.existsSync(migrationsDir)
+        ? fs_extra_1.default.readdirSync(migrationsDir).filter((f) => f.endsWith(`_create_${naming.plural}.up.sql`) ||
+            f.endsWith(`_create_${naming.plural}.down.sql`) ||
+            f.endsWith(`_add_${naming.plural}_permission.up.sql`) ||
+            f.endsWith(`_add_${naming.plural}_permission.down.sql`))
+        : [];
     (0, template_renderer_1.gofmtTree)(projectDir);
     console.log(picocolors_1.default.green(`\nremoved module "${naming.pkg}"`));
     console.log(`  deleted internal/app/${modulePath}/`);
     console.log(`  un-wired cmd/api/main.go`);
     if (fs_extra_1.default.existsSync(openapiPath))
         console.log(`  un-wired docs/openapi.yaml + deleted docs/${naming.plural}/`);
-    if (removedMigrations.length)
-        console.log(`  deleted ${removedMigrations.join(", ")}`);
-    console.log(picocolors_1.default.yellow(`\nnote: the ${naming.plural} table (if migrated) is untouched — drop it yourself, or add a down migration`));
+    if (preservedMigrations.length) {
+        console.log(`  preserved migration history: ${preservedMigrations.join(", ")}`);
+    }
+    console.log(picocolors_1.default.yellow(`\nnote: the ${naming.tableName} table and its data are untouched. ` +
+        `To remove them safely, run \`go-scaffold generate migration drop_${naming.tableName}\` ` +
+        `and write an explicit up/down migration.`));
 }

package/dist/commands/worker.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addWorker = addWorker;
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const config_1 = require("../utils/config");
+const template_renderer_1 = require("../utils/template-renderer");
+const worker_manifest_1 = require("../templates/worker-manifest");
+const platform_patcher_1 = require("../utils/platform-patcher");
+// addWorker scaffolds the async task processing subsystem: Redis
+// (platform/cache), Asynq client/server (platform/queue), SMTP mail
+// (platform/mail, with an email:send task type as the one thing the fresh
+// worker actually handles), and cmd/worker itself. Opt-in — most projects
+// don't need a queue on day one, and an empty worker with no task types
+// registered is a stranger scaffold than just not having one.
+async function addWorker(projectDir = process.cwd()) {
+    const config = (0, config_1.readConfig)(projectDir);
+    const queueDir = path_1.default.join(projectDir, "internal", "platform", "queue");
+    if (fs_extra_1.default.existsSync(queueDir)) {
+        throw new Error(`${queueDir} already exists — worker infrastructure looks like it's already been added`);
+    }
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, worker_manifest_1.WORKER_FILES, { goModule: config.goModule });
+    (0, platform_patcher_1.patchConfigForWorker)(path_1.default.join(projectDir, "internal", "shared", "config", "config.go"));
+    (0, platform_patcher_1.patchMainGoForWorker)(path_1.default.join(projectDir, "cmd", "api", "main.go"), config.goModule);
+    patchEnvExample(path_1.default.join(projectDir, ".env.example"));
+    patchMakefile(path_1.default.join(projectDir, "Makefile"));
+    (0, template_renderer_1.gofmtTree)(projectDir);
+    (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, worker: true } });
+    console.log(picocolors_1.default.green("\nadded internal/platform/{cache,queue,mail}/ and cmd/worker/"));
+    console.log("wired Redis into cmd/api (readyz check) — cmd/api does not enqueue anything yet");
+    console.log(picocolors_1.default.dim("\nnext: make worker (separate terminal, or `make dev` runs both), then go build ./... to confirm"));
+}
+function patchEnvExample(envExamplePath) {
+    if (!fs_extra_1.default.existsSync(envExamplePath))
+        return;
+    let content = fs_extra_1.default.readFileSync(envExamplePath, "utf8");
+    if (content.includes("REDIS_URL"))
+        return; // already added
+    content =
+        content.replace(/\n?$/, "\n") +
+            "\nREDIS_URL=redis://localhost:6379/0\n" +
+            "\n# leave SMTP_HOST unset to log emails instead of sending them (dev default)\n" +
+            "SMTP_HOST=\n" +
+            "SMTP_PORT=587\n" +
+            "SMTP_USERNAME=\n" +
+            "SMTP_PASSWORD=\n" +
+            "SMTP_FROM=no-reply@example.local\n";
+    fs_extra_1.default.writeFileSync(envExamplePath, content);
+}
+function patchMakefile(makefilePath) {
+    if (!fs_extra_1.default.existsSync(makefilePath))
+        return;
+    let content = fs_extra_1.default.readFileSync(makefilePath, "utf8");
+    if (content.includes("\nworker:\n"))
+        return; // already added
+    content = content.replace(/^\.PHONY: /m, ".PHONY: dev worker ");
+    const targets = "\n# run both API + worker in one terminal — Ctrl+C kills both\n" +
+        "dev:\n" +
+        "\t@[ -f .env ] && export $$(grep -v '^#' .env | xargs); \\\n" +
+        "\t(trap 'kill 0' SIGINT SIGTERM; \\\n" +
+        "\t go run ./cmd/api & \\\n" +
+        "\t go run ./cmd/worker & \\\n" +
+        "\t wait)\n" +
+        "\n" +
+        "# background worker for async task processing (email, ...) — requires Redis.\n" +
+        "# Use `make dev` to run both in one terminal, or run this in a separate one.\n" +
+        "worker:\n" +
+        "\t@[ -f .env ] && export $$(grep -v '^#' .env | xargs); go run ./cmd/worker\n";
+    content = content.replace(/\nbuild:/, `${targets}\nbuild:`);
+    fs_extra_1.default.writeFileSync(makefilePath, content);
+}

package/dist/index.js

@@ -10,12 +10,17 @@ const picocolors_1 = __importDefault(require("picocolors"));
 const create_1 = require("./commands/create");
 const generate_1 = require("./commands/generate");
 const method_1 = require("./commands/method");
+const migration_1 = require("./commands/migration");
 const remove_1 = require("./commands/remove");
+const version_1 = require("./utils/version");
+const worker_1 = require("./commands/worker");
+const auth_1 = require("./commands/auth");
+const rbac_1 = require("./commands/rbac");
 const program = new commander_1.Command();
 program
     .name("go-scaffold")
     .description("Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard")
-    .version("0.1.0");
+    .version((0, version_1.cliVersion)());
 program
     .command("create [name]")
     .alias("c")
@@ -23,6 +28,7 @@ program
     .option("--defaults", "skip the wizard, use defaults (for CI/scripting)")
     .option("--no-docker", "skip docker-compose.yml (only applies with --defaults)")
     .option("--no-openapi-docs", "skip docs/openapi.yaml (only applies with --defaults)")
+    .option("--observability", "add Prometheus /metrics + OpenTelemetry tracing (only applies with --defaults; off by default)")
     .option("--api-prefix <prefix>", 'URL prefix every route is grouped under (default "v1"; pass "" for none)')
     .action(async (name, opts) => {
     try {
@@ -30,6 +36,7 @@ program
             defaults: opts.defaults,
             docker: opts.docker,
             openapiDocs: opts.openapiDocs,
+            observability: opts.observability,
             apiPrefix: opts.apiPrefix,
         });
     }
@@ -49,16 +56,20 @@ const generate = program
         const target = await (0, prompts_1.select)({
             message: "What do you want to generate?",
             choices: [
-                { name: "Module (full CRUD domain)", value: "module" },
+                { name: "Module (safe minimal domain; add methods explicitly)", value: "module" },
                 { name: "Method (add one endpoint to an existing module)", value: "method" },
+                { name: "Migration (reserve a timestamped up/down SQL file pair)", value: "migration" },
             ],
         });
         if (target === "module") {
-            await (0, generate_1.generateModule)(undefined, { full: true });
+            await (0, generate_1.generateModule)(undefined, { full: false });
         }
-        else {
+        else if (target === "method") {
             await (0, method_1.generateMethod)(undefined, undefined, {});
         }
+        else {
+            await (0, migration_1.generateMigration)(undefined);
+        }
     }
     catch (err) {
         console.error(picocolors_1.default.red(err.message));
@@ -68,11 +79,14 @@ const generate = program
 generate
     .command("module [name]")
     .alias("m")
-    .description("scaffold a domain module — full CRUD by default, or a bare skeleton with --no-full")
-    .option("--no-full", "minimal skeleton (model/errors/repository, no default CRUD) — add endpoints one at a time with `generate method`")
+    .description("scaffold a safe minimal domain module; opt into a CRUD skeleton with --full")
+    .option("--full", "generate a CRUD skeleton (DTO fields/business rules remain TODO); minimal is the safe default")
+    .option("--no-full", "deprecated compatibility alias; minimal is already the default")
+    .option("--auth", "require a valid access token for this module's routes (needs `add auth`)")
+    .option("--permission <code>", "also require this permission via authz.Require (needs `add rbac`; implies --auth)")
     .action(async (name, opts) => {
     try {
-        await (0, generate_1.generateModule)(name, { full: opts.full });
+        await (0, generate_1.generateModule)(name, { full: opts.full, auth: opts.auth, permission: opts.permission });
     }
     catch (err) {
         console.error(picocolors_1.default.red(err.message));
@@ -107,6 +121,56 @@ generate
         process.exitCode = 1;
     }
 });
+generate
+    .command("migration [name]")
+    .alias("mig")
+    .description("reserve a timestamped migrations/<version>_<name>.{up,down}.sql pair (stubs only — you write the SQL)")
+    .action(async (name) => {
+    try {
+        await (0, migration_1.generateMigration)(name);
+    }
+    catch (err) {
+        console.error(picocolors_1.default.red(err.message));
+        process.exitCode = 1;
+    }
+});
+const add = program.command("add").description("add opt-in infrastructure to an existing go-scaffold project");
+add
+    .command("worker")
+    .description("add Redis, an Asynq task queue, SMTP mail, and cmd/worker (opt-in — most projects don't need this on day one)")
+    .action(async () => {
+    try {
+        await (0, worker_1.addWorker)();
+    }
+    catch (err) {
+        console.error(picocolors_1.default.red(err.message));
+        process.exitCode = 1;
+    }
+});
+add
+    .command("auth")
+    .description("add email/password auth: JWT access tokens, Redis-backed refresh token rotation, register/login/refresh/logout/me (requires `add worker` first)")
+    .action(async () => {
+    try {
+        await (0, auth_1.addAuth)();
+    }
+    catch (err) {
+        console.error(picocolors_1.default.red(err.message));
+        process.exitCode = 1;
+    }
+});
+add
+    .command("rbac")
+    .description("add role-based access control: roles/permissions admin API, cached Authz middleware, PATCH /users/:id/set-role (requires `add auth` first)")
+    .action(async () => {
+    try {
+        await (0, rbac_1.addRbac)();
+    }
+    catch (err) {
+        console.error(picocolors_1.default.red(err.message));
+        process.exitCode = 1;
+    }
+});
 const remove = program
     .command("remove")
     .alias("rm")

package/dist/prompts/create-wizard.js

@@ -25,6 +25,10 @@ async function runCreateWizard() {
         message: "Include hand-written OpenAPI docs (docs/openapi.yaml, whole docs/ tree served at /docs)?",
         default: true,
     });
+    const observability = await (0, prompts_1.confirm)({
+        message: "Add metrics + tracing (Prometheus /metrics, OpenTelemetry over OTLP/HTTP for Gin + GORM)?",
+        default: false,
+    });
     const apiPrefixRaw = await (0, prompts_1.input)({
         message: "API route prefix (e.g. v1, api/v1; leave blank for none):",
         default: "v1",
@@ -34,10 +38,11 @@ async function runCreateWizard() {
     console.log("\nSummary:");
     console.log(`  Docker + PostgreSQL: ${docker ? "yes" : "no"}`);
     console.log(`  OpenAPI docs: ${openapiDocs ? "yes" : "no"}`);
+    console.log(`  Metrics + tracing: ${observability ? "yes" : "no"}`);
     console.log(`  Route prefix: ${apiPrefix ? `/${apiPrefix}` : "(none)"}`);
     const proceed = await (0, prompts_1.confirm)({ message: "\nCreate project with these settings?", default: true });
     if (!proceed) {
         throw new Error("project creation cancelled");
     }
-    return { features: { docker, openapiDocs }, apiPrefix };
+    return { features: { docker, openapiDocs, observability }, apiPrefix };
 }

package/dist/prompts/generate-wizard.js

@@ -4,6 +4,7 @@ exports.promptModuleName = promptModuleName;
 exports.promptMethodName = promptMethodName;
 exports.promptMethodType = promptMethodType;
 exports.promptGetMode = promptGetMode;
+exports.promptMigrationName = promptMigrationName;
 exports.promptLookupField = promptLookupField;
 const prompts_1 = require("@inquirer/prompts");
 const naming_1 = require("../utils/naming");
@@ -53,6 +54,13 @@ async function promptGetMode() {
         ],
     });
 }
+async function promptMigrationName() {
+    const name = await (0, prompts_1.input)({
+        message: "Migration name (e.g. add_status_to_orders):",
+        validate: (value) => (value.trim() ? true : "migration name is required"),
+    });
+    return name.trim();
+}
 async function promptLookupField() {
     const field = await (0, prompts_1.input)({
         message: "Lookup field (e.g. email, status, slug):",

package/dist/templates/auth-manifest.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_FILES = void 0;
+// output paths are relative to the project root
+exports.AUTH_FILES = [
+    { template: "add/auth/internal/shared/middleware/auth.go.hbs", output: "internal/shared/middleware/auth.go" },
+    { template: "add/auth/internal/shared/middleware/ratelimit.go.hbs", output: "internal/shared/middleware/ratelimit.go" },
+    { template: "add/auth/internal/app/user/model/user.go.hbs", output: "internal/app/user/model/user.go" },
+    { template: "add/auth/internal/app/user/model/identity.go.hbs", output: "internal/app/user/model/identity.go" },
+    { template: "add/auth/internal/app/user/dto.go.hbs", output: "internal/app/user/dto.go" },
+    { template: "add/auth/internal/app/user/errors.go.hbs", output: "internal/app/user/errors.go" },
+    { template: "add/auth/internal/app/user/jwt.go.hbs", output: "internal/app/user/jwt.go" },
+    { template: "add/auth/internal/app/user/tokenstore.go.hbs", output: "internal/app/user/tokenstore.go" },
+    { template: "add/auth/internal/app/user/repository.go.hbs", output: "internal/app/user/repository.go" },
+    { template: "add/auth/internal/app/user/service.go.hbs", output: "internal/app/user/service.go" },
+    { template: "add/auth/internal/app/user/service_test.go.hbs", output: "internal/app/user/service_test.go" },
+    { template: "add/auth/internal/app/user/handler.go.hbs", output: "internal/app/user/handler.go" },
+    { template: "add/auth/cmd/seed/main.go.hbs", output: "cmd/seed/main.go" },
+];

package/dist/templates/create-manifest.js

@@ -45,6 +45,10 @@ exports.CREATE_MANIFEST = [
         template: "create/base/internal/shared/pagination/pagination.go.hbs",
         output: "internal/shared/pagination/pagination.go",
     },
+    {
+        template: "create/base/internal/shared/middleware/cors.go.hbs",
+        output: "internal/shared/middleware/cors.go",
+    },
     {
         template: "create/base/internal/shared/middleware/error.go.hbs",
         output: "internal/shared/middleware/error.go",
@@ -58,6 +62,7 @@ exports.CREATE_MANIFEST = [
         output: "internal/shared/middleware/requestid.go",
     },
     { template: "create/base/migrations/.gitkeep.hbs", output: "migrations/.gitkeep" },
+    { template: "create/base/migrations/embed.go.hbs", output: "migrations/embed.go" },
     // architecture standards docs — always included, this is the point of the CLI
     {
         template: "create/features/docs/architecture.md.hbs",
@@ -107,4 +112,24 @@ exports.CREATE_MANIFEST = [
         output: "docs/health/health-readyz.yaml",
         when: (ctx) => ctx.openapiDocs,
     },
+    {
+        template: "create/features/docs/observability/metrics.yaml.hbs",
+        output: "docs/observability/metrics.yaml",
+        when: (ctx) => ctx.openapiDocs && ctx.observability,
+    },
+    {
+        template: "create/features/observability/middleware/metrics.go.hbs",
+        output: "internal/shared/middleware/metrics.go",
+        when: (ctx) => ctx.observability,
+    },
+    {
+        template: "create/features/observability/middleware/tracing.go.hbs",
+        output: "internal/shared/middleware/tracing.go",
+        when: (ctx) => ctx.observability,
+    },
+    {
+        template: "create/features/observability/platform/telemetry/tracing.go.hbs",
+        output: "internal/platform/telemetry/tracing.go",
+        when: (ctx) => ctx.observability,
+    },
 ];

package/dist/templates/module-manifest.js

@@ -12,6 +12,7 @@ exports.MODULE_FILES = [
     { template: "generate/module/handler.go.hbs", output: "handler.go" },
     { template: "generate/module/service_test.go.hbs", output: "service_test.go" },
     { template: "generate/module/handler_test.go.hbs", output: "handler_test.go" },
+    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
 ];
 // minimal: same model/errors/repository (generate method's patches assume the
 // full data-access surface exists), but no default CRUD in dto/service/handler
@@ -25,4 +26,5 @@ exports.MODULE_FILES_MINIMAL = [
     { template: "generate/module/minimal/handler.go.hbs", output: "handler.go" },
     { template: "generate/module/minimal/service_test.go.hbs", output: "service_test.go" },
     { template: "generate/module/minimal/handler_test.go.hbs", output: "handler_test.go" },
+    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
 ];

package/dist/templates/rbac-manifest.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RBAC_FILES = void 0;
+// output paths are relative to the project root
+exports.RBAC_FILES = [
+    { template: "add/rbac/internal/shared/middleware/authz.go.hbs", output: "internal/shared/middleware/authz.go" },
+    { template: "add/rbac/internal/shared/middleware/authz_test.go.hbs", output: "internal/shared/middleware/authz_test.go" },
+    { template: "add/rbac/internal/app/role/model/role.go.hbs", output: "internal/app/role/model/role.go" },
+    { template: "add/rbac/internal/app/role/model/permission.go.hbs", output: "internal/app/role/model/permission.go" },
+    { template: "add/rbac/internal/app/role/model/role_permission.go.hbs", output: "internal/app/role/model/role_permission.go" },
+    { template: "add/rbac/internal/app/role/repository.go.hbs", output: "internal/app/role/repository.go" },
+    { template: "add/rbac/internal/app/role/service.go.hbs", output: "internal/app/role/service.go" },
+    { template: "add/rbac/internal/app/role/service_test.go.hbs", output: "internal/app/role/service_test.go" },
+    { template: "add/rbac/internal/app/role/handler.go.hbs", output: "internal/app/role/handler.go" },
+    { template: "add/rbac/internal/app/role/dto.go.hbs", output: "internal/app/role/dto.go" },
+    { template: "add/rbac/internal/app/role/errors.go.hbs", output: "internal/app/role/errors.go" },
+];

package/dist/templates/worker-manifest.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKER_FILES = void 0;
+// output paths are relative to the project root
+exports.WORKER_FILES = [
+    { template: "add/worker/internal/platform/cache/redis.go.hbs", output: "internal/platform/cache/redis.go" },
+    { template: "add/worker/internal/platform/queue/client.go.hbs", output: "internal/platform/queue/client.go" },
+    { template: "add/worker/internal/platform/queue/server.go.hbs", output: "internal/platform/queue/server.go" },
+    { template: "add/worker/internal/platform/mail/mail.go.hbs", output: "internal/platform/mail/mail.go" },
+    { template: "add/worker/internal/platform/mail/task.go.hbs", output: "internal/platform/mail/task.go" },
+    { template: "add/worker/cmd/worker/main.go.hbs", output: "cmd/worker/main.go" },
+];