@nakedev/go-scaffold 0.1.2 → 0.1.4

package/dist/utils/auth-patcher.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.patchConfigForAuth = patchConfigForAuth;
+exports.patchMainGoForAuth = patchMainGoForAuth;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const marker_patch_1 = require("./marker-patch");
+const IMPORT_MARKER = "// go-scaffold:imports";
+const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
+const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
+const CONFIG_CHECKS_MARKER = "// go-scaffold:config-checks";
+const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
+const MODEL_MARKER = "// go-scaffold:models";
+const ROUTE_MARKER = "// go-scaffold:routes";
+const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
+// patchConfigForAuth adds JWT/cookie/password-reset/Google OAuth fields to
+// Config, the same marker-based text insertion patchConfigForWorker uses
+// (config.go.hbs is only rendered once, at `create` — everything after that
+// is a real file a human may have already edited).
+function patchConfigForAuth(configGoPath) {
+    let content = fs_extra_1.default.readFileSync(configGoPath, "utf8");
+    const fieldsBlock = [
+        "JWTSecret string",
+        "JWTAccessTTL time.Duration",
+        "JWTRefreshTTL time.Duration",
+        "CookieSecure bool",
+        "",
+        "PasswordResetTTL time.Duration",
+        "PasswordResetURL string",
+        "",
+        "EmailVerifyTTL time.Duration",
+        "EmailVerifyURL string",
+        "",
+        "GoogleClientID string",
+        "GoogleClientSecret string",
+        "GoogleRedirectURL string",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "JWTSecret string");
+    const loadBlock = [
+        'JWTSecret:     env("JWT_SECRET", "dev-secret-change-me"),',
+        'JWTAccessTTL:  time.Duration(envInt("JWT_ACCESS_TTL_MIN", 15)) * time.Minute,',
+        'JWTRefreshTTL: time.Duration(envInt("JWT_REFRESH_TTL_MIN", 43200)) * time.Minute,',
+        'CookieSecure:  env("COOKIE_SECURE", "false") == "true",',
+        "",
+        'PasswordResetTTL: time.Duration(envInt("PASSWORD_RESET_TTL_MIN", 30)) * time.Minute,',
+        'PasswordResetURL: env("PASSWORD_RESET_URL", "http://localhost:3000/reset-password"),',
+        "",
+        'EmailVerifyTTL: time.Duration(envInt("EMAIL_VERIFY_TTL_MIN", 1440)) * time.Minute,',
+        'EmailVerifyURL: env("EMAIL_VERIFY_URL", "http://localhost:3000/verify-email"),',
+        "",
+        'GoogleClientID:     env("GOOGLE_CLIENT_ID", ""),',
+        'GoogleClientSecret: env("GOOGLE_CLIENT_SECRET", ""),',
+        'GoogleRedirectURL:  env("GOOGLE_REDIRECT_URL", ""),',
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'JWTSecret:     env("JWT_SECRET"');
+    fs_extra_1.default.writeFileSync(configGoPath, content);
+}
+// patchMainGoForAuth wires the user domain into cmd/api: its import, a
+// queue.Client (needed for the forgot-password email — cmd/api itself never
+// enqueued anything before this), its two models in the AutoMigrate call, a
+// prod guard against the still-default JWT secret, and its route
+// registration (the domain's own Handler.Register splits /auth public vs
+// /users protected — main.go doesn't need to know that split, same
+// convention as every other module).
+function patchMainGoForAuth(mainGoPath, goModule) {
+    let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
+    const importLine = `"${goModule}/internal/app/user"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
+    const modelImportLine = `usermodel "${goModule}/internal/app/user/model"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
+    const queueImportLine = `"${goModule}/internal/platform/queue"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
+    const mailImportLine = `"${goModule}/internal/platform/mail"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, mailImportLine, mailImportLine);
+    const checkBlock = [
+        'if cfg.IsProd() && cfg.JWTSecret == "dev-secret-change-me" {',
+        '\tlogger.Error("JWT_SECRET is still the dev default — set a real secret before deploying with APP_ENV=production")',
+        "\tos.Exit(1)",
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, checkBlock, "JWT_SECRET is still the dev default");
+    const queueInitBlock = ["q, err := queue.NewClient(cfg.RedisURL)", "if err != nil {", '\tlogger.Error("open queue", "error", err)', "\tos.Exit(1)", "}"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.NewClient(cfg.RedisURL)");
+    const migrateLine1 = "&usermodel.User{},";
+    const migrateLine2 = "&usermodel.Identity{},";
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, migrateLine1, migrateLine1);
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, migrateLine2, migrateLine2);
+    const routeLine = "user.NewHandler(user.NewService(user.NewRepository(db), user.NewRedisTokenStore(rdb), mail.NewAsyncClient(q), cfg), cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, rdb).Register(api)";
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, routeLine, routeLine);
+    content = content.replace(/\n\t_ = api \/\/ dropped once `generate module` registers the first route\n/, "\n");
+    const shutdownBlock = ["if err := q.Close(); err != nil {", '\tlogger.Error("close queue", "error", err)', "}"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := q.Close()");
+    fs_extra_1.default.writeFileSync(mainGoPath, content);
+}

package/dist/utils/gocheck.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.typeChecks = typeChecks;
+exports.assertNoDrift = assertNoDrift;
+const child_process_1 = require("child_process");
+const picocolors_1 = __importDefault(require("picocolors"));
+const version_1 = require("./version");
+// typeChecks runs `go vet ./...` in projectRoot. Returns null when there's no
+// Go toolchain on PATH — the caller can't conclude anything either way then,
+// the same graceful skip as gofmtTree.
+//
+// `go vet` rather than `go build`: build skips _test.go files entirely, and the
+// generated handler_test.go is exactly where a shared/ signature change lands
+// first (it constructs the middleware chain by hand). vet type-checks tests
+// too, so it sees what build would miss.
+function typeChecks(projectRoot) {
+    try {
+        (0, child_process_1.execFileSync)("go", ["version"], { stdio: "ignore" });
+    }
+    catch {
+        return null;
+    }
+    try {
+        (0, child_process_1.execFileSync)("go", ["vet", "./..."], { cwd: projectRoot, stdio: ["ignore", "pipe", "pipe"] });
+        return { ok: true, output: "" };
+    }
+    catch (err) {
+        const e = err;
+        return { ok: false, output: `${e.stderr?.toString() ?? ""}${e.stdout?.toString() ?? ""}`.trim() };
+    }
+}
+// assertNoDrift is the second half of a before/after pair: given what
+// typeChecks said *before* the files were written, it re-checks and fails
+// loudly if generating is what broke the project.
+//
+// Why compare instead of just checking afterwards: a project can be mid-refactor
+// (or simply not have run `go mod tidy` yet), and blaming the generator for a
+// break it didn't cause is worse than staying quiet. Only the
+// passed-before → broken-after transition is unambiguously ours.
+//
+// The failure this exists for: `generate` renders templates pinned to the
+// shared/ layer that `create` emits, so once a project edits that layer — which
+// is normal, expected work — the generated code stops compiling against it.
+// Without this check that lands as a mystery build error some time later, in
+// files the user never wrote.
+function assertNoDrift(projectRoot, before, config) {
+    if (before === null || !before.ok)
+        return; // no Go here, or already broken — not ours to judge
+    const after = typeChecks(projectRoot);
+    if (after === null || after.ok)
+        return;
+    const scaffoldedWith = config.scaffoldVersion ?? "unknown (predates version stamping)";
+    throw new Error(`${picocolors_1.default.red("the generated code doesn't compile, but this project was fine a moment ago.")}\n\n` +
+        `The most likely cause is drift: this project's internal/shared layer has been edited\n` +
+        `since it was scaffolded, so the templates this CLI emits no longer match it.\n\n` +
+        `  scaffolded with: go-scaffold ${scaffoldedWith}\n` +
+        `  this CLI:        go-scaffold ${(0, version_1.cliVersion)()}\n\n` +
+        `${picocolors_1.default.dim("go vet ./... says:")}\n${after.output}\n\n` +
+        `The generated files were left in place — reconcile them with your shared/ layer by\n` +
+        `hand, or undo (\`go-scaffold remove module <name>\` for a module) and generate again\n` +
+        `with a CLI version that matches this project.`);
+}

package/dist/utils/main-patcher.js

@@ -17,6 +17,11 @@ const UNUSED_API_LINE = "_ = api // dropped once `generate module` registers the
 // unpatchMainGo removes precisely what patch added.
 function mainGoLines(patch) {
     const modelAlias = `${patch.pkg}model`; // every domain's model subpackage is named "model"
+    const handlerArgs = [`${patch.pkg}.NewService(${patch.pkg}.NewRepository(db))`];
+    if (patch.auth)
+        handlerArgs.push("cfg.JWTSecret");
+    if (patch.permission)
+        handlerArgs.push("authz");
     return {
         importLine: `"${patch.goModule}/internal/app/${patch.modulePath}"`,
         modelImportLine: `${modelAlias} "${patch.goModule}/internal/app/${patch.modulePath}/model"`,
@@ -24,7 +29,9 @@ function mainGoLines(patch) {
         // `api` is the one route group declared by main.go.hbs, prefixed with
         // whatever apiPrefix the project chose at create time (e.g. /v1, /api,
         // or none) — every module registers on it, there is no per-module choice.
-        routeLine: `${patch.pkg}.NewHandler(${patch.pkg}.NewService(${patch.pkg}.NewRepository(db))).Register(api)`,
+        // `authz` only exists in main.go once `add rbac` has run — patch.permission
+        // is only ever set once that's already been verified by the caller.
+        routeLine: `${patch.pkg}.NewHandler(${handlerArgs.join(", ")}).Register(api)`,
     };
 }
 // patchMainGo wires a newly generated module into cmd/api/main.go: its

package/dist/utils/method-patcher.js

@@ -12,9 +12,12 @@ const DTO_MARKER = "// go-scaffold:dto";
 const REPO_INTERFACE_MARKER = "// go-scaffold:repository-interface";
 const REPO_IMPL_MARKER = "// go-scaffold:repository-methods";
 const SERVICE_MARKER = "// go-scaffold:service-methods";
+const SERVICE_INTERFACE_MARKER = "// go-scaffold:service-interface";
 const HANDLER_ROUTES_MARKER = "// go-scaffold:handler-routes";
 const HANDLER_FUNCS_MARKER = "// go-scaffold:handler-funcs";
-const FAKE_REPO_MARKER = "// go-scaffold:fake-repo-methods";
+const REPOSITORY_STUB_FIELDS_MARKER = "// go-scaffold:repository-stub-fields";
+const REPOSITORY_STUB_METHODS_MARKER = "// go-scaffold:repository-stub-methods";
+const LEGACY_FAKE_REPO_METHODS_MARKER = "// go-scaffold:fake-repo-methods";
 const UNUSED_G_LINE = "\t_ = g\n";
 // writeHandler ensures whatever packages the new handler code references are
 // imported (a minimal module starts with only "gin" imported) and drops the
@@ -62,6 +65,48 @@ function patchMethod(paths, naming, method, opts, goModule) {
     else {
         patchDelete(paths, method, goModule);
     }
+    patchHandlerServiceInterface(paths.handlerPath, naming, method, opts, goModule);
+}
+function patchHandlerServiceInterface(handlerPath, naming, method, opts, goModule) {
+    let signature;
+    let needsModel = true;
+    let needsUUID = false;
+    if (opts.type === "get" && opts.getMode === "all") {
+        signature = `${method.pascalName}(context.Context, int, int) ([]model.${naming.pascalName}, error)`;
+    }
+    else if (opts.type === "get") {
+        signature = `${method.pascalName}(context.Context, string) (*model.${naming.pascalName}, error)`;
+    }
+    else if (opts.type === "post") {
+        signature = `${method.pascalName}(context.Context, ${method.pascalName}Input) (*model.${naming.pascalName}, error)`;
+    }
+    else if (opts.type === "put" || opts.type === "patch") {
+        signature = `${method.pascalName}(context.Context, uuid.UUID) (*model.${naming.pascalName}, error)`;
+        needsUUID = true;
+    }
+    else {
+        signature = `${method.pascalName}(context.Context, uuid.UUID) error`;
+        needsModel = false;
+        needsUUID = true;
+    }
+    let handler = fs_extra_1.default.readFileSync(handlerPath, "utf8");
+    if (!(0, marker_patch_1.hasMarker)(handler, SERVICE_INTERFACE_MARKER)) {
+        // Projects scaffolded before the narrow service interface stored *Service
+        // directly. The concrete type already exposes generated methods, so there
+        // is no interface declaration to patch and no migration is required.
+        if (handler.includes("svc *Service"))
+            return;
+        throw new Error(`marker "${SERVICE_INTERFACE_MARKER}" not found and Handler does not use legacy *Service wiring`);
+    }
+    handler = (0, marker_patch_1.insertBeforeMarker)(handler, SERVICE_INTERFACE_MARKER, signature);
+    handler = (0, marker_patch_1.ensureImport)(handler, "context");
+    if (needsModel) {
+        handler = (0, marker_patch_1.ensureImport)(handler, `${goModule}/internal/app/${naming.pkg}/model`);
+    }
+    if (needsUUID) {
+        handler = (0, marker_patch_1.ensureImport)(handler, "github.com/google/uuid");
+    }
+    fs_extra_1.default.writeFileSync(handlerPath, handler);
 }
 function patchGetAll(paths, naming, method, goModule) {
     let handler = fs_extra_1.default.readFileSync(paths.handlerPath, "utf8");
@@ -117,22 +162,40 @@ function patchGetOne(paths, naming, method, rawField, goModule) {
     fs_extra_1.default.writeFileSync(paths.repositoryPath, repo);
     let service = fs_extra_1.default.readFileSync(paths.servicePath, "utf8");
     service = (0, marker_patch_1.insertBeforeMarker)(service, REPO_INTERFACE_MARKER, `FindBy${fieldPascal}(ctx context.Context, ${fieldParam} string) (*model.${naming.pascalName}, error)`);
-    // the interface just grew, so the hand-written fakeRepo mock in
-    // service_test.go needs a matching stub or the test file stops compiling
+    // The repository interface just grew, so the test double needs a matching
+    // method or focused service tests stop compiling. New projects use a
+    // function-backed stub; projects scaffolded before that refactor retain the
+    // old fakeRepo marker and error behavior.
     let serviceTest = fs_extra_1.default.readFileSync(paths.serviceTestPath, "utf8");
-    serviceTest = (0, marker_patch_1.insertBeforeMarker)(serviceTest, FAKE_REPO_MARKER, [
-        // nolint: only matters for a minimal module (fakeRepo never instantiated
-        // yet, so unused flags every one of its methods individually); harmless
-        // no-op on a full module where fakeRepo is already in use.
-        `//nolint:unused`,
-        `func (f *fakeRepo) FindBy${fieldPascal}(context.Context, string) (*model.${naming.pascalName}, error) {`,
-        `\tif f.err != nil {`,
-        `\t\treturn nil, f.err`,
-        `\t}`,
-        `\treturn f.m, nil`,
-        `}`,
-        ``,
-    ].join("\n"));
+    if ((0, marker_patch_1.hasMarker)(serviceTest, REPOSITORY_STUB_FIELDS_MARKER) &&
+        (0, marker_patch_1.hasMarker)(serviceTest, REPOSITORY_STUB_METHODS_MARKER)) {
+        serviceTest = (0, marker_patch_1.insertBeforeMarker)(serviceTest, REPOSITORY_STUB_FIELDS_MARKER, `findBy${fieldPascal}Fn func(context.Context, string) (*model.${naming.pascalName}, error)`);
+        serviceTest = (0, marker_patch_1.insertBeforeMarker)(serviceTest, REPOSITORY_STUB_METHODS_MARKER, [
+            `//nolint:unused`,
+            `func (s *repositoryStub) FindBy${fieldPascal}(ctx context.Context, value string) (*model.${naming.pascalName}, error) {`,
+            `\tif s.findBy${fieldPascal}Fn == nil {`,
+            `\t\tpanic("unexpected repository.FindBy${fieldPascal} call")`,
+            `\t}`,
+            `\treturn s.findBy${fieldPascal}Fn(ctx, value)`,
+            `}`,
+            ``,
+        ].join("\n"));
+    }
+    else if ((0, marker_patch_1.hasMarker)(serviceTest, LEGACY_FAKE_REPO_METHODS_MARKER)) {
+        serviceTest = (0, marker_patch_1.insertBeforeMarker)(serviceTest, LEGACY_FAKE_REPO_METHODS_MARKER, [
+            `//nolint:unused`,
+            `func (f *fakeRepo) FindBy${fieldPascal}(context.Context, string) (*model.${naming.pascalName}, error) {`,
+            `\tif f.err != nil {`,
+            `\t\treturn nil, f.err`,
+            `\t}`,
+            `\treturn f.m, nil`,
+            `}`,
+            ``,
+        ].join("\n"));
+    }
+    else {
+        throw new Error(`neither current repository stub markers nor legacy "${LEGACY_FAKE_REPO_METHODS_MARKER}" found in ${paths.serviceTestPath}`);
+    }
     fs_extra_1.default.writeFileSync(paths.serviceTestPath, serviceTest);
     service = (0, marker_patch_1.insertBeforeMarker)(service, SERVICE_MARKER, [
         `func (s *Service) ${method.pascalName}(ctx context.Context, ${fieldParam} string) (*model.${naming.pascalName}, error) {`,
@@ -266,6 +329,7 @@ function markersPresent(handlerPath, servicePath) {
     const service = fs_extra_1.default.readFileSync(servicePath, "utf8");
     return ((0, marker_patch_1.hasMarker)(handler, HANDLER_ROUTES_MARKER) &&
         (0, marker_patch_1.hasMarker)(handler, HANDLER_FUNCS_MARKER) &&
+        ((0, marker_patch_1.hasMarker)(handler, SERVICE_INTERFACE_MARKER) || handler.includes("svc *Service")) &&
         (0, marker_patch_1.hasMarker)(service, SERVICE_MARKER) &&
         (0, marker_patch_1.hasMarker)(service, REPO_INTERFACE_MARKER));
 }

package/dist/utils/migrations.js

@@ -3,15 +3,37 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.nextMigrationSeq = nextMigrationSeq;
+exports.newMigrationVersion = newMigrationVersion;
 const fs_extra_1 = __importDefault(require("fs-extra"));
-// golang-migrate sequential numbering: 000001, 000002, ...
-function nextMigrationSeq(migrationsDir) {
-    const files = fs_extra_1.default.existsSync(migrationsDir) ? fs_extra_1.default.readdirSync(migrationsDir) : [];
-    const nums = files
+// golang-migrate timestamp numbering — the same convention as the CLI's own
+// `migrate create -ext sql -dir migrations -seq=false <name>`: a 14-digit
+// UTC timestamp (YYYYMMDDHHMMSS). Two people branching from the same base and
+// each adding a migration get different filenames instead of both claiming
+// the next sequential number and colliding on merge. golang-migrate orders
+// by the numeric prefix either way, and a 14-digit timestamp always sorts
+// after any existing 6-digit sequential number, so a project with old-style
+// numbers already in migrations/ is safe to keep generating into.
+function newMigrationVersion(migrationsDir) {
+    const existing = new Set((fs_extra_1.default.existsSync(migrationsDir) ? fs_extra_1.default.readdirSync(migrationsDir) : [])
         .map((f) => f.match(/^(\d+)_/))
         .filter((m) => m !== null)
-        .map((m) => parseInt(m[1], 10));
-    const next = (nums.length ? Math.max(...nums) : 0) + 1;
-    return String(next).padStart(6, "0");
+        .map((m) => m[1]));
+    let d = new Date();
+    let version = formatVersion(d);
+    // Vanishingly unlikely in normal (human-driven) use, but guard the
+    // same-second edge case rather than silently overwrite a sibling file.
+    while (existing.has(version)) {
+        d = new Date(d.getTime() + 1000);
+        version = formatVersion(d);
+    }
+    return version;
+}
+function formatVersion(d) {
+    const pad = (n) => String(n).padStart(2, "0");
+    return (String(d.getUTCFullYear()) +
+        pad(d.getUTCMonth() + 1) +
+        pad(d.getUTCDate()) +
+        pad(d.getUTCHours()) +
+        pad(d.getUTCMinutes()) +
+        pad(d.getUTCSeconds()));
 }

package/dist/utils/module-location.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.existingModulePackages = existingModulePackages;
+exports.resolveProjectModuleNaming = resolveProjectModuleNaming;
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const naming_1 = require("./naming");
+function existingModulePackages(projectDir) {
+    const appDir = path_1.default.join(projectDir, "internal", "app");
+    if (!fs_extra_1.default.existsSync(appDir))
+        return [];
+    return fs_extra_1.default
+        .readdirSync(appDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name);
+}
+function resolveProjectModuleNaming(projectDir, rawName) {
+    return (0, naming_1.resolveExistingModuleNaming)(rawName, existingModulePackages(projectDir));
+}

package/dist/utils/naming.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pluralize = pluralize;
 exports.toPascalCase = toPascalCase;
@@ -13,18 +16,14 @@ exports.validateModuleName = validateModuleName;
 exports.normalizeApiPrefix = normalizeApiPrefix;
 exports.validateApiPrefix = validateApiPrefix;
 exports.resolveModuleNaming = resolveModuleNaming;
+exports.resolveExistingModuleNaming = resolveExistingModuleNaming;
 exports.resolveMethodNaming = resolveMethodNaming;
-// ponytail: heuristic pluralizer, not a dependency — covers common English
-// nouns (order/user/category/address); irregular plurals still need a manual
-// rename in the generated file, add a dictionary if that becomes frequent.
+const pluralize_1 = __importDefault(require("pluralize"));
+// Pluralization must be idempotent because module names may come from the
+// interactive prompt (singular) or a documented/scripted command (often
+// plural). Keep this wrapper exported for callers that only need inflection.
 function pluralize(word) {
-    if (/[sxz]$/.test(word) || /[^aeiou](ch|sh)$/.test(word))
-        return word + "es";
-    if (/[^aeiou]y$/.test(word))
-        return word.slice(0, -1) + "ies";
-    if (word.endsWith("s"))
-        return word;
-    return word + "s";
+    return pluralize_1.default.plural(word);
 }
 function toPascalCase(value) {
     return value
@@ -98,7 +97,7 @@ function assertNotGoKeyword(ident, role) {
 // shadowing the builtin in main.go). Returns true|message for inquirer, and
 // backs the assert in resolveModuleNaming — one source of truth for both.
 function validateModuleName(rawName) {
-    const pkg = toPackageName(rawName);
+    const pkg = toPackageName(pluralize_1.default.singular(toKebabCase(rawName)));
     if (!pkg)
         return `invalid module name: "${rawName}" (must contain letters/numbers)`;
     if (/^[0-9]/.test(pkg)) {
@@ -134,15 +133,79 @@ function resolveModuleNaming(rawName) {
     const check = validateModuleName(rawName);
     if (check !== true)
         throw new Error(check);
+    const singular = pluralize_1.default.singular(toKebabCase(rawName));
+    const pkg = toPackageName(singular);
+    const plural = pluralize_1.default.plural(singular);
+    return {
+        name: singular,
+        pkg,
+        pascalName: toPascalCase(singular),
+        plural,
+        tableName: toDbName(plural),
+        errorPrefix: toDbName(singular).toUpperCase(),
+    };
+}
+function legacyPluralize(word) {
+    if (/[sxz]$/.test(word) || /[^aeiou](ch|sh)$/.test(word))
+        return word + "es";
+    if (/[^aeiou]y$/.test(word))
+        return word.slice(0, -1) + "ies";
+    if (word.endsWith("s"))
+        return word;
+    return word + "s";
+}
+function resolveLegacyModuleNaming(rawName) {
     const pkg = toPackageName(rawName);
+    const plural = legacyPluralize(pkg);
     return {
         name: pkg,
         pkg,
         pascalName: toPascalCase(pkg),
-        plural: pluralize(pkg),
+        plural,
+        tableName: toDbName(plural),
         errorPrefix: pkg.toUpperCase(),
     };
 }
+// Projects generated before canonical inflection used the raw input as the Go
+// package name. Prefer the canonical package when present, but keep locating
+// legacy plural packages so upgrade does not make method/remove commands lose
+// sight of existing code. Two matches are unsafe: silently choosing one can
+// patch or delete the wrong module.
+function resolveExistingModuleNaming(rawName, existingPackages) {
+    const requestedLegacy = resolveLegacyModuleNaming(rawName);
+    const existing = new Set(existingPackages);
+    let canonical;
+    try {
+        canonical = resolveModuleNaming(rawName);
+    }
+    catch (error) {
+        if (existing.has(requestedLegacy.pkg))
+            return requestedLegacy;
+        throw error;
+    }
+    const aliases = existingPackages.filter((pkg) => {
+        if (pkg === canonical.pkg)
+            return false;
+        try {
+            return resolveModuleNaming(pkg).pkg === canonical.pkg;
+        }
+        catch {
+            return false;
+        }
+    });
+    const matches = [
+        ...(existing.has(canonical.pkg) ? [canonical.pkg] : []),
+        ...aliases,
+    ];
+    if (matches.length > 1) {
+        throw new Error(`ambiguous module "${rawName}": ${matches.map((pkg) => `internal/app/${pkg}`).join(" and ")} exist`);
+    }
+    if (matches[0] === canonical.pkg)
+        return canonical;
+    if (matches[0])
+        return resolveLegacyModuleNaming(matches[0]);
+    return canonical;
+}
 function resolveMethodNaming(rawName) {
     const cleaned = rawName.trim();
     const pascalName = toPascalCase(cleaned);

package/dist/utils/openapi-patcher.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patchOpenapiIndex = patchOpenapiIndex;
 exports.unpatchOpenapiIndex = unpatchOpenapiIndex;
+exports.patchOpenapiIndexRaw = patchOpenapiIndexRaw;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const marker_patch_1 = require("./marker-patch");
 const PATHS_MARKER = "# go-scaffold:paths";
@@ -43,5 +44,38 @@ function patchOpenapiIndex(openapiPath, naming, apiPrefix) {
 function unpatchOpenapiIndex(openapiPath, naming, apiPrefix) {
     const content = fs_extra_1.default.readFileSync(openapiPath, "utf8");
     const { paths, schemas } = openapiLines(naming, apiPrefix);
-    fs_extra_1.default.writeFileSync(openapiPath, (0, marker_patch_1.removeLines)(content, [...paths, ...schemas]));
+    const withoutKnownEntries = (0, marker_patch_1.removeLines)(content, [...paths, ...schemas]);
+    // `generate method` can add any number of module-specific path documents.
+    // Remove every two-line path/$ref block owned by this module, otherwise the
+    // index keeps dangling references after the docs folder is deleted.
+    const lines = withoutKnownEntries.split("\n");
+    const moduleRefPrefix = `./${naming.plural}/`;
+    const kept = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const current = lines[i];
+        const next = lines[i + 1];
+        const isPathKey = /^\s*\/[^:]+:\s*$/.test(current);
+        const refMatch = next?.match(/^\s*\$ref:\s*['"]([^'"]+)['"]\s*$/);
+        if (isPathKey && refMatch?.[1].startsWith(moduleRefPrefix)) {
+            i += 1;
+            continue;
+        }
+        kept.push(current);
+    }
+    fs_extra_1.default.writeFileSync(openapiPath, kept.join("\n"));
+}
+// patchOpenapiIndexRaw wires hand-written path docs into the index — used by
+// `add auth`/`add rbac`, whose endpoints aren't a single CRUD resource so
+// there's no ModuleNaming to derive lines from. Each entry is patched with
+// its own sentinel (the path key) rather than one block for all of them, so
+// re-running `add rbac` after a partial failure doesn't skip entries that
+// never made it in.
+function patchOpenapiIndexRaw(openapiPath, apiPrefix, entries) {
+    let content = fs_extra_1.default.readFileSync(openapiPath, "utf8");
+    for (const { urlPath, file } of entries) {
+        const key = `${apiPrefix ? `/${apiPrefix}` : ""}${urlPath}:`;
+        const block = `${key}\n  $ref: '${file}'`;
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PATHS_MARKER, block, key);
+    }
+    fs_extra_1.default.writeFileSync(openapiPath, content);
 }

package/dist/utils/platform-patcher.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.patchConfigForWorker = patchConfigForWorker;
+exports.patchMainGoForWorker = patchMainGoForWorker;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const marker_patch_1 = require("./marker-patch");
+const IMPORT_MARKER = "// go-scaffold:imports";
+const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
+const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
+const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
+const READYZ_MARKER = "// go-scaffold:readyz-checks";
+const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
+// patchConfigForWorker adds RedisURL + SMTP_* fields to Config and their
+// env() loads to Load() — via marker comments, the same text-insertion
+// approach as patchMainGo, since config.go.hbs is only rendered once (at
+// `create`) and everything after that is a real file a human may have
+// already edited.
+function patchConfigForWorker(configGoPath) {
+    let content = fs_extra_1.default.readFileSync(configGoPath, "utf8");
+    const fieldsBlock = ["RedisURL string", "", "SMTPHost string", "SMTPPort string", "SMTPUsername string", "SMTPPassword string", "SMTPFrom string"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "RedisURL string");
+    const loadBlock = [
+        'RedisURL: env("REDIS_URL", "redis://localhost:6379/0"),',
+        "",
+        'SMTPHost:     env("SMTP_HOST", ""),',
+        'SMTPPort:     env("SMTP_PORT", "587"),',
+        'SMTPUsername: env("SMTP_USERNAME", ""),',
+        'SMTPPassword: env("SMTP_PASSWORD", ""),',
+        'SMTPFrom:     env("SMTP_FROM", "no-reply@example.local"),',
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'RedisURL: env("REDIS_URL"');
+    fs_extra_1.default.writeFileSync(configGoPath, content);
+}
+// patchMainGoForWorker wires Redis into cmd/api: opened alongside the DB, and
+// pinged as part of /readyz (so a Redis outage is caught the same way a DB
+// outage already is). It does not create a queue.Client — nothing in cmd/api
+// enqueues a task until some domain actually needs to (e.g. a future `add
+// auth`'s forgot-password flow); an unused *queue.Client sitting in main()
+// would just be dead weight until then.
+function patchMainGoForWorker(mainGoPath, goModule) {
+    let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
+    const cacheImport = `"${goModule}/internal/platform/cache"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, cacheImport, cacheImport);
+    const initBlock = ["rdb, err := cache.Open(cfg)", "if err != nil {", '\tlogger.Error("open redis", "error", err)', "\tos.Exit(1)", "}"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, initBlock, "rdb, err := cache.Open(cfg)");
+    const readyzBlock = [
+        "if err := rdb.Ping(c.Request.Context()).Err(); err != nil {",
+        '\tc.JSON(http.StatusServiceUnavailable, gin.H{"status": "unavailable"})',
+        "\treturn",
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, READYZ_MARKER, readyzBlock, "if err := rdb.Ping(");
+    const shutdownBlock = ["if err := rdb.Close(); err != nil {", '\tlogger.Error("close redis", "error", err)', "}"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := rdb.Close()");
+    fs_extra_1.default.writeFileSync(mainGoPath, content);
+}