@nakedev/go-scaffold 0.4.3 → 0.5.0

package/dist/commands/rbac.js

@@ -15,6 +15,7 @@ const rbac_patcher_1 = require("../utils/rbac-patcher");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
 const golangci_patcher_1 = require("../utils/golangci-patcher");
 const gocheck_1 = require("../utils/gocheck");
+const docs_patcher_1 = require("../utils/docs-patcher");
 // URL (relative to the api prefix) -> docs file (relative to docs/) for every
 // route `add rbac` registers or adds onto the user handler.
 const RBAC_OPENAPI_PATHS = [
@@ -58,14 +59,14 @@ async function addRbac(projectDir = process.cwd()) {
         { template: "add/rbac/migrations/add_roles.down.sql.hbs", output: path_1.default.join("migrations", `${version}_add_roles.down.sql`) },
     ], {});
     (0, rbac_patcher_1.patchConfigForRbac)(path_1.default.join(projectDir, "internal", "shared", "config", "config.go"));
-    (0, rbac_patcher_1.patchUserModelForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "model", "user.go"));
+    (0, rbac_patcher_1.patchUserModelForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "adapters", "outbound", "postgres", "model.go"));
     (0, rbac_patcher_1.patchMiddlewareAuthForRbac)(path_1.default.join(projectDir, "internal", "shared", "middleware", "auth.go"));
-    (0, rbac_patcher_1.patchUserJWTForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "jwt.go"));
-    (0, rbac_patcher_1.patchUserServiceForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "service.go"), config.goModule, path_1.default.join(projectDir, "internal", "app", "user", "sessions.go"));
-    (0, rbac_patcher_1.patchUserServiceTestForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "service_test.go"));
-    (0, rbac_patcher_1.patchUserDTOForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "dto.go"));
-    (0, rbac_patcher_1.patchUserHandlerForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "handler.go"), config.goModule);
-    (0, rbac_patcher_1.patchUserErrorsForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "errors.go"));
+    (0, rbac_patcher_1.patchUserJWTForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "application", "jwt.go"));
+    (0, rbac_patcher_1.patchUserServiceForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "application", "service.go"), path_1.default.join(projectDir, "internal", "app", "user", "application", "sessions.go"));
+    (0, rbac_patcher_1.patchUserServiceTestForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "application", "service_test.go"));
+    (0, rbac_patcher_1.patchUserDTOForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "adapters", "inbound", "http", "dto.go"));
+    (0, rbac_patcher_1.patchUserHandlerForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "adapters", "inbound", "http", "handler.go"));
+    (0, rbac_patcher_1.patchUserErrorsForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "application", "errors.go"));
     (0, golangci_patcher_1.patchGolangciForModule)(path_1.default.join(projectDir, ".golangci.yml"), config.goModule, "role");
     // projects scaffolded before --store existed are all Redis-backed
     (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.features.authStore ?? "redis", config.features.worker ?? false);
@@ -94,9 +95,19 @@ async function addRbac(projectDir = process.cwd()) {
         didWhat: "added RBAC",
         recover: "internal/app/role/ and the rbac patches were left in place — reconcile cmd/api/wiring.go by hand.",
     });
-    (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, rbac: true } });
+    const staleDocs = (0, docs_patcher_1.refreshProjectDocs)(projectDir, config, { rbac: true });
+    (0, config_1.writeConfig)(projectDir, {
+        ...config,
+        features: { ...config.features, rbac: true },
+        modules: {
+            ...config.modules,
+            role: { surface: "crud", applicationStyle: "service", boundary: "hexagonal", packageLayout: "split" },
+        },
+    });
     console.log(picocolors_1.default.green("\nadded internal/app/role/ and internal/shared/middleware/authz.go"));
     console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/wiring.go" + docsMessage);
+    if (staleDocs.length)
+        console.log(picocolors_1.default.yellow((0, docs_patcher_1.docsRefreshWarning)(staleDocs, "add rbac")));
     console.log(picocolors_1.default.yellow("\n⚠ The development table bootstrap does NOT seed role/permission data — it only creates the\n" +
         "  tables from the Go structs. The \"staff\"/\"admin\" roles and their permissions live\n" +
         "  in the migration's SQL (INSERT statements), which table creation never runs. Without\n" +

package/dist/commands/undo.js

@@ -69,13 +69,16 @@ async function undoModule(rawName, opts, projectDir = process.cwd()) {
         if (!ok)
             throw new Error("undo cancelled");
     }
-    // detect --auth/--permission from the generated handler.go itself (not
+    // detect --auth/--permission from the generated handler itself (not
     // stored anywhere else) — unpatchMainGo needs the exact same flags used at
     // generate-time to reconstruct the identical line it's removing.
-    const handlerGoPath = path_1.default.join(moduleDir, "handler.go");
+    const handlerCandidates = [
+        path_1.default.join(moduleDir, "adapters", "inbound", "http", "handler.go"),
+    ];
+    const handlerGoPath = handlerCandidates.find((candidate) => fs_extra_1.default.existsSync(candidate));
     let auth;
     let permission;
-    if (fs_extra_1.default.existsSync(handlerGoPath)) {
+    if (handlerGoPath) {
         const handlerContent = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
         auth = /jwtSecret\s+string/.test(handlerContent);
         permission = handlerContent.match(/h\.authz\.Require\("([^"]+)"\)/)?.[1];

package/dist/commands/worker.js

@@ -14,6 +14,7 @@ const platform_patcher_1 = require("../utils/platform-patcher");
 const gocheck_1 = require("../utils/gocheck");
 const gomod_patcher_1 = require("../utils/gomod-patcher");
 const auth_patcher_1 = require("../utils/auth-patcher");
+const docs_patcher_1 = require("../utils/docs-patcher");
 // addWorker scaffolds async job processing: the backend-neutral queue
 // contract (platform/queue), one adapter for the chosen backing store, SMTP
 // mail (platform/mail, with an email:send job as the one thing a fresh
@@ -35,6 +36,9 @@ async function addWorker(backend, projectDir = process.cwd()) {
         (0, platform_patcher_1.patchComposeForRedis)(path_1.default.join(projectDir, "docker-compose.yml"));
         (0, platform_patcher_1.patchCiForRedis)(path_1.default.join(projectDir, ".github", "workflows", "ci.yml"));
     }
+    else {
+        (0, platform_patcher_1.patchCiForRiver)(path_1.default.join(projectDir, ".github", "workflows", "ci.yml"));
+    }
     // pinned to what this scaffold was written against — see gomod-patcher
     (0, gomod_patcher_1.patchGoModRequires)(path_1.default.join(projectDir, "go.mod"), riverQueue
         ? ["github.com/riverqueue/river v0.43.0", "github.com/riverqueue/river/riverdriver/riverdatabasesql v0.43.0"]
@@ -48,6 +52,7 @@ async function addWorker(backend, projectDir = process.cwd()) {
     // parse-only: river/asynq aren't in go.mod until the user runs `go mod
     // tidy`, so `go vet` can't be the gate here.
     (0, gocheck_1.assertStillParses)(projectDir, parsedBefore, `added worker (${backend})`);
+    const staleDocs = (0, docs_patcher_1.refreshProjectDocs)(projectDir, config, { worker: true, queue: backend });
     (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, worker: true, queue: backend } });
     console.log(picocolors_1.default.green(`\nadded internal/platform/{queue,mail}/ and cmd/worker/ (queue backend: ${backend})`));
     if (riverQueue) {
@@ -61,6 +66,8 @@ async function addWorker(backend, projectDir = process.cwd()) {
         console.log(picocolors_1.default.yellow("note: a Redis enqueue cannot join a database transaction — see the warning on queue.Asynq"));
         console.log(picocolors_1.default.dim("\nnext: make worker (separate terminal, or `make dev` runs both), then go build ./... to confirm"));
     }
+    if (staleDocs.length)
+        console.log(picocolors_1.default.yellow((0, docs_patcher_1.docsRefreshWarning)(staleDocs, "add worker")));
 }
 // needsSmtp and needsRedis are checked independently: `add auth` run without
 // a worker already writes SMTP_HOST on its own (auth stands alone — see
@@ -105,15 +112,18 @@ function patchMakefile(makefilePath, opts) {
         console.error(picocolors_1.default.yellow(`skipped the Makefile \`dev\`/\`worker\` targets — no \`build:\` target to anchor them to in ${makefilePath}.\nAdd them by hand: \`worker:\` running \`go run ./cmd/worker\`.`));
         return;
     }
-    content = content.replace(/^\.PHONY: /m, `.PHONY: dev worker${opts.river ? " river-migrate" : ""} `);
+    content = content.replace(/^\.PHONY: /m, `.PHONY: dev worker${opts.river ? " river-migrate river-migrate-test" : ""} `);
     // River keeps its own tables, versioned by River itself rather than by this
-    // project's migrations/ directory — run its CLI once per database. Pinned
-    // by nothing on purpose: it is a one-shot setup command, not a build input.
+    // project's migrations/ directory — run its pinned CLI once per database.
     const riverTarget = opts.river
         ? "\n# create River's job tables (run once per database, and after upgrading River)\n" +
             "river-migrate:\n" +
             "\t@set -a; [ -f $(ENV_FILE) ] && . ./$(ENV_FILE); set +a; \\\n" +
-            '\tgo run github.com/riverqueue/river/cmd/river@latest migrate-up --line main --database-url "$$DB_DSN"\n'
+            '\tgo run github.com/riverqueue/river/cmd/river@v0.43.0 migrate-up --line main --database-url "$$DB_DSN"\n' +
+            "\n# apply River's own schema to TEST_DB_DSN for the real worker test\n" +
+            "river-migrate-test:\n" +
+            "\t@set -a; [ -f $(ENV_FILE) ] && . ./$(ENV_FILE); set +a; \\\n" +
+            '\tgo run github.com/riverqueue/river/cmd/river@v0.43.0 migrate-up --line main --database-url "$$TEST_DB_DSN"\n'
         : "";
     // Both load config exactly the way Makefile.hbs says every target does:
     // via $(ENV_FILE), and through the same sed that strips trailing comments.

package/dist/index.js

@@ -21,6 +21,7 @@ const worker_wizard_1 = require("./prompts/worker-wizard");
 const auth_wizard_1 = require("./prompts/auth-wizard");
 const generate_wizard_1 = require("./prompts/generate-wizard");
 const config_1 = require("./commands/config");
+const check_1 = require("./commands/check");
 const config_2 = require("./utils/config");
 const module_profile_1 = require("./utils/module-profile");
 // fail is every command's catch: one place so the two non-obvious cases stay
@@ -43,8 +44,19 @@ const program = new commander_1.Command();
 program
     .name("go-scaffold")
     .description("Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard\n\n" +
-    "Run `go-scaffold` with no arguments to pick what to do from a menu. Interactive commands ask for values you omit; read-only commands (`config show`, `config validate`) print or check state without prompts.")
+    "Run `go-scaffold` with no arguments to pick what to do from a menu. Interactive commands ask for values you omit; read-only commands (`check`, `config show`, `config validate`) print or check state without prompts.")
     .version((0, version_1.cliVersion)());
+program
+    .command("check")
+    .description("validate the hexagonal split layout, process composition boundary, layer dependencies, and service/CQRS contract")
+    .action(() => {
+    try {
+        (0, check_1.checkProject)();
+    }
+    catch (err) {
+        fail(err);
+    }
+});
 program
     .command("create [name]")
     .alias("c")

package/dist/templates/auth-manifest.js

@@ -1,64 +1,65 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authFiles = authFiles;
-// Everything that is the same whichever store backs the tokens.
+// Auth is a complete hexagonal feature. The application package owns use
+// cases and contracts, inbound owns Gin/HTTP translation, and outbound owns
+// GORM/Redis details. The manifest is intentionally explicit: adding auth
+// must create one canonical implementation tree.
 const SHARED = [
     { template: "add/auth/internal/shared/middleware/auth.go.hbs", output: "internal/shared/middleware/auth.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit.go.hbs", output: "internal/shared/middleware/ratelimit.go" },
-    { template: "add/auth/internal/app/user/model/user.go.hbs", output: "internal/app/user/model/user.go" },
-    { template: "add/auth/internal/app/user/model/identity.go.hbs", output: "internal/app/user/model/identity.go" },
-    { template: "add/auth/internal/app/user/model/loginthrottle.go.hbs", output: "internal/app/user/model/loginthrottle.go" },
-    { template: "add/auth/internal/app/user/model/authtoken.go.hbs", output: "internal/app/user/model/authtoken.go" },
-    { template: "add/auth/internal/app/user/model/mfa_enrollment.go.hbs", output: "internal/app/user/model/mfa_enrollment.go" },
-    { template: "add/auth/internal/app/user/model/mfa_challenge.go.hbs", output: "internal/app/user/model/mfa_challenge.go" },
-    { template: "add/auth/internal/app/user/model/mfa_recovery_code.go.hbs", output: "internal/app/user/model/mfa_recovery_code.go" },
-    { template: "add/auth/internal/app/user/application/recovery.go.hbs", output: "internal/app/user/application/recovery.go" },
+    { template: "add/auth/internal/app/user/domain/entity.go.hbs", output: "internal/app/user/domain/entity.go" },
+    { template: "add/auth/internal/app/user/domain/errors.go.hbs", output: "internal/app/user/domain/errors.go" },
+    { template: "add/auth/internal/app/user/ports/repository.go.hbs", output: "internal/app/user/ports/repository.go" },
+    { template: "add/auth/internal/app/user/ports/password.go.hbs", output: "internal/app/user/ports/password.go" },
+    { template: "add/auth/internal/app/user/application/contracts.go.hbs", output: "internal/app/user/application/contracts.go" },
+    { template: "add/auth/internal/app/user/application/dto.go.hbs", output: "internal/app/user/application/dto.go" },
+    { template: "add/auth/internal/app/user/application/errors.go.hbs", output: "internal/app/user/application/errors.go" },
+    { template: "add/auth/internal/app/user/application/external_login.go.hbs", output: "internal/app/user/application/external_login.go" },
+    { template: "add/auth/internal/app/user/application/jwt.go.hbs", output: "internal/app/user/application/jwt.go" },
+    { template: "add/auth/internal/app/user/application/local_auth.go.hbs", output: "internal/app/user/application/local_auth.go" },
+    { template: "add/auth/internal/app/user/application/mfa_service.go.hbs", output: "internal/app/user/application/mfa_service.go" },
+    { template: "add/auth/internal/app/user/application/mfa_service_test.go.hbs", output: "internal/app/user/application/mfa_service_test.go" },
     { template: "add/auth/internal/app/user/application/oauth.go.hbs", output: "internal/app/user/application/oauth.go" },
-    { template: "add/auth/internal/app/user/contracts.go.hbs", output: "internal/app/user/contracts.go" },
+    { template: "add/auth/internal/app/user/application/provider_test.go.hbs", output: "internal/app/user/application/provider_test.go" },
+    { template: "add/auth/internal/app/user/application/recovery.go.hbs", output: "internal/app/user/application/recovery.go" },
+    { template: "add/auth/internal/app/user/application/recovery_service.go.hbs", output: "internal/app/user/application/recovery_service.go" },
+    { template: "add/auth/internal/app/user/application/service.go.hbs", output: "internal/app/user/application/service.go" },
+    { template: "add/auth/internal/app/user/application/service_test.go.hbs", output: "internal/app/user/application/service_test.go" },
+    { template: "add/auth/internal/app/user/application/sessions.go.hbs", output: "internal/app/user/application/sessions.go" },
+    { template: "add/auth/internal/app/user/application/tokenstore_ports.go.hbs", output: "internal/app/user/application/tokenstore_ports.go" },
+    { template: "add/auth/internal/app/user/application/user_query.go.hbs", output: "internal/app/user/application/user_query.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/browser_policy.go.hbs", output: "internal/app/user/adapters/inbound/http/browser_policy.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/dto.go.hbs", output: "internal/app/user/adapters/inbound/http/dto.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler.go.hbs", output: "internal/app/user/adapters/inbound/http/handler.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_local.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_local.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_mfa.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_mfa.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_oauth.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_oauth.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_recovery.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_recovery.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_test.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_test.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_user.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_user.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/session_cookie.go.hbs", output: "internal/app/user/adapters/inbound/http/session_cookie.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/password/bcrypt.go.hbs", output: "internal/app/user/adapters/outbound/password/bcrypt.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/password/bcrypt_test.go.hbs", output: "internal/app/user/adapters/outbound/password/bcrypt_test.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/model.go.hbs", output: "internal/app/user/adapters/outbound/postgres/model.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/mfa_store.go.hbs", output: "internal/app/user/adapters/outbound/postgres/mfa_store.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/mfa_store_test.go.hbs", output: "internal/app/user/adapters/outbound/postgres/mfa_store_test.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/repository.go.hbs", output: "internal/app/user/adapters/outbound/postgres/repository.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/repository_test.go.hbs", output: "internal/app/user/adapters/outbound/postgres/repository_test.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/tokenstore_recovery.go.hbs", output: "internal/app/user/adapters/outbound/postgres/tokenstore_recovery.go" },
     { template: "add/auth/internal/app/user/composition.go.hbs", output: "internal/app/user/composition.go" },
-    { template: "add/auth/internal/app/user/provider_test.go.hbs", output: "internal/app/user/provider_test.go" },
-    { template: "add/auth/internal/app/user/handler_test.go.hbs", output: "internal/app/user/handler_test.go" },
-    { template: "add/auth/internal/app/user/tokenstore_recovery.go.hbs", output: "internal/app/user/tokenstore_recovery.go" },
-    { template: "add/auth/internal/app/user/dto.go.hbs", output: "internal/app/user/dto.go" },
-    { template: "add/auth/internal/app/user/errors.go.hbs", output: "internal/app/user/errors.go" },
-    { template: "add/auth/internal/app/user/jwt.go.hbs", output: "internal/app/user/jwt.go" },
-    { template: "add/auth/internal/app/user/tokenstore.go.hbs", output: "internal/app/user/tokenstore.go" },
-    { template: "add/auth/internal/app/user/mfa_store.go.hbs", output: "internal/app/user/mfa_store.go" },
-    { template: "add/auth/internal/app/user/mfa_store_test.go.hbs", output: "internal/app/user/mfa_store_test.go" },
-    { template: "add/auth/internal/app/user/mfa_service.go.hbs", output: "internal/app/user/mfa_service.go" },
-    { template: "add/auth/internal/app/user/mfa_service_test.go.hbs", output: "internal/app/user/mfa_service_test.go" },
-    { template: "add/auth/internal/app/user/repository.go.hbs", output: "internal/app/user/repository.go" },
-    { template: "add/auth/internal/app/user/service.go.hbs", output: "internal/app/user/service.go" },
-    { template: "add/auth/internal/app/user/local_auth.go.hbs", output: "internal/app/user/local_auth.go" },
-    { template: "add/auth/internal/app/user/sessions.go.hbs", output: "internal/app/user/sessions.go" },
-    { template: "add/auth/internal/app/user/recovery_service.go.hbs", output: "internal/app/user/recovery_service.go" },
-    { template: "add/auth/internal/app/user/external_login.go.hbs", output: "internal/app/user/external_login.go" },
-    { template: "add/auth/internal/app/user/user_query.go.hbs", output: "internal/app/user/user_query.go" },
-    { template: "add/auth/internal/app/user/service_test.go.hbs", output: "internal/app/user/service_test.go" },
-    { template: "add/auth/internal/app/user/repository_test.go.hbs", output: "internal/app/user/repository_test.go" },
-    { template: "add/auth/internal/app/user/handler.go.hbs", output: "internal/app/user/handler.go" },
-    { template: "add/auth/internal/app/user/handler_local.go.hbs", output: "internal/app/user/handler_local.go" },
-    { template: "add/auth/internal/app/user/handler_recovery.go.hbs", output: "internal/app/user/handler_recovery.go" },
-    { template: "add/auth/internal/app/user/handler_oauth.go.hbs", output: "internal/app/user/handler_oauth.go" },
-    { template: "add/auth/internal/app/user/handler_user.go.hbs", output: "internal/app/user/handler_user.go" },
-    { template: "add/auth/internal/app/user/handler_mfa.go.hbs", output: "internal/app/user/handler_mfa.go" },
-    { template: "add/auth/internal/app/user/session_cookie.go.hbs", output: "internal/app/user/session_cookie.go" },
-    { template: "add/auth/internal/app/user/browser_policy.go.hbs", output: "internal/app/user/browser_policy.go" },
     { template: "add/auth/internal/platform/authprovider/google/google.go.hbs", output: "internal/platform/authprovider/google/google.go" },
     { template: "add/auth/internal/platform/authprovider/google/google_test.go.hbs", output: "internal/platform/authprovider/google/google_test.go" },
     { template: "add/auth/cmd/seed/main.go.hbs", output: "cmd/seed/main.go" },
 ];
-// Only the chosen store's implementation is written. Shipping both would drag
-// go-redis into every project's go.mod for a file it never constructs — the
-// same reason `add worker` writes one queue adapter, not two.
 const POSTGRES = [
-    { template: "add/auth/internal/app/user/tokenstore_pg.go.hbs", output: "internal/app/user/tokenstore_pg.go" },
-    { template: "add/auth/internal/app/user/tokenstore_pg_test.go.hbs", output: "internal/app/user/tokenstore_pg_test.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/tokenstore_pg.go.hbs", output: "internal/app/user/adapters/outbound/postgres/tokenstore_pg.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/postgres/tokenstore_pg_test.go.hbs", output: "internal/app/user/adapters/outbound/postgres/tokenstore_pg_test.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit_memory.go.hbs", output: "internal/shared/middleware/ratelimit_memory.go" },
 ];
 const REDIS = [
-    { template: "add/auth/internal/app/user/tokenstore_redis.go.hbs", output: "internal/app/user/tokenstore_redis.go" },
-    { template: "add/auth/internal/app/user/tokenstore_redis_test.go.hbs", output: "internal/app/user/tokenstore_redis_test.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/redis/tokenstore.go.hbs", output: "internal/app/user/adapters/outbound/redis/tokenstore.go" },
+    { template: "add/auth/internal/app/user/adapters/outbound/redis/tokenstore_test.go.hbs", output: "internal/app/user/adapters/outbound/redis/tokenstore_test.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit_redis.go.hbs", output: "internal/shared/middleware/ratelimit_redis.go" },
 ];
 function authFiles(store) {

package/dist/templates/create-manifest.js

@@ -25,6 +25,10 @@ exports.CREATE_MANIFEST = [
         template: "create/base/internal/platform/database/database.go.hbs",
         output: "internal/platform/database/database.go",
     },
+    {
+        template: "create/base/internal/composition/doc.go.hbs",
+        output: "internal/composition/doc.go",
+    },
     {
         template: "create/base/internal/shared/config/config.go.hbs",
         output: "internal/shared/config/config.go",

package/dist/templates/module-manifest.js

@@ -1,66 +1,88 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODULE_FILES_MINIMAL_CQRS = exports.MODULE_FILES_MINIMAL = exports.MODULE_FILES_CQRS = exports.MODULE_FILES = void 0;
-// output paths are relative to the module's own directory
-// (internal/app/<pkg> or internal/app/v<version>/<pkg>)
-exports.MODULE_FILES = [
-    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
-    { template: "generate/module/dto.go.hbs", output: "dto.go" },
-    { template: "generate/module/errors.go.hbs", output: "errors.go" },
-    { template: "generate/module/repository.go.hbs", output: "repository.go" },
-    { template: "generate/module/service.go.hbs", output: "service.go" },
-    { template: "generate/module/composition.go.hbs", output: "composition.go" },
-    { template: "generate/module/handler.go.hbs", output: "handler.go" },
-    { template: "generate/module/service_test.go.hbs", output: "service_test.go" },
-    { template: "generate/module/handler_test.go.hbs", output: "handler_test.go" },
-    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
+exports.MODULE_FILES_MINIMAL_CQRS = exports.MODULE_FILES_CQRS = exports.MODULE_FILES_MINIMAL = exports.MODULE_FILES = void 0;
+// output paths are relative to the module's own directory.
+//
+// Every generated domain uses the same physical boundary. Surface and
+// application style change the amount of code inside the boundary; they do
+// not change where domain rules, ports, or adapters live.
+const COMMON = [
+    { template: "generate/module/hexagonal/domain/entity.go.hbs", output: "domain/entity.go" },
+    { template: "generate/module/hexagonal/domain/errors.go.hbs", output: "domain/errors.go" },
+    { template: "generate/module/hexagonal/ports/repository.go.hbs", output: "ports/repository.go" },
+    {
+        template: "generate/module/hexagonal/adapters/outbound/postgres/model.go.hbs",
+        output: "adapters/outbound/postgres/model.go",
+    },
+    {
+        template: "generate/module/hexagonal/adapters/outbound/postgres/repository.go.hbs",
+        output: "adapters/outbound/postgres/repository.go",
+    },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/handler_test.go.hbs",
+        output: "adapters/inbound/http/handler_test.go",
+    },
+    {
+        template: "generate/module/hexagonal/adapters/outbound/postgres/repository_test.go.hbs",
+        output: "adapters/outbound/postgres/repository_test.go",
+    },
+    { template: "generate/module/hexagonal/composition.go.hbs", output: "composition.go" },
 ];
-// CQRS is opt-in so a simple CRUD module does not pay for command/query
-// ceremony. The implementation files are still in the feature package, which
-// keeps the module easy to adopt incrementally and lets `generate method` patch
-// the correct side later.
-exports.MODULE_FILES_CQRS = [
-    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
-    { template: "generate/module/dto.go.hbs", output: "dto.go" },
-    { template: "generate/module/errors.go.hbs", output: "errors.go" },
-    { template: "generate/module/repository.go.hbs", output: "repository.go" },
-    { template: "generate/module/commands.go.hbs", output: "commands.go" },
-    { template: "generate/module/queries.go.hbs", output: "queries.go" },
-    { template: "generate/module/service.go.hbs", output: "service.go" },
-    { template: "generate/module/composition.go.hbs", output: "composition.go" },
-    { template: "generate/module/handler.go.hbs", output: "handler.go" },
-    { template: "generate/module/service_test.go.hbs", output: "service_test.go" },
-    { template: "generate/module/handler_test.go.hbs", output: "handler_test.go" },
-    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
-    { template: "generate/module/cqrs_test.go.hbs", output: "cqrs_test.go" },
+const SERVICE_MINIMAL = [
+    { template: "generate/module/hexagonal/application/dto.minimal.go.hbs", output: "application/dto.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/dto.minimal.go.hbs",
+        output: "adapters/inbound/http/dto.go",
+    },
+    { template: "generate/module/hexagonal/application/service.go.hbs", output: "application/service.go" },
+    { template: "generate/module/hexagonal/application/service_test.go.hbs", output: "application/service_test.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/handler.minimal.go.hbs",
+        output: "adapters/inbound/http/handler.go",
+    },
 ];
-// minimal: same model/errors/repository (generate method's patches assume the
-// full data-access surface exists), but no default CRUD in dto/service/handler
-// — add endpoints one at a time with `generate method`.
-exports.MODULE_FILES_MINIMAL = [
-    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
-    { template: "generate/module/minimal/dto.go.hbs", output: "dto.go" },
-    { template: "generate/module/errors.go.hbs", output: "errors.go" },
-    { template: "generate/module/repository.go.hbs", output: "repository.go" },
-    { template: "generate/module/minimal/service.go.hbs", output: "service.go" },
-    { template: "generate/module/composition.go.hbs", output: "composition.go" },
-    { template: "generate/module/minimal/handler.go.hbs", output: "handler.go" },
-    { template: "generate/module/minimal/service_test.go.hbs", output: "service_test.go" },
-    { template: "generate/module/minimal/handler_test.go.hbs", output: "handler_test.go" },
-    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
+const SERVICE_CRUD = [
+    { template: "generate/module/hexagonal/application/dto.go.hbs", output: "application/dto.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/dto.go.hbs",
+        output: "adapters/inbound/http/dto.go",
+    },
+    { template: "generate/module/hexagonal/application/service.crud.go.hbs", output: "application/service.go" },
+    { template: "generate/module/hexagonal/application/service_test.go.hbs", output: "application/service_test.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/handler.go.hbs",
+        output: "adapters/inbound/http/handler.go",
+    },
 ];
-exports.MODULE_FILES_MINIMAL_CQRS = [
-    { template: "generate/module/model/model.go.hbs", output: "model/model.go" },
-    { template: "generate/module/minimal/dto.go.hbs", output: "dto.go" },
-    { template: "generate/module/errors.go.hbs", output: "errors.go" },
-    { template: "generate/module/repository.go.hbs", output: "repository.go" },
-    { template: "generate/module/minimal/commands.go.hbs", output: "commands.go" },
-    { template: "generate/module/minimal/queries.go.hbs", output: "queries.go" },
-    { template: "generate/module/minimal/service.go.hbs", output: "service.go" },
-    { template: "generate/module/composition.go.hbs", output: "composition.go" },
-    { template: "generate/module/minimal/handler.go.hbs", output: "handler.go" },
-    { template: "generate/module/minimal/service_test.go.hbs", output: "service_test.go" },
-    { template: "generate/module/minimal/handler_test.go.hbs", output: "handler_test.go" },
-    { template: "generate/module/repository_test.go.hbs", output: "repository_test.go" },
-    { template: "generate/module/cqrs_test.go.hbs", output: "cqrs_test.go" },
+const CQRS_MINIMAL = [
+    { template: "generate/module/hexagonal/application/dto.minimal.go.hbs", output: "application/dto.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/dto.minimal.go.hbs",
+        output: "adapters/inbound/http/dto.go",
+    },
+    { template: "generate/module/hexagonal/application/commands.go.hbs", output: "application/commands.go" },
+    { template: "generate/module/hexagonal/application/queries.go.hbs", output: "application/queries.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/handler.minimal.go.hbs",
+        output: "adapters/inbound/http/handler.go",
+    },
+    { template: "generate/module/hexagonal/application/cqrs_test.go.hbs", output: "application/cqrs_test.go" },
 ];
+const CQRS_CRUD = [
+    { template: "generate/module/hexagonal/application/dto.go.hbs", output: "application/dto.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/dto.go.hbs",
+        output: "adapters/inbound/http/dto.go",
+    },
+    { template: "generate/module/hexagonal/application/commands.crud.go.hbs", output: "application/commands.go" },
+    { template: "generate/module/hexagonal/application/queries.crud.go.hbs", output: "application/queries.go" },
+    {
+        template: "generate/module/hexagonal/adapters/inbound/http/handler.go.hbs",
+        output: "adapters/inbound/http/handler.go",
+    },
+    { template: "generate/module/hexagonal/application/cqrs_test.go.hbs", output: "application/cqrs_test.go" },
+];
+exports.MODULE_FILES = [...COMMON, ...SERVICE_CRUD];
+exports.MODULE_FILES_MINIMAL = [...COMMON, ...SERVICE_MINIMAL];
+exports.MODULE_FILES_CQRS = [...COMMON, ...CQRS_CRUD];
+exports.MODULE_FILES_MINIMAL_CQRS = [...COMMON, ...CQRS_MINIMAL];

package/dist/templates/rbac-manifest.js

@@ -1,19 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RBAC_FILES = void 0;
-// output paths are relative to the project root
+// output paths are relative to the project root. RBAC uses the same
+// hexagonal split as every other generated module; there is one role
+// implementation, not a public wrapper around duplicated code.
 exports.RBAC_FILES = [
     { template: "add/rbac/internal/shared/middleware/authz.go.hbs", output: "internal/shared/middleware/authz.go" },
     { template: "add/rbac/internal/shared/middleware/authz_test.go.hbs", output: "internal/shared/middleware/authz_test.go" },
-    { template: "add/rbac/internal/app/role/model/role.go.hbs", output: "internal/app/role/model/role.go" },
-    { template: "add/rbac/internal/app/role/model/permission.go.hbs", output: "internal/app/role/model/permission.go" },
-    { template: "add/rbac/internal/app/role/model/role_permission.go.hbs", output: "internal/app/role/model/role_permission.go" },
-    { template: "add/rbac/internal/app/role/repository.go.hbs", output: "internal/app/role/repository.go" },
-    { template: "add/rbac/internal/app/role/service.go.hbs", output: "internal/app/role/service.go" },
-    { template: "add/rbac/internal/app/role/service_test.go.hbs", output: "internal/app/role/service_test.go" },
-    { template: "add/rbac/internal/app/role/repository_test.go.hbs", output: "internal/app/role/repository_test.go" },
+    { template: "add/rbac/internal/app/role/domain/entity.go.hbs", output: "internal/app/role/domain/entity.go" },
+    { template: "add/rbac/internal/app/role/domain/errors.go.hbs", output: "internal/app/role/domain/errors.go" },
+    { template: "add/rbac/internal/app/role/ports/repository.go.hbs", output: "internal/app/role/ports/repository.go" },
+    { template: "add/rbac/internal/app/role/application/dto.go.hbs", output: "internal/app/role/application/dto.go" },
+    { template: "add/rbac/internal/app/role/application/errors.go.hbs", output: "internal/app/role/application/errors.go" },
+    { template: "add/rbac/internal/app/role/application/service.go.hbs", output: "internal/app/role/application/service.go" },
+    { template: "add/rbac/internal/app/role/application/service_test.go.hbs", output: "internal/app/role/application/service_test.go" },
+    { template: "add/rbac/internal/app/role/adapters/inbound/http/handler.go.hbs", output: "internal/app/role/adapters/inbound/http/handler.go" },
+    { template: "add/rbac/internal/app/role/adapters/inbound/http/handler_test.go.hbs", output: "internal/app/role/adapters/inbound/http/handler_test.go" },
+    { template: "add/rbac/internal/app/role/adapters/outbound/postgres/model.go.hbs", output: "internal/app/role/adapters/outbound/postgres/model.go" },
+    { template: "add/rbac/internal/app/role/adapters/outbound/postgres/repository.go.hbs", output: "internal/app/role/adapters/outbound/postgres/repository.go" },
+    { template: "add/rbac/internal/app/role/adapters/outbound/postgres/repository_test.go.hbs", output: "internal/app/role/adapters/outbound/postgres/repository_test.go" },
     { template: "add/rbac/internal/app/role/composition.go.hbs", output: "internal/app/role/composition.go" },
-    { template: "add/rbac/internal/app/role/handler.go.hbs", output: "internal/app/role/handler.go" },
-    { template: "add/rbac/internal/app/role/dto.go.hbs", output: "internal/app/role/dto.go" },
-    { template: "add/rbac/internal/app/role/errors.go.hbs", output: "internal/app/role/errors.go" },
 ];

package/dist/templates/worker-manifest.js

@@ -18,7 +18,10 @@ const SHARED = [
 // its whole dependency tree into go.mod for nothing. Swapping later means
 // re-running `add worker` with the other backend, or copying the adapter in
 // by hand — the queue.go contract it implements does not change.
-const RIVER = [{ template: "add/worker/internal/platform/queue/river.go.hbs", output: "internal/platform/queue/river.go" }];
+const RIVER = [
+    { template: "add/worker/internal/platform/queue/river.go.hbs", output: "internal/platform/queue/river.go" },
+    { template: "add/worker/internal/platform/queue/river_test.go.hbs", output: "internal/platform/queue/river_test.go" },
+];
 const ASYNQ = [
     { template: "add/worker/internal/platform/queue/asynq.go.hbs", output: "internal/platform/queue/asynq.go" },
     // Redis only comes along when it is actually the queue's backing store.

package/dist/types.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_ARCHITECTURE_CONFIG = void 0;
 exports.DEFAULT_ARCHITECTURE_CONFIG = {
     style: "modular-monolith",
+    boundary: "hexagonal",
+    packageLayout: "split",
     defaultModuleSurface: "minimal",
     defaultApplicationStyle: "service",
 };

package/dist/utils/auth-patcher.js

@@ -112,7 +112,7 @@ function patchMainGoForAuth(mainGoPath, w) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/user"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
-    const modelImportLine = `usermodel "${goModule}/internal/app/user/model"`;
+    const modelImportLine = `usermodel "${goModule}/internal/app/user/adapters/outbound/postgres"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
     if (w.worker) {
         const queueImportLine = `"${goModule}/internal/platform/queue"`;
@@ -238,25 +238,25 @@ function upgradeMailerToQueue(mainGoPath, goModule, queueBackend, compositionGoP
             }
         }
     }
-    // Keep the fallback for projects scaffolded before feature-local auth
-    // composition existed. New projects take the branch above.
-    if (!upgradedComposition && !content.includes(syncMailer))
-        return false;
-    const queueImportLine = `"${goModule}/internal/platform/queue"`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
-    const queueCtor = queueBackend === "river" ? "queue.NewRiverEnqueuer(db)" : "queue.NewAsynqEnqueuer(cfg.RedisURL)";
-    const queueInitBlock = [`q, err := ${queueCtor}`, "if err != nil {", '\treturn fmt.Errorf("open queue: %w", err)', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.New");
-    const cleanupBlock = [
-        "defer func() {",
-        '\tif err := q.Close(); err != nil {',
-        '\t\tlogger.Error("close queue", "error", err)',
-        "\t}",
-        "}()",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, cleanupBlock, "defer func() {\n\tif err := q.Close()");
-    if (!upgradedComposition)
-        content = content.replace(syncMailer, () => "mail.NewAsyncClient(q)");
-    fs_extra_1.default.writeFileSync(mainGoPath, content);
-    return true;
+    if (upgradedComposition) {
+        const queueImportLine = `"${goModule}/internal/platform/queue"`;
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, queueImportLine, queueImportLine);
+        const queueCtor = queueBackend === "river" ? "queue.NewRiverEnqueuer(db)" : "queue.NewAsynqEnqueuer(cfg.RedisURL)";
+        const queueInitBlock = [`q, err := ${queueCtor}`, "if err != nil {", '\treturn fmt.Errorf("open queue: %w", err)', "}"].join("\n");
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, queueInitBlock, "q, err := queue.New");
+        const cleanupBlock = [
+            "defer func() {",
+            '\tif err := q.Close(); err != nil {',
+            '\t\tlogger.Error("close queue", "error", err)',
+            "\t}",
+            "}()",
+        ].join("\n");
+        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, cleanupBlock, "defer func() {\n\tif err := q.Close()");
+        fs_extra_1.default.writeFileSync(mainGoPath, content);
+        return true;
+    }
+    if (content.includes(syncMailer)) {
+        throw new Error("auth mailer is not owned by internal/app/user/composition.go; regenerate auth with the canonical split layout before adding a worker");
+    }
+    return false;
 }