@nakedev/go-scaffold 0.1.3 → 0.3.0

package/dist/commands/generate.js

@@ -9,10 +9,12 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const picocolors_1 = __importDefault(require("picocolors"));
 const config_1 = require("../utils/config");
 const naming_1 = require("../utils/naming");
+const module_location_1 = require("../utils/module-location");
 const template_renderer_1 = require("../utils/template-renderer");
 const module_manifest_1 = require("../templates/module-manifest");
 const main_patcher_1 = require("../utils/main-patcher");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
+const golangci_patcher_1 = require("../utils/golangci-patcher");
 const migrations_1 = require("../utils/migrations");
 const gocheck_1 = require("../utils/gocheck");
 const generate_wizard_1 = require("../prompts/generate-wizard");
@@ -36,12 +38,17 @@ async function generateModule(rawName, opts, projectDir = process.cwd()) {
             throw new Error(`invalid permission code "${opts.permission}" — must start with a lowercase letter and contain only lowercase letters, digits, ':', '_', or '-'`);
         }
     }
-    const naming = (0, naming_1.resolveModuleNaming)(rawName ?? (await (0, generate_wizard_1.promptModuleName)()));
+    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, rawName ?? (await (0, generate_wizard_1.promptModuleName)()));
     const modulePath = naming.pkg;
     const moduleDir = path_1.default.join(projectDir, "internal", "app", modulePath);
     if (fs_extra_1.default.existsSync(moduleDir) && fs_extra_1.default.readdirSync(moduleDir).length > 0) {
         throw new Error(`${moduleDir} already exists — pick a different name or delete it first`);
     }
+    // Every marker this command patches has to be there before the first file
+    // is written — a failure after the module folder and its migration exist is
+    // a dead end, since the retry trips the "already exists" guard above.
+    const mainGoPath = path_1.default.join(projectDir, "cmd", "api", "wiring.go");
+    (0, main_patcher_1.assertMainGoPatchable)(mainGoPath);
     // snapshot before writing anything, so assertNoDrift below can tell "we broke
     // it" from "it was already broken"
     const checkBefore = (0, gocheck_1.typeChecks)(projectDir);
@@ -62,19 +69,22 @@ async function generateModule(rawName, opts, projectDir = process.cwd()) {
     // skip if a create_<plural> migration already exists — re-running after
     // only the module folder was deleted shouldn't leave a duplicate migration.
     const migrationsDir = path_1.default.join(projectDir, "migrations");
+    const slug = (0, naming_1.migrationSlug)(naming);
     const migrationExists = fs_extra_1.default.existsSync(migrationsDir) &&
-        fs_extra_1.default.readdirSync(migrationsDir).some((f) => f.endsWith(`_create_${naming.plural}.up.sql`));
+        fs_extra_1.default
+            .readdirSync(migrationsDir)
+            .some((f) => (0, naming_1.migrationSlugAliases)(naming).some((alias) => f.endsWith(`_create_${alias}.up.sql`)));
     let seq = "";
     if (!migrationExists) {
         seq = (0, migrations_1.newMigrationVersion)(migrationsDir);
         const migrationEntries = [
             {
                 template: "generate/module/migration.up.sql.hbs",
-                output: path_1.default.join("migrations", `${seq}_create_${naming.plural}.up.sql`),
+                output: path_1.default.join("migrations", `${seq}_create_${slug}.up.sql`),
             },
             {
                 template: "generate/module/migration.down.sql.hbs",
-                output: path_1.default.join("migrations", `${seq}_create_${naming.plural}.down.sql`),
+                output: path_1.default.join("migrations", `${seq}_create_${slug}.down.sql`),
             },
         ];
         await (0, template_renderer_1.applyTemplateEntries)(projectDir, migrationEntries, context);
@@ -89,21 +99,22 @@ async function generateModule(rawName, opts, projectDir = process.cwd()) {
         const permissionEntries = [
             {
                 template: "generate/module/permission.up.sql.hbs",
-                output: path_1.default.join("migrations", `${permissionSeq}_add_${naming.plural}_permission.up.sql`),
+                output: path_1.default.join("migrations", `${permissionSeq}_add_${slug}_permission.up.sql`),
             },
             {
                 template: "generate/module/permission.down.sql.hbs",
-                output: path_1.default.join("migrations", `${permissionSeq}_add_${naming.plural}_permission.down.sql`),
+                output: path_1.default.join("migrations", `${permissionSeq}_add_${slug}_permission.down.sql`),
             },
         ];
         await (0, template_renderer_1.applyTemplateEntries)(projectDir, permissionEntries, context);
     }
-    const mainGoPath = path_1.default.join(projectDir, "cmd", "api", "main.go");
+    (0, golangci_patcher_1.patchGolangciForModule)(path_1.default.join(projectDir, ".golangci.yml"), config.goModule, naming.pkg);
     (0, main_patcher_1.patchMainGo)(mainGoPath, {
         goModule: config.goModule,
         modulePath,
         pkg: naming.pkg,
         pascalName: naming.pascalName,
+        schemaName: naming.schemaName,
         auth: opts.auth,
         permission: opts.permission,
     });
@@ -124,10 +135,10 @@ async function generateModule(rawName, opts, projectDir = process.cwd()) {
     const routePath = config.apiPrefix ? `/${config.apiPrefix}/${naming.plural}` : `/${naming.plural}`;
     console.log(picocolors_1.default.green(`\ngenerated internal/app/${modulePath}/`));
     if (opts.full) {
-        console.log(`registered route ${routePath} in cmd/api/main.go`);
+        console.log(`registered route ${routePath} in cmd/api/wiring.go`);
     }
     else {
-        console.log(`registered empty route group ${routePath} in cmd/api/main.go — ` +
+        console.log(`registered empty route group ${routePath} in cmd/api/wiring.go — ` +
             `add endpoints with \`go-scaffold generate method ${naming.pkg} <name> --type ...\``);
     }
     if (opts.permission) {
@@ -140,13 +151,13 @@ async function generateModule(rawName, opts, projectDir = process.cwd()) {
         console.log(picocolors_1.default.yellow(`note: this project has auth installed, but ${routePath} is PUBLIC — re-run with --auth (and --permission <code> if you also have rbac) to require login`));
     }
     if (seq) {
-        console.log(`migration: migrations/${seq}_create_${naming.plural}.{up,down}.sql`);
+        console.log(`migration: migrations/${seq}_create_${slug}.{up,down}.sql`);
     }
     else {
-        console.log(`migration: reused existing migrations/*_create_${naming.plural}.{up,down}.sql`);
+        console.log(`migration: reused existing migrations/*_create_${slug}.{up,down}.sql`);
     }
     if (permissionSeq) {
-        console.log(`migration: migrations/${permissionSeq}_add_${naming.plural}_permission.{up,down}.sql (seeds the "${opts.permission}" permission — grant it to a role via PATCH /roles/:code/permissions)`);
+        console.log(`migration: migrations/${permissionSeq}_add_${slug}_permission.{up,down}.sql (seeds the "${opts.permission}" permission — grant it to a role via PATCH /roles/:code/permissions)`);
     }
     if (docsMessage)
         console.log(docsMessage);

package/dist/commands/method.js

@@ -9,29 +9,62 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const picocolors_1 = __importDefault(require("picocolors"));
 const config_1 = require("../utils/config");
 const naming_1 = require("../utils/naming");
+const module_location_1 = require("../utils/module-location");
 const method_patcher_1 = require("../utils/method-patcher");
 const gocheck_1 = require("../utils/gocheck");
 const template_renderer_1 = require("../utils/template-renderer");
+const migrations_1 = require("../utils/migrations");
+const openapi_patcher_1 = require("../utils/openapi-patcher");
 const generate_wizard_1 = require("../prompts/generate-wizard");
-// the actual URL the new route answers on — printed so the user can add the
-// matching openapi.yaml entry by hand (methods are deliberately not wired into
-// the spec; see the note in docs/openapi.yaml). Mirrors the paths registered
-// in method-patcher.ts.
-function routeHint(naming, method, type, apiPrefix, getMode, field) {
-    const base = apiPrefix ? `/${apiPrefix}/${naming.plural}` : `/${naming.plural}`;
+// URL path registered in method-patcher.ts, excluding the project-wide API
+// prefix so it can be passed directly to patchOpenapiIndexRaw.
+function methodRoutePath(naming, method, type, getMode, field) {
+    const base = `/${naming.plural}`;
     if (type === "get" && getMode === "all")
-        return `GET ${base}/${method.pathSegment}`;
+        return `${base}/${method.pathSegment}`;
     if (type === "get")
-        return `GET ${base}/${(0, naming_1.toDbName)(field ?? "")}/{${(0, naming_1.toCamelCase)(field ?? "")}}`;
+        return `${base}/${(0, naming_1.toDbName)(field ?? "")}/{${(0, naming_1.toCamelCase)(field ?? "")}}`;
     if (type === "post")
-        return `POST ${base}/${method.pathSegment}`;
-    if (type === "delete")
-        return `DELETE ${base}/{id}/${method.pathSegment}`;
-    return `${type.toUpperCase()} ${base}/{id}/${method.pathSegment}`;
+        return `${base}/${method.pathSegment}`;
+    return `${base}/{id}/${method.pathSegment}`;
+}
+function routeHint(naming, method, type, apiPrefix, getMode, field) {
+    const path = methodRoutePath(naming, method, type, getMode, field);
+    const prefixed = apiPrefix ? `/${apiPrefix}${path}` : path;
+    return `${type.toUpperCase()} ${prefixed}`;
+}
+function methodOpenapiDocument(naming, method, type, getMode, field) {
+    const pathParameters = [];
+    if (type === "get" && getMode === "one") {
+        const parameter = (0, naming_1.toCamelCase)(field ?? "");
+        pathParameters.push("parameters:", `  - name: ${parameter}`, "    in: path", "    required: true", "    schema:", "      type: string");
+    }
+    else if (type === "put" || type === "patch" || type === "delete") {
+        pathParameters.push("parameters:", "  - name: id", "    in: path", "    required: true", "    schema:", "      type: string", "      format: uuid");
+    }
+    const operation = [
+        `${type}:`,
+        `  summary: TODO document ${method.name}`,
+        `  operationId: ${method.handlerName}${naming.pascalName}`,
+        `  tags: [${naming.plural}]`,
+    ];
+    if (type === "post") {
+        operation.push("  requestBody:", "    required: true", "    content:", "      application/json:", "        schema:", "          type: object", "          description: TODO define request fields");
+    }
+    const status = type === "delete" ? "204" : type === "post" ? "201" : "200";
+    operation.push("  responses:", `    \"${status}\":`, `      description: ${type === "delete" ? "completed or already absent" : "TODO define response"}`);
+    if (type !== "delete") {
+        operation.push("      content:", "        application/json:", "          schema:", "            type: object", "            description: TODO replace with the method response schema");
+    }
+    operation.push("    \"400\": { $ref: '../../common/responses.yaml#/ValidationError' }");
+    if (type === "get" || type === "put" || type === "patch") {
+        operation.push("    \"404\": { $ref: '../../common/responses.yaml#/NotFoundError' }");
+    }
+    return [...pathParameters, ...operation, ""].join("\n");
 }
 async function generateMethod(moduleNameArg, methodNameArg, opts, projectDir = process.cwd()) {
     const config = (0, config_1.readConfig)(projectDir);
-    const naming = (0, naming_1.resolveModuleNaming)(moduleNameArg ?? (await (0, generate_wizard_1.promptModuleName)()));
+    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, moduleNameArg ?? (await (0, generate_wizard_1.promptExistingModule)((0, module_location_1.existingModulePackages)(projectDir), "add a method to")));
     const modulePath = naming.pkg;
     const moduleDir = path_1.default.join(projectDir, "internal", "app", modulePath);
     const paths = {
@@ -56,18 +89,62 @@ async function generateMethod(moduleNameArg, methodNameArg, opts, projectDir = p
     }
     const getMode = type === "get" ? opts.getMode ?? (await (0, generate_wizard_1.promptGetMode)()) : undefined;
     const field = type === "get" && getMode === "one" ? opts.field ?? (await (0, generate_wizard_1.promptLookupField)()) : undefined;
-    // field becomes a Go param name (`func (...)(ctx, <field> string)`)
+    // field becomes a Go param name (`func (...)(ctx, <field> string)`) and a
+    // column name in the generated `WHERE <field> = ?`
     if (field)
-        (0, naming_1.assertNotGoKeyword)((0, naming_1.toCamelCase)(field), "lookup field");
+        (0, naming_1.assertGoIdentifier)((0, naming_1.toCamelCase)(field), "lookup field");
     const method = (0, naming_1.resolveMethodNaming)(methodNameArg ?? (await (0, generate_wizard_1.promptMethodName)()));
+    // Every marker this command patches has to exist before the first write:
+    // patchMethod writes dto.go, then handler.go, then reads service.go, so a
+    // missing service marker used to leave two files patched and the method
+    // permanently un-retryable (assertNotDuplicate then sees it as existing).
+    if (!(0, method_patcher_1.markersPresent)(paths.handlerPath, paths.servicePath)) {
+        throw new Error(`internal/app/${naming.pkg} is missing the marker comments \`generate method\` patches at.\n` +
+            `handler.go and service.go must both still carry their \`// go-scaffold:*\` markers —\n` +
+            `restore them, or add this method by hand.`);
+    }
+    const docsRelativePath = config.features.openapiDocs
+        ? `${naming.plural}/methods/${method.pathSegment}.yaml`
+        : undefined;
+    if (docsRelativePath && fs_extra_1.default.existsSync(path_1.default.join(projectDir, "docs", docsRelativePath))) {
+        throw new Error(`OpenAPI method document already exists: docs/${docsRelativePath}`);
+    }
     const checkBefore = (0, gocheck_1.typeChecks)(projectDir);
     (0, method_patcher_1.patchMethod)(paths, naming, method, { type, getMode, field }, config.goModule);
     (0, template_renderer_1.gofmtTree)(projectDir);
     (0, gocheck_1.assertNoDrift)(projectDir, checkBefore, config);
+    // A --field lookup queries a column the table doesn't have yet. GORM builds
+    // that SQL at runtime, so nothing before the first real request notices:
+    // the build passes, vet passes, the generated tests pass. Ship the column
+    // and its index with the code that needs them.
+    let fieldMigration = "";
+    if (field) {
+        const migrationsDir = path_1.default.join(projectDir, "migrations");
+        fieldMigration = (0, migrations_1.newMigrationVersion)(migrationsDir);
+        const fieldColumn = (0, naming_1.toDbName)(field);
+        await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+            { template: "generate/module/field-column.up.sql.hbs", output: path_1.default.join("migrations", `${fieldMigration}_add_${naming.tableName}_${fieldColumn}.up.sql`) },
+            { template: "generate/module/field-column.down.sql.hbs", output: path_1.default.join("migrations", `${fieldMigration}_add_${naming.tableName}_${fieldColumn}.down.sql`) },
+        ], { ...naming, pkg: naming.pkg, methodName: method.name, fieldColumn });
+    }
+    if (fieldMigration) {
+        console.log(`migration: migrations/${fieldMigration}_add_${naming.tableName}_${(0, naming_1.toDbName)(field)}.{up,down}.sql ` +
+            `(adds the column the lookup queries, plus an index on it — check the type before applying)`);
+    }
+    if (docsRelativePath) {
+        const docsPath = path_1.default.join(projectDir, "docs", docsRelativePath);
+        fs_extra_1.default.outputFileSync(docsPath, methodOpenapiDocument(naming, method, type, getMode, field));
+        (0, openapi_patcher_1.patchOpenapiIndexRaw)(path_1.default.join(projectDir, "docs", "openapi.yaml"), config.apiPrefix, [
+            {
+                urlPath: methodRoutePath(naming, method, type, getMode, field),
+                file: `./${docsRelativePath}`,
+            },
+        ]);
+    }
     console.log(picocolors_1.default.green(`\nadded "${method.name}" to internal/app/${modulePath}/`));
     console.log(`route: ${routeHint(naming, method, type, config.apiPrefix, getMode, field)}`);
-    if (config.features.openapiDocs) {
-        console.log(picocolors_1.default.yellow(`docs: add this route to docs/openapi.yaml by hand — \`generate method\` doesn't touch the spec`));
+    if (docsRelativePath) {
+        console.log(picocolors_1.default.green(`docs: docs/${docsRelativePath} (wired into docs/openapi.yaml)`));
     }
     console.log(picocolors_1.default.dim(`\nnext: fill in the TODO in service.go, then \`go build ./...\` / \`go test ./...\``));
 }

package/dist/commands/observability.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addObservability = addObservability;
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const config_1 = require("../utils/config");
+const template_renderer_1 = require("../utils/template-renderer");
+const observability_manifest_1 = require("../templates/observability-manifest");
+const observability_patcher_1 = require("../utils/observability-patcher");
+const gocheck_1 = require("../utils/gocheck");
+const gomod_patcher_1 = require("../utils/gomod-patcher");
+// addObservability scaffolds Prometheus metrics (GET /metrics) and
+// OpenTelemetry tracing for Gin + GORM, wiring both into the files `create`
+// already wrote. Opt-in and separate from `create`: most projects don't want
+// to think about a collector on day one, and unlike worker/auth/rbac this
+// touches files every project already has, so it has to patch rather than
+// just add new ones. `create --observability` calls this immediately after
+// scaffolding, so the two paths produce identical projects.
+async function addObservability(projectDir = process.cwd(), opts = {}) {
+    const config = (0, config_1.readConfig)(projectDir);
+    const telemetryGoPath = path_1.default.join(projectDir, "internal", "platform", "telemetry", "tracing.go");
+    if (fs_extra_1.default.existsSync(telemetryGoPath)) {
+        throw new Error(`${telemetryGoPath} already exists — observability looks like it's already been added`);
+    }
+    const parsedBefore = (0, gocheck_1.parseChecks)(projectDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, observability_manifest_1.OBSERVABILITY_FILES, { openapiDocs: config.features.openapiDocs });
+    (0, observability_patcher_1.patchMainGoForObservability)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.projectName);
+    (0, observability_patcher_1.patchDatabaseGoForObservability)(path_1.default.join(projectDir, "internal", "platform", "database", "database.go"), config.goModule);
+    (0, observability_patcher_1.patchConfigForObservability)(path_1.default.join(projectDir, "internal", "shared", "config", "config.go"));
+    (0, gomod_patcher_1.patchGoModRequires)(path_1.default.join(projectDir, "go.mod"), [
+        "github.com/prometheus/client_golang v1.24.1",
+        "go.opentelemetry.io/otel v1.45.0",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0",
+        "go.opentelemetry.io/otel/sdk v1.45.0",
+        "go.opentelemetry.io/otel/trace v1.45.0",
+    ]);
+    (0, observability_patcher_1.patchEnvExampleForObservability)(path_1.default.join(projectDir, ".env.example"));
+    const openapiPath = path_1.default.join(projectDir, "docs", "openapi.yaml");
+    if (config.features.openapiDocs && fs_extra_1.default.existsSync(openapiPath)) {
+        (0, observability_patcher_1.patchOpenapiIndexForObservability)(openapiPath);
+    }
+    (0, template_renderer_1.gofmtTree)(projectDir);
+    // parse-only: the otel/prometheus imports this adds aren't in go.mod until
+    // the `go mod tidy` printed below, so `go vet` can't be the gate here.
+    (0, gocheck_1.assertStillParses)(projectDir, parsedBefore, "added observability");
+    // After the gate, next to writeConfig: these are .md files, so the parse
+    // check has no reason to guard them, and a throw from it used to strand the
+    // docs saying `enabled` while the config it never reached still said false —
+    // a disagreement no later command could converge, since the "already added"
+    // guard then blocks a re-run.
+    const staleDocs = refreshArchitectDocs(projectDir, config);
+    (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, observability: true } });
+    if (opts.silent)
+        return;
+    console.log(picocolors_1.default.green("\nadded internal/platform/telemetry/, internal/shared/middleware/{metrics,tracing}.go, and GET /metrics"));
+    console.log("wired into cmd/api/wiring.go and internal/platform/database — every request and GORM query now gets a trace span");
+    if (staleDocs.length) {
+        // Deliberately not "you edited these". The comparison is a whole-file
+        // match against today's template, and techstack.md embeds pinned
+        // dependency versions — so every release that bumps one makes every
+        // project scaffolded before it look edited. Which is exactly the
+        // population this function exists for.
+        console.log(picocolors_1.default.yellow(`\nnote: couldn't safely rewrite ${staleDocs.join(" and ")} — ` +
+            `${staleDocs.length > 1 ? "they don't" : "it doesn't"} match what this go-scaffold\n` +
+            `  would have generated, so ${staleDocs.length > 1 ? "they were" : "it was"} left alone rather than overwriting your edits.\n` +
+            `  ${staleDocs.length > 1 ? "They still describe" : "It still describes"} this project as having no metrics or tracing; update by hand.`));
+    }
+    console.log(picocolors_1.default.dim("\nnext: go mod tidy, then set OTEL_EXPORTER_OTLP_ENDPOINT to export traces (empty = tracing no-ops, /metrics works either way)"));
+}
+// The architecture docs gate their observability sections on a `create`-time
+// flag, so adding the feature afterwards used to leave techstack.md saying
+// `disabled` and architecture.md missing the section entirely — while the
+// README promises `create --observability` and this command produce the same
+// project.
+//
+// Re-rendering from the templates rather than string-patching keeps the prose
+// in one place (the .hbs), but would also silently discard a user's edits. So
+// it first renders what the file *should* look like today, with observability
+// still off: only a byte-for-byte match proves nobody has touched it. Returns
+// the docs it declined to overwrite, for the caller to warn about.
+function refreshArchitectDocs(projectDir, config) {
+    const docs = [
+        { template: "create/features/docs/architecture.md.hbs", output: path_1.default.join("docs", "architect", "architecture.md") },
+        { template: "create/features/docs/techstack.md.hbs", output: path_1.default.join("docs", "architect", "techstack.md") },
+    ];
+    // only what the two templates actually reference — projectName, apiPrefix
+    // and the feature flags
+    const base = { projectName: config.projectName, apiPrefix: config.apiPrefix, ...config.features };
+    const root = (0, template_renderer_1.getTemplatesRoot)();
+    const skipped = [];
+    for (const doc of docs) {
+        const outputPath = path_1.default.join(projectDir, doc.output);
+        if (!fs_extra_1.default.existsSync(outputPath))
+            continue;
+        const source = fs_extra_1.default.readFileSync(path_1.default.join(root, doc.template), "utf8");
+        // compare with line endings normalised — a Windows checkout with
+        // core.autocrlf=true would otherwise never match, and the feature would
+        // silently never fire there
+        const onDisk = lf(fs_extra_1.default.readFileSync(outputPath, "utf8"));
+        if (onDisk !== lf((0, template_renderer_1.renderString)(source, { ...base, observability: false }))) {
+            skipped.push(doc.output);
+            continue;
+        }
+        fs_extra_1.default.writeFileSync(outputPath, (0, template_renderer_1.renderString)(source, { ...base, observability: true }));
+    }
+    return skipped;
+}
+function lf(text) {
+    return text.replace(/\r\n/g, "\n");
+}

package/dist/commands/rbac.js

@@ -13,6 +13,8 @@ const rbac_manifest_1 = require("../templates/rbac-manifest");
 const migrations_1 = require("../utils/migrations");
 const rbac_patcher_1 = require("../utils/rbac-patcher");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
+const golangci_patcher_1 = require("../utils/golangci-patcher");
+const gocheck_1 = require("../utils/gocheck");
 // URL (relative to the api prefix) -> docs file (relative to docs/) for every
 // route `add rbac` registers or adds onto the user handler.
 const RBAC_OPENAPI_PATHS = [
@@ -41,6 +43,12 @@ async function addRbac(projectDir = process.cwd()) {
     if (fs_extra_1.default.existsSync(roleDir)) {
         throw new Error(`${roleDir} already exists — RBAC looks like it's already been added`);
     }
+    const before = (0, gocheck_1.typeChecks)(projectDir);
+    // Every file below is patched in place, and main.go's userSvc line is the
+    // one rbac cannot construct on its own — check it first so a mismatch costs
+    // an error message rather than a half-patched project.
+    (0, rbac_patcher_1.assertRbacPatchable)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.features.authStore ?? "redis", config.features.worker ?? false);
+    const parsedBefore = (0, gocheck_1.parseChecks)(projectDir);
     await (0, template_renderer_1.applyTemplateEntries)(projectDir, rbac_manifest_1.RBAC_FILES, { goModule: config.goModule });
     const migrationsDir = path_1.default.join(projectDir, "migrations");
     fs_extra_1.default.ensureDirSync(migrationsDir);
@@ -58,7 +66,9 @@ async function addRbac(projectDir = process.cwd()) {
     (0, rbac_patcher_1.patchUserDTOForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "dto.go"));
     (0, rbac_patcher_1.patchUserHandlerForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "handler.go"), config.goModule);
     (0, rbac_patcher_1.patchUserErrorsForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "errors.go"));
-    (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "main.go"), config.goModule);
+    (0, golangci_patcher_1.patchGolangciForModule)(path_1.default.join(projectDir, ".golangci.yml"), config.goModule, "role");
+    // projects scaffolded before --store existed are all Redis-backed
+    (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.features.authStore ?? "redis", config.features.worker ?? false);
     (0, rbac_patcher_1.patchCmdSeedForRbac)(path_1.default.join(projectDir, "cmd", "seed", "main.go"), config.goModule);
     patchEnvExample(path_1.default.join(projectDir, ".env.example"));
     let docsMessage = "";
@@ -77,9 +87,16 @@ async function addRbac(projectDir = process.cwd()) {
         docsMessage = "\ndocs: docs/rbac/*.yaml, wired into docs/openapi.yaml";
     }
     (0, template_renderer_1.gofmtTree)(projectDir);
+    (0, gocheck_1.assertStillParses)(projectDir, parsedBefore, "added RBAC");
+    // rbac introduces no new third-party dependency, so unlike add auth/worker
+    // this can hold the stronger line: the project has to still type-check.
+    (0, gocheck_1.assertNoDrift)(projectDir, before, config, {
+        didWhat: "added RBAC",
+        recover: "internal/app/role/ and the rbac patches were left in place — reconcile cmd/api/wiring.go by hand.",
+    });
     (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, rbac: true } });
     console.log(picocolors_1.default.green("\nadded internal/app/role/ and internal/shared/middleware/authz.go"));
-    console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/main.go" + docsMessage);
+    console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/wiring.go" + docsMessage);
     console.log(picocolors_1.default.yellow("\n⚠ AUTO_MIGRATE=true does NOT seed the role/permission data — it only creates the\n" +
         "  tables from the Go structs. The \"staff\"/\"admin\" roles and their permissions live\n" +
         "  in the migration's SQL (INSERT statements), which AutoMigrate never runs. Without\n" +