@nakedev/go-scaffold 0.1.4 → 0.3.1

package/dist/templates/auth-manifest.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_FILES = void 0;
-// output paths are relative to the project root
-exports.AUTH_FILES = [
+exports.authFiles = authFiles;
+// Everything that is the same whichever store backs the tokens.
+const SHARED = [
     { template: "add/auth/internal/shared/middleware/auth.go.hbs", output: "internal/shared/middleware/auth.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit.go.hbs", output: "internal/shared/middleware/ratelimit.go" },
     { template: "add/auth/internal/app/user/model/user.go.hbs", output: "internal/app/user/model/user.go" },
     { template: "add/auth/internal/app/user/model/identity.go.hbs", output: "internal/app/user/model/identity.go" },
+    { template: "add/auth/internal/app/user/model/loginthrottle.go.hbs", output: "internal/app/user/model/loginthrottle.go" },
     { template: "add/auth/internal/app/user/dto.go.hbs", output: "internal/app/user/dto.go" },
     { template: "add/auth/internal/app/user/errors.go.hbs", output: "internal/app/user/errors.go" },
     { template: "add/auth/internal/app/user/jwt.go.hbs", output: "internal/app/user/jwt.go" },
@@ -14,6 +15,22 @@ exports.AUTH_FILES = [
     { template: "add/auth/internal/app/user/repository.go.hbs", output: "internal/app/user/repository.go" },
     { template: "add/auth/internal/app/user/service.go.hbs", output: "internal/app/user/service.go" },
     { template: "add/auth/internal/app/user/service_test.go.hbs", output: "internal/app/user/service_test.go" },
+    { template: "add/auth/internal/app/user/repository_test.go.hbs", output: "internal/app/user/repository_test.go" },
     { template: "add/auth/internal/app/user/handler.go.hbs", output: "internal/app/user/handler.go" },
     { template: "add/auth/cmd/seed/main.go.hbs", output: "cmd/seed/main.go" },
 ];
+// Only the chosen store's implementation is written. Shipping both would drag
+// go-redis into every project's go.mod for a file it never constructs — the
+// same reason `add worker` writes one queue adapter, not two.
+const POSTGRES = [
+    { template: "add/auth/internal/app/user/model/authtoken.go.hbs", output: "internal/app/user/model/authtoken.go" },
+    { template: "add/auth/internal/app/user/tokenstore_pg.go.hbs", output: "internal/app/user/tokenstore_pg.go" },
+    { template: "add/auth/internal/shared/middleware/ratelimit_memory.go.hbs", output: "internal/shared/middleware/ratelimit_memory.go" },
+];
+const REDIS = [
+    { template: "add/auth/internal/app/user/tokenstore_redis.go.hbs", output: "internal/app/user/tokenstore_redis.go" },
+    { template: "add/auth/internal/shared/middleware/ratelimit_redis.go.hbs", output: "internal/shared/middleware/ratelimit_redis.go" },
+];
+function authFiles(store) {
+    return [...SHARED, ...(store === "postgres" ? POSTGRES : REDIS)];
+}

package/dist/templates/create-manifest.js

@@ -4,11 +4,14 @@ exports.CREATE_MANIFEST = void 0;
 exports.CREATE_MANIFEST = [
     { template: "create/base/go.mod.hbs", output: "go.mod" },
     { template: "create/base/.gitignore.hbs", output: ".gitignore" },
+    { template: "create/base/Dockerfile.hbs", output: "Dockerfile" },
+    { template: "create/base/.dockerignore.hbs", output: ".dockerignore" },
     { template: "create/base/.env.example.hbs", output: ".env.example" },
     { template: "create/base/Makefile.hbs", output: "Makefile" },
     { template: "create/base/.golangci.yml.hbs", output: ".golangci.yml" },
     { template: "create/base/.vscode/settings.json.hbs", output: ".vscode/settings.json" },
     { template: "create/base/.github/workflows/ci.yml.hbs", output: ".github/workflows/ci.yml" },
+    { template: "create/base/.github/dependabot.yml.hbs", output: ".github/dependabot.yml" },
     { template: "create/base/README.md.hbs", output: "README.md" },
     { template: "create/base/AGENTS.md.hbs", output: "AGENTS.md" },
     { template: "create/base/CLAUDE.md.hbs", output: "CLAUDE.md" },
@@ -17,6 +20,7 @@ exports.CREATE_MANIFEST = [
         output: ".claude/skills/go-scaffold/SKILL.md",
     },
     { template: "create/base/cmd/api/main.go.hbs", output: "cmd/api/main.go" },
+    { template: "create/base/cmd/api/wiring.go.hbs", output: "cmd/api/wiring.go" },
     {
         template: "create/base/internal/platform/database/database.go.hbs",
         output: "internal/platform/database/database.go",
@@ -45,6 +49,10 @@ exports.CREATE_MANIFEST = [
         template: "create/base/internal/shared/pagination/pagination.go.hbs",
         output: "internal/shared/pagination/pagination.go",
     },
+    {
+        template: "create/base/internal/shared/tx/tx.go.hbs",
+        output: "internal/shared/tx/tx.go",
+    },
     {
         template: "create/base/internal/shared/middleware/cors.go.hbs",
         output: "internal/shared/middleware/cors.go",
@@ -87,6 +95,11 @@ exports.CREATE_MANIFEST = [
         output: "docs/openapi.yaml",
         when: (ctx) => ctx.openapiDocs,
     },
+    {
+        template: "create/base/redocly.yaml.hbs",
+        output: "redocly.yaml",
+        when: (ctx) => ctx.openapiDocs,
+    },
     {
         template: "create/features/docs/common/parameters.yaml.hbs",
         output: "docs/common/parameters.yaml",
@@ -112,24 +125,4 @@ exports.CREATE_MANIFEST = [
         output: "docs/health/health-readyz.yaml",
         when: (ctx) => ctx.openapiDocs,
     },
-    {
-        template: "create/features/docs/observability/metrics.yaml.hbs",
-        output: "docs/observability/metrics.yaml",
-        when: (ctx) => ctx.openapiDocs && ctx.observability,
-    },
-    {
-        template: "create/features/observability/middleware/metrics.go.hbs",
-        output: "internal/shared/middleware/metrics.go",
-        when: (ctx) => ctx.observability,
-    },
-    {
-        template: "create/features/observability/middleware/tracing.go.hbs",
-        output: "internal/shared/middleware/tracing.go",
-        when: (ctx) => ctx.observability,
-    },
-    {
-        template: "create/features/observability/platform/telemetry/tracing.go.hbs",
-        output: "internal/platform/telemetry/tracing.go",
-        when: (ctx) => ctx.observability,
-    },
 ];

package/dist/templates/observability-manifest.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBSERVABILITY_FILES = void 0;
+// output paths are relative to the project root
+exports.OBSERVABILITY_FILES = [
+    {
+        template: "create/features/observability/middleware/metrics.go.hbs",
+        output: "internal/shared/middleware/metrics.go",
+    },
+    {
+        template: "create/features/observability/middleware/tracing.go.hbs",
+        output: "internal/shared/middleware/tracing.go",
+    },
+    {
+        template: "create/features/observability/platform/telemetry/tracing.go.hbs",
+        output: "internal/platform/telemetry/tracing.go",
+    },
+    // only meaningful once there's an openapi.yaml to $ref it from
+    {
+        template: "create/features/docs/observability/metrics.yaml.hbs",
+        output: "docs/observability/metrics.yaml",
+        when: (ctx) => ctx.openapiDocs,
+    },
+];

package/dist/templates/rbac-manifest.js

@@ -11,6 +11,7 @@ exports.RBAC_FILES = [
     { template: "add/rbac/internal/app/role/repository.go.hbs", output: "internal/app/role/repository.go" },
     { template: "add/rbac/internal/app/role/service.go.hbs", output: "internal/app/role/service.go" },
     { template: "add/rbac/internal/app/role/service_test.go.hbs", output: "internal/app/role/service_test.go" },
+    { template: "add/rbac/internal/app/role/repository_test.go.hbs", output: "internal/app/role/repository_test.go" },
     { template: "add/rbac/internal/app/role/handler.go.hbs", output: "internal/app/role/handler.go" },
     { template: "add/rbac/internal/app/role/dto.go.hbs", output: "internal/app/role/dto.go" },
     { template: "add/rbac/internal/app/role/errors.go.hbs", output: "internal/app/role/errors.go" },

package/dist/templates/worker-manifest.js

@@ -1,12 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKER_FILES = void 0;
-// output paths are relative to the project root
-exports.WORKER_FILES = [
-    { template: "add/worker/internal/platform/cache/redis.go.hbs", output: "internal/platform/cache/redis.go" },
-    { template: "add/worker/internal/platform/queue/client.go.hbs", output: "internal/platform/queue/client.go" },
-    { template: "add/worker/internal/platform/queue/server.go.hbs", output: "internal/platform/queue/server.go" },
+exports.MAIL_CLIENT_ONLY = void 0;
+exports.workerFiles = workerFiles;
+// The SMTP client on its own. `add auth` installs just this when the project
+// has no worker: mail/task.go is the piece that knows about the queue, and
+// pulling it in would drag platform/queue along with it.
+exports.MAIL_CLIENT_ONLY = [
     { template: "add/worker/internal/platform/mail/mail.go.hbs", output: "internal/platform/mail/mail.go" },
+];
+const SHARED = [
+    { template: "add/worker/internal/platform/queue/queue.go.hbs", output: "internal/platform/queue/queue.go" },
+    ...exports.MAIL_CLIENT_ONLY,
     { template: "add/worker/internal/platform/mail/task.go.hbs", output: "internal/platform/mail/task.go" },
     { template: "add/worker/cmd/worker/main.go.hbs", output: "cmd/worker/main.go" },
 ];
+// Only the chosen backend's adapter is written: an unused adapter would drag
+// its whole dependency tree into go.mod for nothing. Swapping later means
+// re-running `add worker` with the other backend, or copying the adapter in
+// by hand — the queue.go contract it implements does not change.
+const RIVER = [{ template: "add/worker/internal/platform/queue/river.go.hbs", output: "internal/platform/queue/river.go" }];
+const ASYNQ = [
+    { template: "add/worker/internal/platform/queue/asynq.go.hbs", output: "internal/platform/queue/asynq.go" },
+    // Redis only comes along when it is actually the queue's backing store.
+    { template: "add/worker/internal/platform/cache/redis.go.hbs", output: "internal/platform/cache/redis.go" },
+];
+function workerFiles(backend) {
+    return [...SHARED, ...(backend === "river" ? RIVER : ASYNQ)];
+}

package/dist/utils/auth-patcher.js

@@ -4,7 +4,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patchConfigForAuth = patchConfigForAuth;
+exports.authWiringLines = authWiringLines;
 exports.patchMainGoForAuth = patchMainGoForAuth;
+exports.upgradeMailerToQueue = upgradeMailerToQueue;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const marker_patch_1 = require("./marker-patch");
 const IMPORT_MARKER = "// go-scaffold:imports";
@@ -12,6 +14,7 @@ const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
 const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 const CONFIG_CHECKS_MARKER = "// go-scaffold:config-checks";
 const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
+const SCHEMA_MARKER = "// go-scaffold:schemas";
 const MODEL_MARKER = "// go-scaffold:models";
 const ROUTE_MARKER = "// go-scaffold:routes";
 const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
@@ -26,6 +29,7 @@ function patchConfigForAuth(configGoPath) {
         "JWTAccessTTL time.Duration",
         "JWTRefreshTTL time.Duration",
         "CookieSecure bool",
+        "CookieSameSite string",
         "",
         "PasswordResetTTL time.Duration",
         "PasswordResetURL string",
@@ -37,12 +41,13 @@ function patchConfigForAuth(configGoPath) {
         "GoogleClientSecret string",
         "GoogleRedirectURL string",
     ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "JWTSecret string");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "JWTSecret");
     const loadBlock = [
         'JWTSecret:     env("JWT_SECRET", "dev-secret-change-me"),',
         'JWTAccessTTL:  time.Duration(envInt("JWT_ACCESS_TTL_MIN", 15)) * time.Minute,',
         'JWTRefreshTTL: time.Duration(envInt("JWT_REFRESH_TTL_MIN", 43200)) * time.Minute,',
         'CookieSecure:  env("COOKIE_SECURE", "false") == "true",',
+        'CookieSameSite: env("COOKIE_SAMESITE", "strict"),',
         "",
         'PasswordResetTTL: time.Duration(envInt("PASSWORD_RESET_TTL_MIN", 30)) * time.Minute,',
         'PasswordResetURL: env("PASSWORD_RESET_URL", "http://localhost:3000/reset-password"),',
@@ -54,43 +59,113 @@ function patchConfigForAuth(configGoPath) {
         'GoogleClientSecret: env("GOOGLE_CLIENT_SECRET", ""),',
         'GoogleRedirectURL:  env("GOOGLE_REDIRECT_URL", ""),',
     ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'JWTSecret:     env("JWT_SECRET"');
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'env("JWT_SECRET"');
     fs_extra_1.default.writeFileSync(configGoPath, content);
 }
-// patchMainGoForAuth wires the user domain into cmd/api: its import, a
-// queue.Client (needed for the forgot-password email — cmd/api itself never
-// enqueued anything before this), its two models in the AutoMigrate call, a
-// prod guard against the still-default JWT secret, and its route
-// registration (the domain's own Handler.Register splits /auth public vs
-// /users protected — main.go doesn't need to know that split, same
-// convention as every other module).
-function patchMainGoForAuth(mainGoPath, goModule) {
+// authWiringLines is the single source of truth for the two lines that differ
+// between stores, so patchMainGoForAuth and `add rbac`'s rewrite of the same
+// lines can never drift apart.
+function authWiringLines(w) {
+    const postgres = w.store === "postgres";
+    return {
+        tokenStore: postgres ? "user.NewPgTokenStore(db)" : "user.NewRedisTokenStore(rdb)",
+        limiter: postgres ? "middleware.NewMemoryLimiter()" : "middleware.NewRedisLimiter(rdb)",
+        // with a queue the mail is enqueued and the request returns immediately;
+        // without one it goes out inline, which is the cost of not running a worker
+        mailer: w.worker ? "mail.NewAsyncClient(q)" : "mail.NewSyncClient(mail.Open(cfg))",
+    };
+}
+function patchMainGoForAuth(mainGoPath, w) {
+    const { goModule, queueBackend, store } = w;
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/user"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
     const modelImportLine = `usermodel "${goModule}/internal/app/user/model"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
-    const queueImportLine = `"${goModule}/internal/platform/queue"`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
+    if (w.worker) {
+        const queueImportLine = `"${goModule}/internal/platform/queue"`;
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
+    }
     const mailImportLine = `"${goModule}/internal/platform/mail"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, mailImportLine, mailImportLine);
     const checkBlock = [
         'if cfg.IsProd() && cfg.JWTSecret == "dev-secret-change-me" {',
-        '\tlogger.Error("JWT_SECRET is still the dev default — set a real secret before deploying with APP_ENV=production")',
-        "\tos.Exit(1)",
+        '\treturn errors.New("JWT_SECRET is still the dev default — set a real secret before deploying with APP_ENV=production")',
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, checkBlock, "JWT_SECRET is still the dev default");
-    const queueInitBlock = ["q, err := queue.NewClient(cfg.RedisURL)", "if err != nil {", '\tlogger.Error("open queue", "error", err)', "\tos.Exit(1)", "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.NewClient(cfg.RedisURL)");
-    const migrateLine1 = "&usermodel.User{},";
-    const migrateLine2 = "&usermodel.Identity{},";
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, migrateLine1, migrateLine1);
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, migrateLine2, migrateLine2);
-    const routeLine = "user.NewHandler(user.NewService(user.NewRepository(db), user.NewRedisTokenStore(rdb), mail.NewAsyncClient(q), cfg), cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, rdb).Register(api)";
+    // Without SMTP the mail client logs the message instead of sending it — a
+    // deliberate dev convenience that in production means password-reset and
+    // email-verification links land in the log aggregator while
+    // /auth/forgot-password still answers 200, so nobody finds out the mail
+    // never went anywhere.
+    const smtpCheckBlock = [
+        'if cfg.IsProd() && cfg.SMTPHost == "" {',
+        '\treturn errors.New("SMTP_HOST is unset — password reset and email verification links would be written to the log instead of sent")',
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, smtpCheckBlock, "SMTP_HOST is unset");
+    // The enqueuer is built from whatever backend `add worker` chose — the
+    // constructor differs, everything downstream of it (mail.NewAsyncClient)
+    // only sees the queue.Enqueuer interface and doesn't change.
+    if (w.worker) {
+        const queueCtor = queueBackend === "river" ? "queue.NewRiverEnqueuer(db)" : "queue.NewAsynqEnqueuer(cfg.RedisURL)";
+        const queueInitBlock = [`q, err := ${queueCtor}`, "if err != nil {", '\treturn fmt.Errorf("open queue: %w", err)', "}"].join("\n");
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.New");
+    }
+    const schemaBlock = [
+        'if err := db.Exec("CREATE SCHEMA IF NOT EXISTS user_svc").Error; err != nil {',
+        '\treturn fmt.Errorf("create schema user_svc: %w", err)',
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS user_svc");
+    const migrateLines = ["&usermodel.User{},", "&usermodel.Identity{},", "&usermodel.LoginThrottle{},"];
+    // only the Postgres store has a table for AutoMigrate to create
+    if (store === "postgres")
+        migrateLines.push("&usermodel.AuthToken{},");
+    for (const line of migrateLines) {
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, line, line);
+    }
+    // same two-line shape every generated module uses: a named service, then
+    // the handler that registers it. `add rbac` extends both lines later, and a
+    // human wiring another domain into user's service edits line one in place.
+    const { tokenStore, limiter, mailer } = authWiringLines(w);
+    const svcLine = `userSvc := user.NewService(user.NewRepository(db), ${tokenStore}, ${mailer}, cfg)`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, svcLine, "userSvc :=");
+    const routeLine = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${limiter}).Register(api)`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, routeLine, routeLine);
     content = content.replace(/\n\t_ = api \/\/ dropped once `generate module` registers the first route\n/, "\n");
+    if (w.worker) {
+        const shutdownBlock = ["if err := q.Close(); err != nil {", '\tlogger.Error("close queue", "error", err)', "}"].join("\n");
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := q.Close()");
+    }
+    fs_extra_1.default.writeFileSync(mainGoPath, content);
+}
+// upgradeMailerToQueue is `add worker` arriving after `add auth`. Auth wired a
+// synchronous mailer because there was no queue at the time; now there is one,
+// so the enqueuer gets built and the mailer swapped for the async client.
+//
+// Without this the printed "run `add worker` later to move it onto the queue"
+// would be a lie, and the project would keep blocking on SMTP with a perfectly
+// good queue sitting next to it.
+//
+// No-op on a project whose auth already had a worker, and on one with no auth
+// at all — both simply don't contain the line it looks for. Returns whether
+// it actually upgraded something, so the caller's printed summary can say
+// which happened instead of always assuming "no auth yet".
+function upgradeMailerToQueue(mainGoPath, goModule, queueBackend) {
+    let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
+    const syncMailer = "mail.NewSyncClient(mail.Open(cfg))";
+    if (!content.includes(syncMailer))
+        return false;
+    const queueImportLine = `"${goModule}/internal/platform/queue"`;
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
+    const queueCtor = queueBackend === "river" ? "queue.NewRiverEnqueuer(db)" : "queue.NewAsynqEnqueuer(cfg.RedisURL)";
+    const queueInitBlock = [`q, err := ${queueCtor}`, "if err != nil {", '\treturn fmt.Errorf("open queue: %w", err)', "}"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.New");
     const shutdownBlock = ["if err := q.Close(); err != nil {", '\tlogger.Error("close queue", "error", err)', "}"].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := q.Close()");
+    content = content.replace(syncMailer, () => "mail.NewAsyncClient(q)");
     fs_extra_1.default.writeFileSync(mainGoPath, content);
+    return true;
 }

package/dist/utils/config.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.configPath = configPath;
 exports.writeConfig = writeConfig;
 exports.readConfig = readConfig;
+exports.isProjectDir = isProjectDir;
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const CONFIG_FILE = "go-scaffold.config.json";
@@ -26,28 +27,75 @@ function readConfig(projectDir) {
 }
 function detectConfig(projectDir) {
     const goModPath = path_1.default.join(projectDir, "go.mod");
+    const mainGoPath = path_1.default.join(projectDir, "cmd", "api", "main.go");
     if (!fs_extra_1.default.existsSync(goModPath)) {
         throw new Error(`no ${CONFIG_FILE} and no go.mod found in ${projectDir} — run this inside a go-scaffold project`);
     }
+    // go.mod alone is just "some Go module". Without cmd/api/main.go there is
+    // nothing to wire a module into, and every command would write its files
+    // first and only then die on a missing main.go — a half-scaffolded
+    // directory the user has to clean up by hand.
+    if (!fs_extra_1.default.existsSync(mainGoPath)) {
+        throw new Error(`${projectDir} has a go.mod but no cmd/api/main.go — this looks like a plain Go module, not a go-scaffold project.\n` +
+            `Run \`go-scaffold create <name>\` to start one.`);
+    }
     const goMod = fs_extra_1.default.readFileSync(goModPath, "utf8");
     const moduleMatch = goMod.match(/^module\s+(\S+)/m);
     const goModule = moduleMatch ? moduleMatch[1] : path_1.default.basename(projectDir);
-    // parse the chosen prefix back out of `api := r.Group("/v1")` in main.go;
-    // an empty group (`r.Group("")`) or no match at all means no prefix.
+    // parse the chosen prefix back out of `api := r.Group("/v1")`; an empty
+    // group (`r.Group("")`) or no match at all means no prefix.
+    //
+    // Read from cmd/api/wiring.go where the composition root lives now, falling
+    // back to main.go for projects scaffolded before it was split out — this is
+    // the config-less path, so it is exactly the old projects that reach it.
+    const wiringGoPath = path_1.default.join(projectDir, "cmd", "api", "wiring.go");
+    const compositionRoot = fs_extra_1.default.existsSync(wiringGoPath) ? wiringGoPath : mainGoPath;
     let apiPrefix = "";
-    const mainGoPath = path_1.default.join(projectDir, "cmd", "api", "main.go");
-    if (fs_extra_1.default.existsSync(mainGoPath)) {
-        const groupMatch = fs_extra_1.default.readFileSync(mainGoPath, "utf8").match(/api\s*:=\s*r\.Group\("\/?([a-z0-9/]*)"\)/);
-        if (groupMatch)
-            apiPrefix = groupMatch[1];
-    }
+    const groupMatch = fs_extra_1.default.readFileSync(compositionRoot, "utf8").match(/api\s*:=\s*r\.Group\("\/?([a-z0-9/]*)"\)/);
+    if (groupMatch)
+        apiPrefix = groupMatch[1];
+    // Every feature is detectable from the tree each `add` command creates, so
+    // detect them all rather than reporting only docker/openapi. Leaving the
+    // rest undefined made a config-less project a dead end: `add auth` refused
+    // ("needs add worker first") while `add worker` also refused ("queue
+    // already exists"), with no way out. Worse, the first `add` to succeed then
+    // wrote a config that recorded the undetected features as absent.
+    const has = (...segments) => fs_extra_1.default.existsSync(path_1.default.join(projectDir, ...segments));
+    const worker = has("internal", "platform", "queue");
     return {
         projectName: path_1.default.basename(projectDir),
         goModule,
         apiPrefix,
         features: {
-            docker: fs_extra_1.default.existsSync(path_1.default.join(projectDir, "docker-compose.yml")),
-            openapiDocs: fs_extra_1.default.existsSync(path_1.default.join(projectDir, "docs", "openapi.yaml")),
+            docker: has("docker-compose.yml"),
+            openapiDocs: has("docs", "openapi.yaml"),
+            worker,
+            // which adapter file is present is what `add worker --queue` decided
+            queue: !worker ? undefined : has("internal", "platform", "queue", "asynq.go") ? "asynq" : "river",
+            auth: has("internal", "app", "user"),
+            // which store `add auth` chose is readable from which implementation
+            // file it wrote — same trick as the queue adapter above. Projects from
+            // before the option existed have neither name and read as "redis",
+            // which is what they in fact are.
+            authStore: !has("internal", "app", "user")
+                ? undefined
+                : has("internal", "app", "user", "tokenstore_pg.go")
+                    ? "postgres"
+                    : "redis",
+            rbac: has("internal", "app", "role"),
+            observability: has("internal", "platform", "telemetry"),
         },
     };
 }
+// isProjectDir answers "would readConfig succeed here?" without throwing, so
+// the top-level menu can offer only what can actually run in this directory
+// instead of asking two questions and then failing.
+function isProjectDir(projectDir) {
+    try {
+        readConfig(projectDir);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/utils/gocheck.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.typeChecks = typeChecks;
+exports.parseChecks = parseChecks;
+exports.assertStillParses = assertStillParses;
 exports.assertNoDrift = assertNoDrift;
 const child_process_1 = require("child_process");
 const picocolors_1 = __importDefault(require("picocolors"));
@@ -32,6 +34,44 @@ function typeChecks(projectRoot) {
         return { ok: false, output: `${e.stderr?.toString() ?? ""}${e.stdout?.toString() ?? ""}`.trim() };
     }
 }
+// parseChecks asks the weaker question typeChecks can't: does every .go file
+// in the tree still *parse*? gofmt only reads files, so this works before
+// `go mod tidy` has resolved a new feature's third-party imports — which is
+// precisely when `add auth`/`add worker`/`add observability` do their most
+// invasive patching and when `go vet` is guaranteed to fail for reasons that
+// have nothing to do with us.
+function parseChecks(projectRoot) {
+    try {
+        (0, child_process_1.execFileSync)("gofmt", ["-l", "-e", "."], { cwd: projectRoot, stdio: ["ignore", "pipe", "pipe"] });
+        return { ok: true, output: "" };
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT")
+            return null; // no Go toolchain — can't conclude anything
+        return { ok: false, output: `${e.stderr?.toString() ?? ""}`.trim() };
+    }
+}
+// assertStillParses is the before/after pair for a command that patches files
+// rather than only adding them. A marker patch that lands in the wrong place
+// produces Go that doesn't parse, and without this the command goes on to
+// print success over it — gofmt's own failure used to be swallowed whole.
+//
+// Same "only blame yourself for a passed → broken transition" rule as
+// assertNoDrift: a project that already had an unparseable file (mid-edit, a
+// scratch file) is not this command's problem.
+function assertStillParses(projectRoot, before, didWhat) {
+    if (before === null || !before.ok)
+        return;
+    const after = parseChecks(projectRoot);
+    if (after === null || after.ok)
+        return;
+    throw new Error(`${picocolors_1.default.red(`${didWhat}, but the result is not valid Go — a patch landed somewhere it doesn't fit.`)}\n\n` +
+        `${picocolors_1.default.dim("gofmt says:")}\n${after.output}\n\n` +
+        `The files were left as-is so you can see the damage. Most likely one of the files this\n` +
+        `command patches was hand-edited away from the shape it was generated in. Please report\n` +
+        `this if that isn't the case — the CLI should never write Go that doesn't parse.`);
+}
 // assertNoDrift is the second half of a before/after pair: given what
 // typeChecks said *before* the files were written, it re-checks and fails
 // loudly if generating is what broke the project.
@@ -46,20 +86,32 @@ function typeChecks(projectRoot) {
 // is normal, expected work — the generated code stops compiling against it.
 // Without this check that lands as a mystery build error some time later, in
 // files the user never wrote.
-function assertNoDrift(projectRoot, before, config) {
+function assertNoDrift(projectRoot, before, config, 
+// What the command did, for commands that patch rather than generate
+// (`add rbac`, `undo module`). Their failure isn't template drift, it's a
+// marker patch that landed against a main.go it didn't recognise.
+patched) {
     if (before === null || !before.ok)
         return; // no Go here, or already broken — not ours to judge
     const after = typeChecks(projectRoot);
     if (after === null || after.ok)
         return;
     const scaffoldedWith = config.scaffoldVersion ?? "unknown (predates version stamping)";
+    const versions = `  scaffolded with: go-scaffold ${scaffoldedWith}\n` +
+        `  this CLI:        go-scaffold ${(0, version_1.cliVersion)()}\n\n` +
+        `${picocolors_1.default.dim("go vet ./... says:")}\n${after.output}`;
+    if (patched) {
+        throw new Error(`${picocolors_1.default.red(`${patched.didWhat}, but the project no longer compiles.`)}\n\n` +
+            `This command patches existing files at marker comments. If those files were\n` +
+            `hand-edited — or were written by a different CLI version — a patch can land\n` +
+            `somewhere it doesn't fit, and the result only shows up as a build error.\n\n` +
+            `${versions}\n\n${patched.recover}`);
+    }
     throw new Error(`${picocolors_1.default.red("the generated code doesn't compile, but this project was fine a moment ago.")}\n\n` +
         `The most likely cause is drift: this project's internal/shared layer has been edited\n` +
         `since it was scaffolded, so the templates this CLI emits no longer match it.\n\n` +
-        `  scaffolded with: go-scaffold ${scaffoldedWith}\n` +
-        `  this CLI:        go-scaffold ${(0, version_1.cliVersion)()}\n\n` +
-        `${picocolors_1.default.dim("go vet ./... says:")}\n${after.output}\n\n` +
+        `${versions}\n\n` +
         `The generated files were left in place — reconcile them with your shared/ layer by\n` +
-        `hand, or undo (\`go-scaffold remove module <name>\` for a module) and generate again\n` +
+        `hand, or undo (\`go-scaffold undo module <name>\` for a module) and generate again\n` +
         `with a CLI version that matches this project.`);
 }

package/dist/utils/golangci-patcher.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.patchGolangciForModule = patchGolangciForModule;
+exports.unpatchGolangciForModule = unpatchGolangciForModule;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const marker_patch_1 = require("./marker-patch");
+const DEPGUARD_MARKER = "# go-scaffold:depguard-rules";
+function ruleName(pkg) {
+    return `domain-isolation-${pkg}`;
+}
+// depguardRule is the per-domain boundary rule. It has to be per-domain
+// because depguard matches import paths as static prefixes with no idea which
+// domain a file belongs to: a single `deny: internal/app` rule would also
+// reject `order` importing its own `order/model`. Scoping with `files:` and
+// allowing exactly this domain's own path gives "may import myself, may not
+// import a sibling".
+//
+// Written with no leading indentation — insertBeforeMarker re-indents the
+// whole block to match the marker's own column.
+function depguardRule(goModule, pkg) {
+    return [
+        `${ruleName(pkg)}:`,
+        `  list-mode: lax`,
+        `  files:`,
+        `    - "**/internal/app/${pkg}/**"`,
+        `  allow:`,
+        `    - "${goModule}/internal/app/${pkg}"`,
+        `  deny:`,
+        `    - pkg: "${goModule}/internal/app"`,
+        `      desc: >-`,
+        `        a domain must not import another domain directly — declare a`,
+        `        consumer-side interface for what you need and let`,
+        `        cmd/api/wiring.go wire the concrete service in`,
+        `        (docs/architect/patterns.md)`,
+    ].join("\n");
+}
+// patchGolangciForModule adds this domain's boundary rule. No-op on a project
+// whose .golangci.yml predates the marker (or was replaced wholesale) — a
+// missing lint rule must never fail code generation.
+function patchGolangciForModule(golangciPath, goModule, pkg) {
+    if (!fs_extra_1.default.existsSync(golangciPath))
+        return;
+    const content = fs_extra_1.default.readFileSync(golangciPath, "utf8");
+    if (!content.includes(DEPGUARD_MARKER))
+        return;
+    fs_extra_1.default.writeFileSync(golangciPath, (0, marker_patch_1.insertBeforeMarkerOnce)(content, DEPGUARD_MARKER, depguardRule(goModule, pkg), `${ruleName(pkg)}:`));
+}
+// unpatchGolangciForModule drops the rule again, matched by its heading and
+// everything indented under it — the inverse of patchGolangciForModule.
+function unpatchGolangciForModule(golangciPath, pkg) {
+    if (!fs_extra_1.default.existsSync(golangciPath))
+        return;
+    const lines = fs_extra_1.default.readFileSync(golangciPath, "utf8").split("\n");
+    const heading = `${ruleName(pkg)}:`;
+    const start = lines.findIndex((l) => l.trim() === heading);
+    if (start === -1)
+        return;
+    const indent = lines[start].length - lines[start].trimStart().length;
+    let end = start + 1;
+    while (end < lines.length) {
+        const line = lines[end];
+        // blank lines belong to the block only if something indented follows
+        const deeper = line.trim() === "" || line.length - line.trimStart().length > indent;
+        if (!deeper)
+            break;
+        end++;
+    }
+    lines.splice(start, end - start);
+    fs_extra_1.default.writeFileSync(golangciPath, lines.join("\n"));
+}