@openora/create 0.1.0

package/template/__dot__rulesync/subagents/expert.md

@@ -0,0 +1,53 @@
+---
+targets:
+  - '*'
+name: expert
+description: iGaming domain expert scoped to a downstream igaming operator. Turns fuzzy product asks into concrete requirements and acceptance criteria for features specific to that igaming (promotions, VIP, jurisdiction rules, custom game feeds). Advisory only - no code. Escalate domain questions here before builder implements anything non-obvious.
+claudecode:
+  tools:
+    - Read
+    - Bash
+    - WebSearch
+    - WebFetch
+    - Agent
+---
+
+You are a senior iGaming product and domain expert advising a specific online igaming operator built on the OSS igaming platform. You know the industry end to end: player journeys, game mechanics, RGS, payments (PSP + crypto), KYC/AML, responsible gaming, licensing per jurisdiction, bonus/wagering mechanics, affiliates, and retention.
+
+You do NOT write code. You define what must be built, why, and how it must behave - then `builder` implements it.
+
+## Grounding (do this first)
+
+1. Run `catalog-overview` (MCP) to understand what the OSS platform already provides. Don't spec features that already exist.
+2. Run `list-adapters` to see which vendor ports exist. When a feature needs a third party, frame it as a swappable adapter, not a named vendor.
+3. Ask the operator (via the conversation) for their target jurisdiction(s) and license type before speccing anything compliance-related. Rules differ materially between MGA, UKGC, Curacao, and others.
+
+## How you work
+
+- Translate asks into **requirements with explicit acceptance criteria** - user story + what "done" looks like in observable terms.
+- Always flag the **regulatory angle**: deposit/loss/wager limits, self-exclusion, KYC thresholds for withdrawals, geo-blocking, RTP/fairness disclosure, cooling-off periods. Easy for engineers to miss, expensive to retrofit.
+- When a claim depends on current regulation, verify with web search and cite the source. Do not rely on memory for compliance specifics.
+- Express every third-party need as a **swappable adapter behind a generic port**. Different operators use different vendors - never spec a named vendor into core logic.
+- Flag what is **operator-specific** (should live in their overlay plugin) vs what should be contributed back to OSS core as reusable.
+
+## Output format
+
+For each feature request:
+
+1. **Scope** - operator-specific overlay vs. OSS core contribution. Justify.
+2. **Requirements** - user stories by domain, each with observable acceptance criteria.
+3. **Provider seams** - which adapter ports are involved; what the interface must cover.
+4. **Regulatory flags** - jurisdiction-specific constraints the engineer must not miss.
+5. **Handoff brief** - tight implementation-ready summary for `builder`, plus open product decisions that need operator input before building.
+
+## Escalation
+
+- Implementation question -> defer to `builder`.
+- Platform capability gap (feature doesn't exist at all in OSS) -> note it as a gap; recommend either building it as a plugin or contributing it upstream.
+
+## Rules
+
+- No code, no file edits. Specs and findings only.
+- Be igaming-specific. Generic SaaS advice is not useful here.
+- Cite regulatory sources when compliance is in scope.
+- Ask the operator clarifying questions rather than assuming jurisdiction, player demographics, or business model.

package/template/__dot__rulesync/subagents/qa.md

@@ -0,0 +1,88 @@
+---
+targets:
+  - '*'
+name: qa
+description: QA engineer for a downstream igaming built on @openora/*. Writes and runs Playwright E2E tests against the operator's local stack. Uses Chrome DevTools MCP for network/console/DOM inspection. Escalates domain questions to expert and confirmed bugs to builder. Distinguishes bugs in OSS core (upstream issue) from bugs in operator overlays (local fix).
+---
+
+You are a QA engineer for a downstream igaming built on the OSS igaming platform. You write Playwright E2E tests, debug failures using Chrome DevTools, and triage bugs - distinguishing issues in OSS core (report upstream) from issues in operator overlays (fix locally).
+
+## Grounding (do this first)
+
+1. Run `list-routes` (MCP) to get the full API surface - platform defaults plus operator-registered routes.
+2. Run `catalog-overview` to understand what modules are active and what their expected behavior is.
+3. Read the operator's `extensions.config.ts` to know which overlays and adapters are active.
+
+## Local stack
+
+The OSS platform is headless (API + modules only) - the player app and backoffice are the operator's OWN frontends, not shipped by the platform. A typical operator stack:
+
+| Service    | Default URL           | Provided by                           |
+| ---------- | --------------------- | ------------------------------------- |
+| API        | http://localhost:3001 | OSS platform (`@openora/api-runtime`) |
+| Player app | http://localhost:3000 | operator                              |
+| Backoffice | http://localhost:3002 | operator                              |
+
+Seed credentials (after `pnpm seed`): `admin@oss.dev` / `password123`
+
+Confirm actual ports and which UIs exist with the operator - they may have only an API, or a single combined app.
+
+## Test suite location
+
+E2E tests in `apps/e2e/`. If missing, scaffold:
+
+```bash
+mkdir -p apps/e2e && cd apps/e2e
+pnpm init && pnpm add -D @playwright/test
+npx playwright install chromium
+```
+
+Test structure: `apps/e2e/tests/<domain>/<scenario>.spec.ts`
+
+## Debugging with the chrome-devtools MCP
+
+Use the **chrome-devtools** MCP (navigate, fill forms, inspect console/network, evaluate scripts, screenshot):
+
+1. open a tab
+2. navigate to the URL under test
+3. fill the form / click -> reproduce the user action
+4. read console messages -> JS errors, unhandled rejections
+5. inspect network requests -> API calls, status codes, response shapes
+6. evaluate a script -> query DOM state
+7. take a screenshot -> capture UI state at failure point
+
+## Bug triage - the key question
+
+Before escalating any bug, determine: **is this in OSS core or in the operator's overlay?**
+
+| Location          | Evidence                                                                                               | Action                      |
+| ----------------- | ------------------------------------------------------------------------------------------------------ | --------------------------- |
+| OSS core          | Fails in a fresh consumer scaffolded via `pnpm create:app` too, or in a clean install with no overlays | Report upstream to OSS repo |
+| Operator overlay  | Only fails with the operator's specific plugins/adapters active                                        | Escalate to `builder`       |
+| Domain rule wrong | Behavior is technically consistent but violates igaming rules                                          | Escalate to `expert`        |
+
+### Severity levels
+
+| Level | Criteria                                            | Action                                      |
+| ----- | --------------------------------------------------- | ------------------------------------------- |
+| P0    | Blocks money movement, auth, or core game loop      | Immediate - `builder`                       |
+| P1    | Wrong business logic (wrong balance, bad geo-block) | Domain confirm via `expert`, then `builder` |
+| P2    | UI broken, API returns wrong shape                  | Escalate if blocking                        |
+| P3    | Cosmetic, edge case                                 | Document, don't block                       |
+
+## Core flows to test (priority order)
+
+1. Auth - register, login, logout, bad credentials
+2. Wallet - balance, deposit, withdraw, history
+3. Gaming - catalogue, start/end round, balance deduction
+4. Bonus - claim, wagering progress
+5. Compliance - deposit limit enforcement, geo-block
+6. Backoffice - admin login, player list, KYC status
+7. Operator-specific overlays - test each active plugin
+
+## Rules
+
+- Don't modify platform or overlay code to make a test pass - report and escalate.
+- Assert on user-visible outcomes, not React component internals.
+- If the local stack isn't running, say so clearly with the start command.
+- Don't commit unless asked.

package/template/apps/api/package.json.tpl

@@ -0,0 +1,21 @@
+{
+  "name": "@{{name}}/api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "dev": "node --import tsx --watch --env-file-if-exists=../../.env src/main.ts",
+    "start": "node --import tsx --env-file-if-exists=../../.env src/main.ts",
+    "db:migrate": "node --import tsx --env-file-if-exists=../../.env src/migrate.ts",
+    "db:seed": "node --import tsx --env-file-if-exists=../../.env src/seed.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@openora/core": "{{coreVersion}}"
+  },
+  "devDependencies": {
+    "tsx": "4.22.2",
+    "typescript": "6.0.3"
+  }
+}

package/template/apps/api/src/extensions.config.ts.tpl

@@ -0,0 +1,22 @@
+import { corePlugins, type PluginEntry } from '@openora/core/server';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Your plugin registry. `corePlugins()` returns every built-in platform plugin,
+// resolved from the installed @openora/core. Add your own overlays after it - a
+// later registration of a DI token wins, so an adapter override must come after
+// the module it replaces. Opt a core module out with a filter, eg
+// `corePlugins().filter((p) => p.id !== 'chat')`.
+
+// Local overlays live alongside this file, under src/extensions/<name>/.
+const LOCAL = resolve(dirname(fileURLToPath(import.meta.url)), 'extensions');
+
+export const extensions: PluginEntry[] = [
+  ...corePlugins(),
+
+  // Your overlays. Generate with `pnpm gen plugin` / `pnpm gen adapter`.
+  // Example (loaded after `wallet` so its PAYMENT_ADAPTER binding wins):
+  // { id: 'my-payment', path: `${LOCAL}/my-payment/plugin.ts` },
+];
+
+void LOCAL;

package/template/apps/api/src/main.ts.tpl

@@ -0,0 +1,84 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createApp, loadExtensions } from '@openora/core/server';
+import { composeContract, defineIgamingConfig } from '@openora/core/contracts';
+import {
+  user,
+  session,
+  account,
+  verification,
+  twoFactor,
+} from '@openora/core/pam/schema/identity';
+import { identityContract } from '@openora/core/pam/contracts/identity';
+import { complianceContract } from '@openora/core/compliance/contracts';
+import { profileContract } from '@openora/core/pam/contracts/profile';
+import { cmsContract } from '@openora/core/cms/contracts';
+import { notificationsContract } from '@openora/core/engagement/contracts/notifications';
+import { chatContract } from '@openora/core/engagement/contracts/chat';
+import { walletContract } from '@openora/core/wallet/contract';
+import { gamingContract } from '@openora/core/casino/contracts/gaming';
+import { lobbyContract } from '@openora/core/casino/contracts/lobby';
+import { backofficeContract } from '@openora/core/admin-console/contract';
+import { iamContract } from '@openora/core/iam/contract';
+import { auditContract } from '@openora/core/audit/contract';
+
+const contract = composeContract({
+  identity: identityContract,
+  cms: cmsContract,
+  compliance: complianceContract,
+  notifications: notificationsContract,
+  wallet: walletContract,
+  gaming: gamingContract,
+  chat: chatContract,
+  lobby: lobbyContract,
+  backoffice: backofficeContract,
+  profile: profileContract,
+  iam: iamContract,
+  audit: auditContract,
+});
+
+// Declarative platform config, validated at the boundary by defineIgamingConfig.
+// Injected app-wide via the IGAMING_CONFIG token so services/adapters can read it.
+const igaming = defineIgamingConfig({
+  branding: {
+    name: '{{name}}',
+    themePreset: 'midnightSapphire',
+    supportEmail: 'support@{{name}}.example',
+  },
+  currencies: ['EUR', 'USD'],
+  jurisdictions: ['DE', 'GB'],
+  blockedCountries: ['US'],
+  limits: {
+    maxDepositPerDay: 1000,
+    maxStakePerBet: 100,
+    sessionReminderMinutes: 60,
+  },
+  providers: {
+    payment: 'mock',
+  },
+});
+
+// loadExtensions() walks up from the working dir; point it at the registry sitting
+// next to this entry so booting from any cwd resolves it (it lives under src/, which
+// the upward walk would otherwise miss). An explicit env override still wins.
+process.env['EXTENSIONS_CONFIG'] ??= resolve(
+  dirname(fileURLToPath(import.meta.url)),
+  'extensions.config.ts',
+);
+
+async function bootstrap() {
+  const { listen, emitOpenApiSpec } = await createApp({
+    plugins: await loadExtensions(),
+    contract,
+    authSchema: { user, session, account, verification, twoFactor },
+    igaming,
+    port: Number(process.env['PORT'] ?? 3001),
+    cors: { origins: process.env['CORS_ORIGINS']?.split(',') ?? '*' },
+    openapi: { info: { title: '{{name}} API', version: '0.1.0' } },
+  });
+
+  await listen();
+  await emitOpenApiSpec();
+}
+
+void bootstrap();

package/template/apps/api/src/migrate.ts.tpl

@@ -0,0 +1,46 @@
+/**
+ * Migration runner. Applies every enabled @openora/core migration set against
+ * DATABASE_URL (or DATABASE_ADMIN_URL). Resolves @openora/core from node_modules,
+ * so it works whether the package is a local `link:` or a published npm install -
+ * no platform checkout required. Each set tracks itself in its own table, so order is
+ * not load-bearing and re-runs are idempotent. See ADR-0027.
+ *
+ * Usage: pnpm db:migrate  (run before db:seed). Requires DATABASE_URL.
+ * Add or remove a line to match the modules you enable in extensions.config.ts.
+ */
+const sets: ReadonlyArray<readonly [string, string]> = [
+  ['engine outbox', '@openora/core/server/migrate'],
+  ['audit', '@openora/core/audit/migrate'],
+  ['iam', '@openora/core/iam/migrate'],
+  ['identity', '@openora/core/pam/migrate/identity'],
+  ['profile', '@openora/core/pam/migrate/profile'],
+  ['wallet', '@openora/core/wallet/migrate'],
+  ['gaming', '@openora/core/casino/migrate/gaming'],
+  ['lobby', '@openora/core/casino/migrate/lobby'],
+  ['chat', '@openora/core/engagement/migrate/chat'],
+  ['notifications', '@openora/core/engagement/migrate/notifications'],
+  ['compliance', '@openora/core/compliance/migrate'],
+  ['cms', '@openora/core/cms/migrate'],
+];
+
+async function main() {
+  if (!process.env['DATABASE_ADMIN_URL'] && !process.env['DATABASE_URL']) {
+    console.error('Cannot run migrations: set DATABASE_URL (or DATABASE_ADMIN_URL).');
+    process.exit(1);
+  }
+
+  for (const [label, specifier] of sets) {
+    process.stdout.write(`\n> migrate ${label}\n`);
+    const { migrate } = (await import(specifier)) as { migrate: () => Promise<void> };
+    await migrate();
+  }
+
+  process.stdout.write(`\nDone: ${sets.length} migration set(s) applied.\n`);
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((e) => {
+    console.error('\nMigrate failed:', e);
+    process.exit(1);
+  });

package/template/apps/api/src/seed.ts.tpl

@@ -0,0 +1,39 @@
+/**
+ * Reference-data seeder. Composes the module seeders you enable (e.g. IAM's
+ * predefined roles) and runs them - convergent upserts, safe on every deploy.
+ *
+ * Standalone one-shot script (mirrors the migration runner): needs only a DB
+ * connection, never boots the app. Add a module's seeder by importing + calling it.
+ *
+ * Usage: pnpm db:seed  (run after db:migrate). Requires DATABASE_URL.
+ * Does NOT include demo data (fixtures, fake players) - that is dev-only.
+ */
+import { createDrizzleDb } from '@openora/core/server';
+import { seedRoles } from '@openora/core/iam/seed';
+// import additional module seeders here as you enable them
+
+async function main() {
+  if (process.env['NODE_ENV'] === 'production') {
+    console.error('Refusing to seed in production. This script is dev/local only.');
+    process.exit(1);
+  }
+
+  const databaseUrl = process.env['DATABASE_URL'];
+  if (!databaseUrl) {
+    console.error('DATABASE_URL env var not set');
+    process.exit(1);
+  }
+
+  const db = createDrizzleDb(databaseUrl);
+
+  await seedRoles(db);
+  // await seedOtherModule(db);
+  console.log('Reference data seeded.');
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((e) => {
+    console.error('\nSeed failed:', e);
+    process.exit(1);
+  });

package/template/apps/api/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@openora/core/tsconfig/node-service.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src"]
+}

package/template/docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: oss_igaming
+    ports:
+      - '5432:5432'
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres']
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+volumes:
+  postgres_data:

package/template/package.json.tpl

@@ -0,0 +1,32 @@
+{
+  "name": "{{name}}",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "turbo run dev",
+    "build": "turbo run build",
+    "typecheck": "turbo run typecheck",
+    "lint": "oxlint .",
+    "sync:agents": "rulesync generate",
+    "prepare": "rulesync generate",
+    "db:migrate": "pnpm -F @{{name}}/api db:migrate",
+    "db:seed": "pnpm -F @{{name}}/api db:seed",
+    "gen": "turbo gen"
+  },
+  "devDependencies": {
+    "@openora/mcp": "latest",
+    "@turbo/gen": "2.9.14",
+    "@types/node": "25.9.0",
+    "oxlint": "1.64.0",
+    "rulesync": "8.25.0",
+    "tsx": "4.22.2",
+    "turbo": "2.9.14",
+    "typescript": "6.0.3"
+  },
+  "engines": {
+    "node": ">=22.0.0",
+    "pnpm": ">=10.0.0"
+  },
+  "packageManager": "pnpm@11.5.2"
+}

package/template/pnpm-workspace.yaml.tpl

@@ -0,0 +1,8 @@
+packages:
+  - 'apps/*'
+
+allowBuilds:
+  esbuild: true
+  msgpackr-extract: true
+  sharp: true
+  tldjs: false

package/template/rulesync.jsonc

@@ -0,0 +1,26 @@
+// rulesync config - single source of truth for all AI-agent instruction files.
+// Source lives in .rulesync/ (rules, subagents, commands, mcp.json).
+// Regenerate with `pnpm sync:agents`; CI checks with `pnpm sync:agents:check`.
+{
+  "$schema": "https://github.com/dyoshikawa/rulesync/releases/latest/download/config-schema.json",
+
+  // Agents this repo targets, with per-target features. agentsmd is rules-only so
+  // AGENTS.md stays a clean human brief (no simulated-command boilerplate).
+  // Hooks + permissions are NOT managed here - .claude/settings.json is hand-maintained
+  // (it holds the guard hooks), so rulesync never clobbers it.
+  // codexcli: rules (AGENTS.md) + mcp (.codex/config.toml) only - its commands/
+  // subagents are simulation-only (kept off) and it has no hooks system.
+  "targets": {
+    "agentsmd": ["rules"],
+    "claudecode": ["rules", "mcp", "subagents", "commands", "skills"],
+    "copilot": ["rules", "mcp", "subagents", "commands", "hooks"],
+    "codexcli": ["rules", "mcp"],
+  },
+
+  // rulesync emits Copilot agents/prompts natively - no simulation needed.
+  "simulateCommands": false,
+  "simulateSubagents": false,
+
+  // Never bulk-delete output dirs (eg .github also holds workflows).
+  "delete": false,
+}

package/template/turbo/generators/config.ts

@@ -0,0 +1,2 @@
+// To customize, replace this re-export with your own plop config.
+export { default } from '@openora/turbo-generators';

package/template/turbo.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://turbo.build/schema.json",
+  "ui": "tui",
+  "tasks": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["dist/**", ".next/**", "!.next/cache/**"]
+    },
+    "dev": {
+      "cache": false,
+      "persistent": true
+    },
+    "typecheck": {
+      "dependsOn": ["^build"]
+    }
+  }
+}