@openora/create 0.1.0 → 0.4.1-canary.101

package/template/__dot__rulesync/subagents/quality-reviewer.md

@@ -0,0 +1,67 @@
+---
+targets:
+  - '*'
+name: quality-reviewer
+description: >-
+  Code-quality review of changed files: OSS-core boundaries, conventions,
+  frontend rules, performance, duplication, and simplification in a single
+  pass. Findings only, no edits.
+claudecode:
+  model: sonnet
+---
+
+You are a senior code-quality reviewer for this consumer igaming repo (built on `@openora/*` OSS core). One pass over the changed files, several lenses. You are NOT the implementer - findings only, no changes.
+
+## Grounding
+
+- Read `.claude/rules/conventions.md` IN FULL, and `docs/standards/frontend.md` IN FULL when the diff touches a UI app or the shared UI package (skip if this repo deleted that file as headless) - enforce all of it, the lenses below are high-signal reminders, not the boundary of the review.
+- For import/extension questions, `.claude/rules/oss-boundaries.md`; for overlay tables, `docs/standards/database.md`.
+- Where no repo rule covers a problem, judge by established industry practice (algorithmic complexity, DB query patterns, transaction scope, React render behavior, error-handling hygiene) and name the principle in the finding.
+- Library API in doubt (Next, React, Drizzle, Zod, `@openora/*`)? Check current docs via context7/web search - never claim from memory.
+
+## Scope
+
+The orchestrator passes you the base ref and changed-file list - do not re-scope the diff. Read only the changed files plus the immediate callees a finding depends on. If no file list was passed: `git diff origin/dev...HEAD --name-only`.
+
+## Lenses
+
+### OSS boundaries & extension
+
+- [ ] No edits to `@openora/*` core or `node_modules`; extension only via `extensions.config.ts`, overlay plugins, adapters.
+- [ ] No deep imports into core internals - package/subpath entries only.
+- [ ] Overlay talks to platform data via the typed client, events, or read-only `/schema` - never another module's internals.
+
+### Conventions
+
+- [ ] Types inferred from schemas/contracts (`z.infer`, `$inferSelect`) - no hand-written duplicates; derive with `.pick/.omit/.extend`.
+- [ ] Single source of truth for enums (values + schema + type triple); `timestamptz` for datetimes; named-object params over 3+ positionals.
+- [ ] Zero-value comments flagged; missing WHY comments on genuinely surprising code flagged.
+
+### Frontend (`apps/web`, `apps/backoffice`, `packages/ui`)
+
+- [ ] Module isolation per the Modular-architecture rules; no cross-module reach-ins.
+- [ ] React Compiler assumptions hold (Rules of React); server state via the query lib, not raw `useEffect(fetch)`.
+- [ ] daisyUI/styling conventions followed; no one-off design systems.
+
+### Performance
+
+- [ ] No N+1 queries or `await` in a loop that could batch; lists paginate.
+- [ ] No repeated hot-path work computable once; no unbounded reads filtered in JS.
+
+### Duplication & simplification
+
+- [ ] No copy-pasted logic a helper a few files over provides - name the existing helper.
+- [ ] No speculative abstraction (interface-with-one-impl, config for a constant); nested ifs flattenable with early returns; dead code introduced by the change.
+
+## Do NOT flag (false-positive guard)
+
+- Anything lint/CI (`/check`, oxlint) already enforces.
+- Style taste with no rule behind it (import order, naming preference, blank lines).
+- Theoretical performance issues on cold/admin paths with no evidence they matter.
+- Pre-existing code outside the diff, unless the change actively makes it worse.
+- Missing features or scope expansion - review the change, not the roadmap.
+- Speculative hardening or "might need later" abstractions.
+
+## Output
+
+Max 10 findings, highest impact first. Each: `[WARN]`/`[INFO]` `file:line - finding - evidence - rule cited - fix`. Use `[BLOCK]` only for a core edit or boundary break. No prose around the list. End with **PASS** / **CHANGES REQUESTED** + one line on the most impactful finding.

package/template/__dot__rulesync/subagents/security-reviewer.md

@@ -0,0 +1,54 @@
+---
+targets:
+  - '*'
+name: security-reviewer
+description: >-
+  Security review of changed overlay/frontend files for authz, secret/PII,
+  money-path, and input-validation risks in a real-money igaming consumer repo.
+  Findings only, no edits.
+claudecode:
+  model: opus
+---
+
+You are a security reviewer for a real-money igaming consumer repo built on `@openora/*`. Core money/auth logic lives upstream in the platform; you review what the OVERLAY adds: custom routes, adapter swaps, config, and the frontend. Findings only, no changes.
+
+## Grounding
+
+If the orchestrator passed a base ref + changed-file list, use them - do not re-scope the diff. Otherwise: `git diff origin/dev...HEAD --name-only`. Read each changed file plus the immediate callees a finding depends on. Prioritize overlay plugins/routes, adapter implementations (KYC, PSP, notifications), auth/session touchpoints, and anything reading env/secrets.
+
+## Checklist
+
+### Authorization
+
+- [ ] Overlay admin/backoffice routes enforce the platform guard - never a re-implemented role check.
+- [ ] No client-supplied user id trusted for ownership decisions; caller resolved server-side.
+- [ ] Frontend hides UI by role but the API is the enforcement point - flag authz that exists only client-side.
+
+### Money paths
+
+- [ ] Overlay code never mutates balances directly - money flows through platform commands/ports.
+- [ ] Any overlay money-adjacent mutation is idempotent at the data layer (DB guard, not just a key).
+- [ ] Amounts are integer minor units; no float arithmetic on money.
+
+### Secrets & PII
+
+- [ ] Vendor adapter credentials from env/config - never in source, templates, or client bundles.
+- [ ] No PII (email, KYC docs, DOB, payment details) in logs, analytics events, error messages, or client-visible payloads.
+- [ ] Nothing secret leaks into `NEXT_PUBLIC_*` or the browser bundle.
+
+### Input & injection
+
+- [ ] All external input Zod-validated at the boundary (no `z.any()`/`z.unknown()` on a security edge).
+- [ ] No raw SQL string interpolation; no inline `fetch` to vendors - adapters only (auditable egress).
+- [ ] Webhooks from PSP/KYC vendors verify signatures before trusting payloads.
+
+## Do NOT flag (false-positive guard)
+
+- Attack paths you have not traced through the actual code - state the concrete trigger or don't raise it.
+- Platform-core internals (upstream's responsibility) - flag only how the overlay USES them.
+- Code outside the diff, unless the change makes it newly exploitable.
+- Generic hardening wishlists (rate limits everywhere, CSP) with no tie to the changed surface.
+
+## Output
+
+Max 10 findings, most severe first. Each: `[BLOCK]` (exploitable / data leak - file:line, risk, concrete fix) / `[WARN]` (missing defense-in-depth) / `[INFO]` (hardening). End with **PASS** / **CHANGES REQUESTED** + one line on the most severe finding.

package/template/apps/api/package.json.tpl

@@ -7,9 +7,8 @@
     "build": "tsc",
     "dev": "node --import tsx --watch --env-file-if-exists=../../.env src/main.ts",
     "start": "node --import tsx --env-file-if-exists=../../.env src/main.ts",
-    "db:migrate": "node --import tsx --env-file-if-exists=../../.env src/migrate.ts",
     "db:seed": "node --import tsx --env-file-if-exists=../../.env src/seed.ts",
-    "typecheck": "tsc --noEmit"
+    "check:types": "tsc --noEmit"
   },
   "dependencies": {
     "@openora/core": "{{coreVersion}}"

package/template/apps/api/src/main.ts.tpl

@@ -67,18 +67,16 @@ process.env['EXTENSIONS_CONFIG'] ??= resolve(
 );
 
 async function bootstrap() {
-  const { listen, emitOpenApiSpec } = await createApp({
+  const { listen } = await createApp({
     plugins: await loadExtensions(),
     contract,
     authSchema: { user, session, account, verification, twoFactor },
     igaming,
     port: Number(process.env['PORT'] ?? 3001),
     cors: { origins: process.env['CORS_ORIGINS']?.split(',') ?? '*' },
-    openapi: { info: { title: '{{name}} API', version: '0.1.0' } },
   });
 
   await listen();
-  await emitOpenApiSpec();
 }
 
 void bootstrap();

package/template/apps/api/src/seed.ts.tpl

@@ -10,6 +10,8 @@
  */
 import { createDrizzleDb } from '@openora/core/server';
 import { seedRoles } from '@openora/core/iam/seed';
+import { seedTag } from '@openora/core/pam/tag/seed';
+import { seedAutoWithdrawalConfig, seedBonusRolloverConfig } from '@openora/core/wallet/seed';
 // import additional module seeders here as you enable them
 
 async function main() {
@@ -27,7 +29,9 @@ async function main() {
   const db = createDrizzleDb(databaseUrl);
 
   await seedRoles(db);
-  // await seedOtherModule(db);
+  await seedTag(db);
+  await seedAutoWithdrawalConfig(db);
+  await seedBonusRolloverConfig(db);
   console.log('Reference data seeded.');
 }
 

package/template/docker-compose.yml

@@ -15,5 +15,16 @@ services:
       timeout: 5s
       retries: 10
 
+  redis:
+    image: redis:7-alpine
+    command: ['redis-server', '--maxmemory-policy', 'noeviction']
+    ports:
+      - '6379:6379'
+    healthcheck:
+      test: ['CMD', 'redis-cli', 'ping']
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
 volumes:
   postgres_data:

package/template/docs/standards/comments.md

@@ -0,0 +1,16 @@
+# Comments
+
+Read this before writing a comment or JSDoc.
+
+- Comment WHY, never WHAT: hidden constraint, invariant, bug workaround (link it), trade-off. If a
+  block needs a comment to be understood, rename/extract instead.
+- No section-divider comments (`// ---`, `// ===`).
+- Every JSDoc is multi-line, always - `/**`, the text, and `*/` each on their own line. A
+  single-line `/** ... */` is never allowed, even for one sentence. Add one only on an independent
+  function/class (not a React component or hook) that is >~15 lines or has non-obvious params. One
+  sentence; document the surprising contract, not the name.
+- Never JSDoc a React component or hook - a genuinely surprising note goes on the specific
+  prop/param type, or an inline comment at the call site.
+- Deferred work: `// TODO:` with the concrete follow-up, never a bare TODO.
+- Placeholder/sample data and stubs: greppable `// mock:` comment so throwaway code stays
+  findable.

package/template/{__dot__rulesync/rules/db-conventions.md → docs/standards/database.md}

@@ -1,22 +1,16 @@
----
-root: false
-targets:
-  - '*'
-globs:
-  - 'apps/api/**'
-description: SQL / Drizzle conventions for tables an overlay or local add-on owns.
----
-
 # Database conventions (SQL / Drizzle)
 
-Applies to every table an overlay or local add-on owns (`apps/api/src/extensions/<name>/src/schema/`).
-Tables live in `@openora/*` core for platform domains - never edit those; these rules govern the
-tables you add. Boundary/import rules live in `oss-boundaries`; this file is SQL only.
+Read this in full before editing a schema, Drizzle query, migration config, or seed under
+`apps/api/**`. Tables live in `@openora/*` core for platform domains - never edit those; these
+rules govern the tables your overlay adds
+(`apps/api/src/extensions/<name>/src/schema/`). Import/boundary rules live in `oss-boundaries`;
+this file is SQL only.
 
 ## Identifiers - snake_case everywhere
 
-Every drizzle instance sets `casing: 'snake_case'`, so the SQL name derives from the camelCase key.
-Pass an explicit name only where casing can't derive it: table names, `pgEnum` types, index names.
+Every drizzle instance sets `casing: 'snake_case'`, so the SQL name derives from the camelCase
+key. Pass an explicit name only where casing can't derive it: table names, `pgEnum` types, index
+names.
 
 ```ts
 // good - key derives the column; const camelCase; explicit snake_case only for table + index
@@ -46,8 +40,8 @@ Every datetime column (`createdAt`, `updatedAt`, `expiresAt`, any `*At`) carries
 ## Keys, references, indexes
 
 - UUID primary keys (`uuid().primaryKey().defaultRandom()`).
-- **No foreign keys across a module/overlay boundary** - store a plain ID string and resolve via the
-  oRPC client or a schema subpath. FKs only within the same add-on.
+- **No foreign keys across a module/overlay boundary** - store a plain ID string and resolve via
+  the oRPC client or a schema subpath. FKs only within the same add-on.
 - `NOT NULL` by default; push defaults to the DB (`.notNull().default(...)`), not app code.
 - Index every column you filter or join on; name it `<table>_<cols>_idx`.
 
@@ -62,11 +56,11 @@ await db.select().from(wallet).where(inArray(wallet.playerId, ids));
 
 - Select only the columns you use; don't `select(*)` wide rows to read one field.
 - **Build rows by spread + override, never hand-copy field-by-field.** When a row mostly mirrors a
-  validated input, spread it and set only the server-computed fields - `db.insert(x).values({ ...input,
-id, createdAt })` - never re-list `field: input.field` per key (it silently drifts the moment a
-  column is added). Keep fields explicit only for: an order-sensitive hash/signature payload; a source
-  carrying columns the row must not receive (spread then omit them); or a null-vs-undefined boundary
-  that won't coerce (`actorId: input.actorId ?? null`).
+  validated input, spread it and set only the server-computed fields - `db.insert(x).values({
+...input, id, createdAt })` - never re-list `field: input.field` per key (it silently drifts the
+  moment a column is added). Keep fields explicit only for: an order-sensitive hash/signature
+  payload; a source carrying columns the row must not receive (spread then omit them); or a
+  null-vs-undefined boundary that won't coerce (`actorId: input.actorId ?? null`).
 - **Money / critical paths are transactional and idempotent** - a DB guard inside the transaction,
   not just an `idempotencyKey` (delivery is at-least-once).
 

package/template/docs/standards/enforcement.md

@@ -0,0 +1,12 @@
+# Enforcement
+
+Read this before working around a failing gate or adding a lint rule.
+
+- `pnpm check:types` + `pnpm check:lint` (oxlint) + `pnpm test:unit` is the fast gate;
+  `pnpm check:boundaries` (dependency-cruiser) is the whole-graph boundary/cycle check, also run
+  by the pre-commit hook and CI.
+- oxlint extends the platform's shared config (`./node_modules/@openora/core/oxlint/oxlintrc.json`)
+  - add local rules on top, never fork it.
+- Don't work around a lint/boundary violation - fix the import.
+- Agent rules are generated from `.rulesync/` via `pnpm gen:agents` - never hand-edit a generated
+  file.

package/template/docs/standards/errors.md

@@ -0,0 +1,26 @@
+# Errors
+
+Read this before adding an error class, a catch, or a money-handling path.
+
+- Fail fast at boundaries with typed errors (`CreateOrderSchema.parse(raw)` throws early).
+- No silent catches - log with context and rethrow.
+- Typed, named error classes via the shared factories (`makeNotFoundError`/`makeOwnershipError`/
+  `makeConflictError`); the router's `mapErrors` keys off the exported class.
+- `ORPCError.message` is an English fallback for logs, not player-facing copy - UI copy keys off
+  `.code` plus typed `.data` fields.
+- Money/critical paths are transactional AND idempotent: a DB guard inside the transaction, not
+  just an `idempotencyKey` (delivery is at-least-once).
+
+```ts
+// bad - swallows the error, no context, no rethrow
+try {
+  await chargeWallet(tx, amount);
+} catch {
+  return null;
+}
+// good - a DB guard makes the mutation idempotent under at-least-once delivery
+await db.transaction(async (t) => {
+  if (await ledgerExists(t, idempotencyKey)) return;
+  await insertLedger(t, { idempotencyKey, amount });
+});
+```

package/template/docs/standards/frontend.md

@@ -0,0 +1,60 @@
+# Frontend conventions
+
+React/UI rules for this repo's `apps/*` UI apps and shared UI package. Read this before touching
+`apps/web/**`, `apps/backoffice/**`, or `packages/ui/**`. Not applicable if this repo is
+headless/api-only - delete this file and its row in `conventions`'s routing table in that case.
+
+## Component library and styling
+
+- React Compiler is ON. Never hand-write `useMemo`/`useCallback`/`React.memo` - a compiler bail is
+  a Rules-of-React violation to fix. Exception: your shared UI package is consumed pre-built, so
+  hand-write stability there when it's part of a hook's contract (same reason `@openora/core/react`
+  does).
+- Pick ONE component library and use its classes customized via utility classes + theme tokens.
+  Don't hand-roll what the library provides.
+- Never hand-write component CSS selectors (`.btn-*{}`, `.table th{}`). A per-app `styles.css`
+  holds only the theme plus custom properties for raw values with no token; every other style is
+  a utility class on the element.
+- App-specific looks live in that app's `styles.css`; shared UI components stay visually neutral.
+- No hardcoded user-facing copy - every label goes through `t()` with a key in the module's
+  `locales/`. Pattern: `locales/index.ts` exports `export const ns = registerTranslations('<module>',
+locales)`; components use `useTranslation(ns)`. Non-`en` files mirror `en.json` keys exactly.
+- Theme tokens and CSS variables are declared once in the shared UI package - style with semantic
+  tokens (`bg-base-100`, `text-base-content`, `btn-primary`), never inline raw hex. A design color
+  with no token: add it to BOTH dark and light theme blocks. A new token without a design source:
+  ask the user first.
+- Hoist long class strings into a module-scope `const styles = { ... } as const` keyed by role -
+  never inline long strings in JSX; merge with `cn()`.
+- Extract a repeated utility-class recipe into a shared component or constant on the third
+  occurrence.
+- Import helpers like `cn()` from the shared UI package barrel - never deep-import.
+- Server state is not client state - key/cache/invalidate via the query lib, never
+  `useEffect(fetch)`, never shadowed in ad-hoc caches.
+- No label or text is allowed to overflow its container - never leave text unconstrained by
+  default. Pick per element, based on whether the full text is load-bearing: `truncate` + a
+  `title` attribute holding the full string when a single line is the right shape and hiding the
+  tail is acceptable (a table cell, a narrow badge); `line-clamp-N` + a reserved `min-h-[NlH]` when
+  several lines are the right shape or the content differs in length across siblings that must
+  stay visually aligned (a KPI tile label, a card title) - the reserved height keeps every sibling
+  the same height whether or not its text actually wraps. A tooltip/popover with the full text is
+  the fallback only when neither fits the UX.
+
+## Modular architecture (every app)
+
+- Feature modules live in `src/modules/<m>/` with the same internal folders: `pages/`,
+  `components/`, `hooks/`, `utils/`, `locales/`, and a public barrel `index.ts`.
+- App-level (non-module) code splits the same way: `src/lib/` holds stateful/integration code
+  (API clients, SDK wrappers, config); `src/utils/` holds pure stateless helpers (formatters,
+  converters).
+- No cross-module imports, ever. Cross-module communication is query invalidation or a domain
+  event, never a direct import.
+- Outer composition code (`src/app/`, `src/routes/`, `extensions.config.ts`) imports modules only
+  through their barrel; deep-importing internals is forbidden. Files inside a module use relative
+  paths to siblings only, never `../../` out of the module.
+- Components in `components/` and `pages/` are presentation-only: props in, JSX out - no
+  fetching, no side effects. Business logic, queries, and mutations live in `hooks/`, which accept
+  external dependencies (oRPC calls, API clients) as parameters.
+- Next.js client components: `'use client'` on line 1 + `.client.tsx` suffix; server components
+  are the default (no marker). All-client apps (Vite/TanStack) use no suffix.
+- One concept per file, exported name matches the kebab-case filename; split hooks and components
+  into separate files.

package/template/docs/standards/functions.md

@@ -0,0 +1,38 @@
+# Functions and modules
+
+Read this before writing or refactoring a function, service method, or module.
+
+- Pure functions with dependencies passed in as arguments; side effects only at the edges
+  (services, adapters, plugins, handlers) - never in helpers.
+- Immutability: derive new objects (`{ ...user, roles: [...] }`), don't mutate.
+- Construct objects by spread + override, never field-by-field hand-copy. Keep fields explicit
+  only for order-sensitive serialization, when the target must not receive some source fields, or
+  when null-vs-undefined matters at a boundary.
+- A `class` is only a thin dependency-holding shell at a composition root; methods delegate to
+  pure functions. No inheritance for reuse, no decorators - compose.
+- Short, single-purpose functions - if you'd write `// step 2` inside one, extract it.
+- Guard clauses first, main path last.
+- More than 3 parameters -> a single named-object param.
+- Don't annotate a return type TypeScript can infer. Annotate only when: inference can't
+  (recursion), you deliberately widen/narrow, or it's the exported public API of a shared
+  `packages/*` module - there the explicit type IS the contract. Argument types always stay
+  explicit.
+- Named exports only - no default exports (exceptions: `*.config.*` files, `plugin.ts` whose
+  loader reads `mod.default`, and Next.js App Router files; lint-enforced).
+
+```ts
+// bad - the service reaches into a global/container to hide what it depends on
+export class WalletService {
+  constructor(private readonly container: Container) {}
+  async deposit() {
+    const psp = this.container.get(PAYMENT_ADAPTER);
+  }
+}
+// good - deps are constructor params of their port type
+export class WalletService {
+  constructor(
+    private readonly db: DrizzleService,
+    private readonly payments: PaymentAdapter,
+  ) {}
+}
+```

package/template/docs/standards/git-delivery.md

@@ -0,0 +1,16 @@
+# Git and delivery
+
+Read this before a commit, PR, or branch operation.
+
+- Conventional commits, enforced by commitlint (husky + CI): `feat`, `fix`, `refactor`, `chore`,
+  `docs`, `test`, `ci`, `perf`. E.g. `feat(wallet): atomic debit command port`.
+- Subject starts lowercase, acronyms included (`feat(pam): kyc status filter`). This applies to
+  the PR title too - squash merges derive the commit message from it.
+- One PR = one concern. Stage files explicitly; never `git add -A` when foreign changes are in
+  the tree.
+- Green before review: typecheck + lint + unit tests pass; `pnpm verify` is the full gate (adds
+  format:check + boundaries + build).
+- Branch off `dev`; never commit directly to a shared branch; never push without an explicit
+  per-action "yes push".
+- PR description carries intent: what / why / acceptance criteria / ticket link. No secrets,
+  internal hostnames, or PII - it is the public record.

package/template/docs/standards/module-structure.md

@@ -0,0 +1,37 @@
+# Package and module structure
+
+Read this before creating a package, an overlay add-on, or wiring a new module's internal layout.
+
+- One package = one concern, named `@<scope>/<kebab>`, with an explicit `exports` map. The
+  entrypoint IS the public API; everything else is internal and off-limits to consumers
+  (`oss-boundaries`).
+- Overlay/add-on packages mirror the platform module shape: `contract/`, `schema/`, `service/`,
+  `router/`, `adapters/`, `__tests__/`, plus `plugin.ts` at the root as the single wiring point.
+
+| Layer    | File                        | Holds                                                           | Must NOT hold                    |
+| -------- | --------------------------- | --------------------------------------------------------------- | -------------------------------- |
+| schema   | `schema/index.ts`           | Drizzle `pgTable`s; row types via `$inferSelect`/`$inferInsert` | logic                            |
+| contract | `contract/index.ts`         | oRPC route contract + req/res Zod schemas                       | logic, transport wiring          |
+| service  | `service/<name>.service.ts` | ALL business logic; emits events after DB commit                | HTTP/transport knowledge         |
+| router   | `router/index.ts`           | thin oRPC wiring: resolve caller, call service, map errors      | business rules                   |
+| plugin   | `plugin.ts`                 | DI wiring only: `ctx.provide(...)`, route registration          | logic                            |
+| adapters | `adapters/<vendor>/`        | concrete impls of adapter ports                                 | being imported by another module |
+
+- Each overlay owns its `drizzle.config.ts` and its own migration history - never share one
+  migration folder across packages.
+- Pin exact dependency versions in every package; a package never depends on an app.
+- Add a dependency deliberately - std lib or a few lines often beat a tree.
+
+```ts
+// bad - a service reaches into the container and hides what it depends on
+export class WalletService {
+  constructor(private readonly container: Container) {}
+}
+// good - deps are constructor params of their port type; plugin.ts does the resolving
+export class WalletService {
+  constructor(
+    private readonly db: DrizzleService,
+    private readonly payments: PaymentAdapter,
+  ) {}
+}
+```

package/template/docs/standards/testing.md

@@ -0,0 +1,48 @@
+# Testing
+
+Read this before adding or restructuring a test.
+
+## Pick the tier
+
+Pick the OUTERMOST tier that can reach the behaviour - a test earns its keep by running real code,
+not by being cheap.
+
+| What you changed                                              | Tier                                          |
+| ------------------------------------------------------------- | --------------------------------------------- |
+| A screen, a form, a player/admin journey                      | Browser E2E (`apps/e2e/tests/<app>/**`)       |
+| An API route, an overlay, a vendor adapter, anything with SQL | API E2E (`apps/e2e/tests/api/**`)             |
+| A pure function - parser, resolver, mapper, money calculation | Unit (`src/__tests__/<name>.test.ts`, Vitest) |
+
+The API tier drives the real API over HTTP against real Postgres, with each external vendor
+replaced by a stub HTTP server the API is pointed at by env. It is the default tier for
+`apps/api/src/extensions/**`: an overlay is wiring, and wiring is exactly what a unit test skips.
+
+## What is real, what is doubled
+
+- **Anything that touches the database is tested against real Postgres.** Never fake a query
+  builder: a stubbed chain proves a call order, not a result, so it misses the regressions that
+  matter - a unique-index conflict, a wrong `where`, a lost race, a rollback that never happened.
+- **External vendors are stubbed at their HTTP boundary** (a `node:http` stand-in the API's
+  base-URL env var points at), never by mocking our own adapter - a mocked adapter skips exactly
+  the wiring the test exists to check. Every vendor adapter therefore accepts a base-URL override.
+- **A spy assertion is never the point of a test.** `expect(client.x).toHaveBeenCalledWith(...)`
+  only restates the line above it. A spy may stand in for an outbound vendor call, never for the
+  thing under test.
+
+```ts
+// bad - a mocked builder chain proves a call order, not a result
+const db = { select: vi.fn().mockReturnValue({ from: vi.fn().mockResolvedValue([row]) }) };
+expect(db.select).toHaveBeenCalled();
+// good - assert the outcome
+expect(await service.get(id)).toEqual(row);
+```
+
+## How to write them
+
+- Test behavior, not implementation - tests must survive a safe refactor (assert outputs, not
+  private caches).
+- Cover new logic as part of the same change; always include the authz negatives.
+- Drive a vendor's inbound side the way the vendor does: post the real webhook shape to the real
+  route with a signature the stub's key material produces. Never call the adapter directly.
+- Deterministic and isolated: no shared mutable state, no real outbound network, seedable data.
+  Own the rows a test creates and clean them up - the API suite shares one database.

package/template/docs/standards/types.md

@@ -0,0 +1,31 @@
+# Types
+
+Read this before adding or changing a schema, type, or enum-like value set.
+
+- One source of truth per shape - infer, never hand-write a type that already exists:
+  `z.infer<typeof UserSchema>`, `typeof users.$inferSelect`, `Omit<User, 'id'>`.
+- Schema-first at every boundary (HTTP, config, env, messages, events): validate once at the edge,
+  trust the type after. oRPC + Zod does this for routes; do the same elsewhere.
+- Never re-infer a schema you imported - the owning contract exports the type once; import it.
+- No `any` outside tests - `unknown` + narrowing.
+- No `as` casts to silence the compiler - fix the root cause (`as const` is fine).
+- Never `!` non-null assertions - narrow explicitly, or restructure so the value is provably
+  present (carry it on the object instead of re-looking it up).
+- Under `noUncheckedIndexedAccess`: `.at()`, destructure-with-default
+  (`const [first = ''] = parts`), or an explicit guard - never `arr[i]!`.
+- `type` over `interface` (lint-enforced).
+- Type entity ids through their owning type (`playerId: Player['id']`), never a bare `string`.
+- Derive related schemas with `.pick()/.omit()/.partial()/.extend()/.merge()` - never re-type
+  fields.
+- Enum-like value sets are a values + schema + type triple declared once on the contract surface:
+  `X_STATUSES = [...] as const` -> `XStatusSchema = z.enum(X_STATUSES)` -> inferred `XStatus`.
+  Never a TS `enum`, never a second hand-typed copy - import the one from `@openora/*`.
+- Make illegal states unrepresentable - discriminated unions
+  (`{ status: 'ok'; data } | { status: 'error'; error }`) over optional-flag soup.
+
+```ts
+// bad - hand-written duplicate of an inferrable type
+type User = { id: string; email: string; roles: string[] };
+// good - infer from the schema that already validates the shape
+type User = z.infer<typeof UserSchema>;
+```

package/template/package.json.tpl

@@ -6,11 +6,11 @@
   "scripts": {
     "dev": "turbo run dev",
     "build": "turbo run build",
-    "typecheck": "turbo run typecheck",
-    "lint": "oxlint .",
-    "sync:agents": "rulesync generate",
+    "check:types": "turbo run check:types",
+    "check:lint": "oxlint .",
+    "gen:agents": "rulesync generate",
     "prepare": "rulesync generate",
-    "db:migrate": "pnpm -F @{{name}}/api db:migrate",
+    "db:migrate": "pnpm -F @{{name}}/api exec openora-migrate",
     "db:seed": "pnpm -F @{{name}}/api db:seed",
     "gen": "turbo gen"
   },

package/template/rulesync.jsonc

@@ -1,6 +1,6 @@
 // rulesync config - single source of truth for all AI-agent instruction files.
 // Source lives in .rulesync/ (rules, subagents, commands, mcp.json).
-// Regenerate with `pnpm sync:agents`; CI checks with `pnpm sync:agents:check`.
+// Regenerate with `pnpm gen:agents`.
 {
   "$schema": "https://github.com/dyoshikawa/rulesync/releases/latest/download/config-schema.json",
 

package/template/turbo/generators/config.ts

@@ -1,2 +1,2 @@
 // To customize, replace this re-export with your own plop config.
-export { default } from '@openora/turbo-generators';
+export { default } from '@openora/core/generators';

package/template/turbo.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://turbo.build/schema.json",
   "ui": "tui",
+  "globalDependencies": [".oxlintrc.json"],
   "tasks": {
     "build": {
       "dependsOn": ["^build"],
@@ -10,8 +11,19 @@
       "cache": false,
       "persistent": true
     },
-    "typecheck": {
-      "dependsOn": ["^build"]
+    "check:types": {
+      "dependsOn": ["^build"],
+      "outputs": []
+    },
+    "//#check:lint": {
+      "inputs": [
+        "**/*.{ts,tsx,mts,cts,js,mjs,cjs,jsx}",
+        "!.turbo/**",
+        "!**/node_modules/**",
+        "!**/dist/**",
+        "!**/.next/**"
+      ],
+      "outputs": []
     }
   }
 }