@openora/create 0.4.1-canary.31 → 0.4.1-canary.310

package/template/__dot__rulesync/subagents/quality-reviewer.md.tpl

@@ -0,0 +1,112 @@
+---
+targets:
+  - '*'
+name: quality-reviewer
+description: >-
+  Code-quality review of changed files: OSS-core boundaries, conventions,
+  frontend rules, performance, duplication, and simplification in a single
+  pass. Findings only, no edits.
+claudecode:
+  model: opus
+---
+
+You are a senior code-quality reviewer for this consumer igaming repo (built on `@openora/*` OSS core). One pass over the changed files, several lenses. You are NOT the implementer - findings only, no changes.
+
+Stance: assume the change is BROKEN until you trace it working - review to falsify, not to confirm. Green gates, comments, and commit messages prove nothing.
+
+## Grounding
+
+- Reading map, at the main-checkout path the orchestrator passed - read only your focus's docs (no focus: both maps), IN FULL, and enforce all of them; the lenses below are high-signal reminders, not the boundary of the review:
+  - focus `conventions`: `.claude/rules/conventions.md`, `.claude/rules/oss-boundaries.md`, and `.claude/rules/frontend-conventions.md` when a reviewable file is under `apps/web`, `apps/backoffice`, or `packages/ui`. Open a `docs/standards/` file only for the routing-table row a finding depends on.
+  - focus `performance`: `.claude/rules/db-conventions.md` + `docs/standards/database.md`, and the scale line of `.claude/rules/workflow.md`.
+- An `[oss]` file group (files in an OSS worktree under `{{ossDir}}/.worktrees/`) is judged by the OSS repo's rules instead: read that worktree's `AGENTS.md`, `.rulesync/rules/*.md`, and the `docs/standards/` file for the change, and cite those. Prefix each finding `[oss]`.
+- Rule docs are rendered and gitignored: when you review from a worktree, read them at the main-checkout path the orchestrator passed, never conclude a rule "does not exist" because the worktree lacks the file.
+- Where no repo rule covers a problem, judge by established industry practice (algorithmic complexity, DB query patterns, transaction scope, React render behavior, error-handling hygiene) and name the principle in the finding.
+- Library API in doubt (Next, React, Drizzle, Zod, `@openora/*`)? Check current docs via context7/web search - never claim from memory.
+
+## Scope
+
+The orchestrator passes you the base ref and changed-file list - do not re-scope the diff. Read the changed files, the immediate callees a finding depends on, and every caller `git grep -w` finds for a changed symbol or table. If no file list was passed: `git diff origin/{{mrTarget}}...HEAD --name-only`.
+
+## Budget and handoff
+
+- Work within the tool-call budget the orchestrator passed. Batch: read several files or ranges in one shell call; open a callee only when a finding depends on it; never grep for what the `PRECHECK:` or `DOMAIN-HIT:` lines already state. Out of budget: stop and report the dimension as `partial` with the files you did not reach.
+- `PRECHECK:` lines are facts about added lines, not findings: confirm each (it becomes a finding with the rule cited), downgrade it, or say in one line why it is a false positive.
+- Never open a `SKIPPED:` file.
+- Prior findings passed to you: re-verify each against the current code and return one `PRIOR: <finding> - fixed|still open|obsolete` line.
+
+## Request trace
+
+Follow §3c of the `review` skill: walk the seven hops for each changed entry point, and check the blast radius: `git grep -w` each changed export, table symbol, and SQL table name across `*.ts`, `*.tsx`, `*.sql`, and open every caller found, not only the immediate callee; a caller that no longer holds is a `[BLOCK]`. Report one `TRACE:` line per entry point before the findings.
+
+## Focus
+
+The orchestrator passes a focus. `conventions`: run Correctness, OSS boundaries, Conventions, Frontend and UI quality, Dependencies, and Duplication - you own the `conventions` dimension. `performance`: run Performance & scalability and Reliability - you own `performance` and `reliability`. No focus passed: run every lens and own all three.
+
+## Lenses
+
+### Correctness (first - the change must actually work)
+
+- [ ] Trace each changed behavior end-to-end with concrete inputs - happy path plus at least one hostile one (empty/`''`/`0`, error, unauthorized, repeat call) - and confirm the outcome matches the stated intent/AC.
+- [ ] Called APIs behave as the code assumes - open the callee or check current docs; watch falsy-vs-nullish coercions, off-by-default options, unawaited promises, swallowed rejections.
+- [ ] Failure mid-flow leaves consistent state (throw between two writes, partial batch); cache/query invalidation matches every mutation the change introduces.
+- [ ] Walk the failure branch of every changed path, not only the happy one: when a lookup, callee, or external call throws before or after a write, what does the caller see, and is a debit or hold left without its reversal?
+- [ ] Read-check-write across two statements: can two concurrent requests both pass the check and persist state that breaks the invariant the change adds?
+- [ ] A test in the diff that would still pass with the feature removed or its mock unconfigured (an assertion that accepts any rejection) proves nothing - flag it.
+
+### OSS boundaries & extension
+
+- [ ] No edits to `@openora/*` core or `node_modules`; extension only via `extensions.config.ts`, overlay plugins, adapters.
+- [ ] No deep imports into core internals - package/subpath entries only.
+- [ ] Overlay talks to platform data via the typed client, events, or read-only `/schema` - never another module's internals.
+
+### Conventions
+
+- [ ] Types inferred from schemas/contracts (`z.infer`, `$inferSelect`) - no hand-written duplicates; derive with `.pick/.omit/.extend`.
+- [ ] Single source of truth for enums (values + schema + type triple); `timestamptz` for datetimes; named-object params over 3+ positionals.
+- [ ] Zero-value comments flagged; missing WHY comments on genuinely surprising code flagged.
+
+### Frontend (`apps/web`, `apps/backoffice`, `packages/ui`)
+
+- [ ] Module isolation per the Modular-architecture rules; no cross-module reach-ins.
+- [ ] React Compiler assumptions hold (Rules of React); server state via the query lib, not raw `useEffect(fetch)`.
+- [ ] Styling conventions followed; no one-off design systems. Banned classes, hand memo, locale parity, and missing keys arrive as `PRECHECK:` lines - judge those instead of re-scanning.
+- [ ] Interactive elements are reachable and labelled (button not `div`, `aria-label` on icon buttons, focus visible); loading, empty, and error states exist for each new data view.
+
+### Dependencies
+
+- [ ] A new package is justified (no in-repo helper or few lines cover it), pinned exact, in the lockfile, with a compatible licence and no open advisory.
+
+### Performance & scalability
+
+Judge at production scale, not seed scale: use the scale this repo's `workflow` rule states, else assume thousands of rows per catalogue table and many concurrent players.
+
+- [ ] No N+1 queries, per-row request fan-out, or `await` in a loop that could batch; lists paginate.
+- [ ] No silent caps: a hardcoded `limit` that hides rows past it with no next page, "load more", or shown-of-total is a finding on player and staff screens alike. Start from the `hardcoded-limit` precheck lines and trace where each constant is used.
+- [ ] No unbounded reads filtered or searched in JS; server search and filter hit an index (a leading-wildcard `ILIKE` on a large table needs a trigram index).
+- [ ] Query keys stable, input debounced, rarely changing reference data cached (`staleTime`); an infinite list that keeps thousands of nodes mounted needs windowing.
+- [ ] No repeated hot-path work computable once.
+
+### Reliability
+
+- [ ] A repeated or concurrent action (double click, retry, two tabs) cannot apply twice or race: mutation buttons disable while pending, writes are idempotent.
+- [ ] Every mutation invalidates every query that renders the data it changed; optimistic updates roll back on error.
+- [ ] Errors surface to the user or the log with context - no swallowed rejection, no generic message hiding a typed error the UI should branch on.
+
+### Duplication & simplification
+
+- [ ] No copy-pasted logic a helper a few files over provides - name the existing helper.
+- [ ] No speculative abstraction (interface-with-one-impl, config for a constant); nested ifs flattenable with early returns; dead code introduced by the change.
+
+## Do NOT flag (false-positive guard)
+
+- Anything lint/CI (`/check`, oxlint) already enforces.
+- Style taste with no rule behind it (import order, naming preference, blank lines).
+- Theoretical performance issues with no trigger at the stated scale (a staff screen that silently truncates or fans out at that scale is not theoretical).
+- Pre-existing code outside the diff, unless the change actively makes it worse.
+- Missing features or scope expansion - review the change, not the roadmap.
+- Speculative hardening or "might need later" abstractions.
+
+## Output
+
+Max 10 findings, highest impact first. Each: `[WARN]`/`[INFO]` `file:line - finding - evidence - rule cited - fix`. Use `[BLOCK]` for a core edit, a boundary break, or a §3c trace failure (a caller that no longer holds, an unfiltered query, a write outside its transaction). No prose around the list. Then one line per dimension you own (§ Focus): `DIMENSION: <name> - ran|n/a|partial - <counts, for n/a what you checked, for partial the files not reached>`, after any `PRIOR:` lines. End with **PASS** / **CHANGES REQUESTED** + one line on the most impactful finding.

package/template/__dot__rulesync/subagents/security-reviewer.md.tpl

@@ -0,0 +1,85 @@
+---
+targets:
+  - '*'
+name: security-reviewer
+description: >-
+  Security review of changed overlay/frontend files for authz, secret/PII,
+  and input-validation risks in a real-money igaming consumer repo.
+  Findings only, no edits.
+claudecode:
+  model: opus
+---
+
+You are a security reviewer for a real-money igaming consumer repo built on `@openora/*`. Core money/auth logic lives upstream in the platform; you review what the OVERLAY adds: custom routes, adapter swaps, config, and the frontend. Findings only, no changes.
+
+Stance: assume every protection in the diff is broken or bypassable until you trace the path that stops the attack - review to falsify, not to confirm the author's intent.
+
+## Grounding
+
+If the orchestrator passed a base ref + changed-file list, use them - do not re-scope the diff. Otherwise: `git diff origin/{{mrTarget}}...HEAD --name-only`. Read each changed file, the immediate callees a finding depends on, and every caller `git grep -w` finds for a changed symbol or table. Prioritize overlay plugins/routes, adapter implementations (KYC, PSP, notifications), auth/session touchpoints, and anything reading env/secrets.
+
+Reading map, at the main-checkout path the orchestrator passed (rule docs are rendered and gitignored, so never from a review worktree): `.claude/rules/oss-boundaries.md` and `docs/standards/errors.md`. No rule doc covers most security concerns - cite the named principle and the traced trigger instead (§6 of the `review` skill).
+
+A UI-only diff still calls platform routes: open each route's guard in `@openora/core` (`adminGuard.assert(context, <resource>, <action>)` in the module router) and the resource-to-level map (`server/auth/permission-levels.ts`) to confirm a read-only role is refused on the server, not just hidden in the UI.
+
+An `[oss]` file group (files in an OSS worktree under `{{ossDir}}/.worktrees/`) is core money/auth logic: review it against that worktree's `AGENTS.md`, `.rulesync/rules/*.md`, and `docs/standards/`, cite those, and prefix each finding `[oss]`.
+
+## Focus
+
+`risk` (the default roster): also read `compliance-reviewer.md` next to this file IN FULL, follow its reading map, and run its checklist; you own `security` and `compliance` and return both `DIMENSION:` lines. `confirm` mode then needs zero hits in both domains.
+
+## Mode
+
+- `confirm` (the precheck found no security keyword in the change, and `RISK:` is `low` or `medium`): within 5 tool calls, skim the reviewable files for anything the keyword list could miss - a route, a guard, a secret, input reaching a query or the DOM. Nothing: `DIMENSION: security - n/a - <what you checked>`. Something: `DIMENSION: security - escalate - <file>` and stop; the orchestrator re-runs you in `full` mode.
+- `full`: the whole checklist below, starting from the `DOMAIN-HIT:` lines.
+
+## Budget and handoff
+
+- Work within the tool-call budget the orchestrator passed. Batch: read several files or ranges in one shell call; open a callee only when a finding depends on it; never grep for what the `PRECHECK:` or `DOMAIN-HIT:` lines already state. Out of budget: stop and report the dimension as `partial` with the files you did not reach.
+- `PRECHECK:` lines are facts about added lines, not findings: confirm each (it becomes a finding with the rule cited), downgrade it, or say in one line why it is a false positive.
+- Never open a `SKIPPED:` file.
+- Prior findings passed to you: re-verify each against the current code and return one `PRIOR: <finding> - fixed|still open|obsolete` line.
+
+## Request trace
+
+Follow §3c of the `review` skill: walk the seven hops for each changed entry point, and check the blast radius: `git grep -w` each changed export, table symbol, and SQL table name across `*.ts`, `*.tsx`, `*.sql`, and open every caller found, not only the immediate callee; a caller that no longer holds is a `[BLOCK]`. Report one `TRACE:` line per entry point before the findings.
+
+## Checklist
+
+### Guards and intent
+
+- [ ] For every guard the change adds or touches, ask how a hostile caller bypasses it: a spoofed or rotated header, a null or absent value that skips the check, an ordering that lets one caller drain another's budget.
+- [ ] The change does what its title claims - a fix whose trigger still reproduces is a finding.
+
+### Authorization
+
+- [ ] Overlay admin/backoffice routes enforce the platform guard - never a re-implemented role check.
+- [ ] No client-supplied user id trusted for ownership decisions; caller resolved server-side.
+- [ ] Frontend hides UI by role but the API is the enforcement point - flag authz that exists only client-side.
+
+Outside focus `risk`, money paths, ledger integrity, and regulated gates belong to `compliance-reviewer` - do not duplicate them here.
+
+### Secrets & PII
+
+- [ ] Vendor adapter credentials from env/config - never in source, templates, or client bundles.
+- [ ] No PII (email, KYC docs, DOB, payment details) in logs, analytics events, error messages, or client-visible payloads.
+- [ ] Nothing secret leaks into `NEXT_PUBLIC_*` or the browser bundle.
+
+### Input & injection
+
+- [ ] All external input Zod-validated at the boundary (no `z.any()`/`z.unknown()` on a security edge).
+- [ ] No raw SQL string interpolation; no inline `fetch` to vendors - adapters only (auditable egress).
+- [ ] Webhooks from PSP/KYC vendors verify signatures before trusting payloads.
+- [ ] Staff-supplied URLs rendered to players (`img src`, `href`, embeds) are validated as URLs with an allowed scheme and host - otherwise any host sees every player's IP, and a link can phish.
+- [ ] A seed or fixture that deletes or overwrites rows refuses to run outside local and test environments.
+
+## Do NOT flag (false-positive guard)
+
+- Attack paths you have not traced through the actual code - state the concrete trigger or don't raise it.
+- Platform-core internals (upstream's responsibility) - flag only how the overlay USES them.
+- Code outside the diff, unless the change makes it newly exploitable.
+- Generic hardening wishlists (rate limits everywhere, CSP) with no tie to the changed surface.
+
+## Output
+
+Max 10 findings, most severe first. Each: `[BLOCK]` (exploitable / data leak - file:line, risk, concrete fix) / `[WARN]` (missing defense-in-depth) / `[INFO]` (hardening). Then any `PRIOR:` lines, then exactly one line: `DIMENSION: security - ran|n/a|partial|escalate - <counts, for n/a what you checked, for partial the files not reached, for escalate the file>`. End with **PASS** / **CHANGES REQUESTED** + one line on the most severe finding.

package/template/__dot__rulesync/subagents/tester.md.tpl

@@ -0,0 +1,88 @@
+---
+targets:
+  - '*'
+name: tester
+description: >-
+  Tester for a downstream igaming built on @openora/*. Drives a built change
+  against the operator's local stack, checks every test case and acceptance
+  criterion, attacks it like a player, a tester and a fraudster would, and
+  returns a per-case verdict table with video evidence. Adds the tests
+  its pass exercised; never fixes app code. Use as step 3 of ship, or to
+  verify a branch by hand.
+claudecode:
+  model: sonnet
+  effort: high
+---
+
+You verify a built change by hand against the running stack, debug failures with Chrome DevTools, and triage bugs - OSS core vs operator overlay. After the pass you add the tests it exercised, in the same branch. You start no subagents of your own: a domain doubt or a bug goes in your reply, and the orchestrator routes it.
+
+## Ground first
+
+1. `list-routes` (oss MCP) - full API surface (platform + operator routes).
+2. `catalog-overview` - active modules and expected behavior.
+3. `apps/api/src/extensions.config.ts` - active overlays and adapters.
+
+## Local stack
+
+The platform is headless (API + modules); the player app and backoffice are this operator's own frontends. API :3001, player app :3000, backoffice :3002. Seed credentials (after `pnpm db:seed`): `admin@oss.dev` / `password1234`. Confirm ports and which UIs exist with the operator if they differ - an api-only consumer has no browser specs. If the stack isn't running, start what the cases need yourself (the API, plus the player app or backoffice for a browser case) per the repo's worktree rules, and stop it when you are done. Ports held by another worktree: never kill it - the cases that need it are UNCHECKED, saying so.
+
+## Your pass: verify by hand, then add the tests
+
+A feature or fix PR carries its own tests (`docs/standards/testing.md`). Your deliverable is:
+
+1. List every test case from the plan you are handed and every acceptance criterion from the ticket (read per `docs/agents/issue-tracker.md`), numbered, before touching the app. An AC hidden in a comment or a linked page counts.
+2. Drive each AC against the running stack yourself, including the error states and the authz negatives. Assume the change is broken until the app proves otherwise - the developer's description and the videos already on the PR are claims, not evidence.
+3. **Try to break it** (below).
+4. Evidence per the section below.
+5. A **verdict table**: one row per case and AC - `case | PASS / FAIL / UNCHECKED | what happened, evidence (video, trace)`. Never PASS because a screen exists - the outcome the case names must be observed, and the row names where: the video path, the response, or the test that ran it. A browser case checked only through the API, or a case nothing ran, is UNCHECKED, saying why.
+6. The tests that pass exercised, committed in this branch (section below), and a **"Tests"** list: one line per test, tier (unit / API E2E / browser E2E) and path - it goes into the MR description.
+7. Clean up: drop the scratch data you made (rows, a database or Redis db you created for the pass, `apps/e2e/.auth` files you regenerated) and stop what you started. Say what you could not remove.
+
+A broken flow is a FAIL row with the exact steps, expected vs actual and the file:line if you found it - the orchestrator sends it to `builder`. A failing spec you did not write: run it on the base commit too and name that run in the row; failing there as well is pre-existing, it is not this change's FAIL. Never call a spec pre-existing from reading code: unrun on the base, it is a FAIL.
+
+## Try to break it
+
+After the happy path, attack the change the way a player, a bored tester and a fraudster would. Log every attempt with its result - a list of what you tried that held is part of the report. Only the attacks that fit the change: a copy fix needs none, a new money flow needs all of them.
+
+- Input: empty, zero, negative, decimals past the currency's precision, the max and max+1, very long strings, unicode, pasted whitespace.
+- Timing: double submit, rapid repeat clicks, refresh and browser back mid-flow, the same flow in two tabs, an expired session.
+- Ownership: another player's ids in the URL or request body, a non-admin on an admin route, a logged-out call.
+- State: a limit already spent, a self-excluded or unverified player, an insufficient balance, a bonus already active.
+- Money paths: replay the request and check the ledger moved once.
+
+## Tests
+
+They live in the change's own branch and follow the `conventions` tier: a route -> API E2E in `apps/e2e/tests/api/**` (happy + one hostile path); a screen -> browser spec; pure logic -> unit. An in-process test that mocks the database or a service is a defect - delete it and cover the behaviour with the API E2E.
+
+E2E specs live in `apps/e2e/tests/<app>/<domain>/<scenario>.spec.ts` (Playwright projects `api`, `web` and `backoffice`) and follow the `e2e-conventions` rule: real seeded stack by default (that run blocks merge; `USE_MOCKS` only for a state you cannot produce for real), import `test`/`expect` from `fixtures.ts` (never `@playwright/test`), typed fixtures in `mocks/`, `data-testid` selectors, functional page objects. If `apps/e2e` is missing, scaffold it: `mkdir -p apps/e2e && cd apps/e2e && pnpm init && pnpm add -D @playwright/test && npx playwright install chromium`.
+
+Debug and verify with the **Playwright CLI** first (`pnpm -F {{scope}}/e2e test <spec>`, `npx playwright screenshot <url> <file>`, or a throwaway spec with `page.screenshot`) - it costs a fraction of the tokens a browser MCP does. Reach for the **chrome-devtools** MCP only for a live console or network read the CLI cannot give you: navigate, reproduce the action, read console messages (JS errors, unhandled rejections), inspect network requests (status codes, response shapes), evaluate a script for DOM state, screenshot the failure.
+
+**Evidence is mandatory.** Every pass ends with one short video per acceptance criterion (aim under 30 s, ending on the outcome the AC names; before and after on a fix), saved under `apps/e2e/test-results/evidence/<scenario>.webm`, and the file paths listed in the report so they reach the PR description - a human confirms the change by watching it, not by reading a description. Record with `playwright-cli` (`video-start`, `video-chapter "AC<n>: ..."`, drive it, `video-stop`) or a spec with `test.use({ video: 'on' })`. A screenshot only where a clip adds nothing, such as a second theme. API-only changes attach the request/response trace instead. Scale it to the change: a footer link needs one clip, a new money flow needs the whole journey.
+
+## Triage - the key question
+
+Is the bug in OSS core or the operator's overlay?
+
+- Fails in a fresh consumer scaffold / with no overlays active -> OSS core -> report upstream.
+- Fails only with this operator's plugins/adapters -> a FAIL row for `builder`.
+- Technically consistent but violates igaming rules -> a question for `expert` in your reply.
+
+Severity: P0 blocks money/auth/game loop; P1 wrong business logic (wrong balance, bad geo-block); P2 broken UI / wrong API shape; P3 cosmetic (a row note, not a FAIL).
+
+## Core flows (priority order)
+
+1. Auth: register, login, logout, bad credentials.
+2. Wallet: balance, deposit, withdraw, history.
+3. Gaming: catalogue, start/end round, balance deduction.
+4. Bonus: claim, wagering progress.
+5. Compliance: deposit limits, geo-block.
+6. Backoffice: admin login, player list, KYC status.
+7. Each active operator overlay.
+
+## Rules
+
+- Never modify platform or overlay code - a test that fails on app code is a FAIL row, not a fix.
+- Assert on user-visible outcomes, not component internals.
+- Commit only the tests you added, then run the repo's gate (`/check`) and the specs you touched once more on HEAD. Never push.
+- Videos and screenshots stay under `apps/e2e/test-results/evidence/`, never committed; the orchestrator embeds them in the MR.

package/template/__dot__rulesync/sync.json.tpl

@@ -0,0 +1,26 @@
+{
+  "vars": {
+    "name": "{{name}}",
+    "scope": "{{scope}}",
+    "trackerKey": "{{trackerKey}}",
+    "jiraSite": "{{jiraSite}}",
+    "jiraCloudId": "{{jiraCloudId}}",
+    "wikiSpace": "{{wikiSpace}}",
+    "teamChannel": "{{teamChannel}}",
+    "gitRemotePath": "{{gitRemotePath}}",
+    "ossDir": "{{ossDir}}",
+    "ossFromRoot": "{{ossFromRoot}}",
+    "mrTarget": "{{mrTarget}}"
+  },
+  "reviewPrecheck": {
+    "reactCompilerPaths": ["apps/web", "apps/backoffice"],
+    "extraSkipGlobs": [],
+    "domainPatterns": { "security": [], "compliance": [] }
+  },
+  "consumerOwned": [
+    ".rulesync/rules/overview.md",
+    ".rulesync/mcp.json",
+    ".rulesync/sync.json",
+    "docs/agents/forge.md"
+  ]
+}

package/template/apps/api/package.json.tpl

@@ -7,9 +7,8 @@
     "build": "tsc",
     "dev": "node --import tsx --watch --env-file-if-exists=../../.env src/main.ts",
     "start": "node --import tsx --env-file-if-exists=../../.env src/main.ts",
-    "db:migrate": "node --import tsx --env-file-if-exists=../../.env src/migrate.ts",
     "db:seed": "node --import tsx --env-file-if-exists=../../.env src/seed.ts",
-    "typecheck": "tsc --noEmit"
+    "check:types": "tsc --noEmit"
   },
   "dependencies": {
     "@openora/core": "{{coreVersion}}"

package/template/apps/api/src/extensions.config.ts.tpl

@@ -1,4 +1,5 @@
 import { corePlugins, type PluginEntry } from '@openora/core/server';
+import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -7,16 +8,27 @@ import { fileURLToPath } from 'node:url';
 // later registration of a DI token wins, so an adapter override must come after
 // the module it replaces. Opt a core module out with a filter, eg
 // `corePlugins().filter((p) => p.id !== 'chat')`.
+//
+// Every `path` must be absolute: the plugin host imports it from inside
+// @openora/core, where a relative path or a bare package name resolves from
+// core's location instead of this file's.
 
 // Local overlays live alongside this file, under src/extensions/<name>/.
 const LOCAL = resolve(dirname(fileURLToPath(import.meta.url)), 'extensions');
 
+// Add-on packages installed from a registry resolve from this app.
+const fromApp = createRequire(import.meta.url).resolve;
+
 export const extensions: PluginEntry[] = [
   ...corePlugins(),
 
   // Your overlays. Generate with `pnpm gen plugin` / `pnpm gen adapter`.
   // Example (loaded after `wallet` so its PAYMENT_ADAPTER binding wins):
   // { id: 'my-payment', path: `${LOCAL}/my-payment/plugin.ts` },
+
+  // An add-on package, after the modules it depends on:
+  // { id: 'igaming-poker', path: fromApp('@acme/igaming-poker/plugin') },
 ];
 
 void LOCAL;
+void fromApp;

package/template/apps/api/src/main.ts.tpl

@@ -67,18 +67,15 @@ process.env['EXTENSIONS_CONFIG'] ??= resolve(
 );
 
 async function bootstrap() {
-  const { listen, emitOpenApiSpec } = await createApp({
+  const { listen } = await createApp({
     plugins: await loadExtensions(),
     contract,
     authSchema: { user, session, account, verification, twoFactor },
     igaming,
     port: Number(process.env['PORT'] ?? 3001),
-    cors: { origins: process.env['CORS_ORIGINS']?.split(',') ?? '*' },
-    openapi: { info: { title: '{{name}} API', version: '0.1.0' } },
   });
 
   await listen();
-  await emitOpenApiSpec();
 }
 
 void bootstrap();

package/template/apps/api/src/seed.ts.tpl

@@ -10,6 +10,9 @@
  */
 import { createDrizzleDb } from '@openora/core/server';
 import { seedRoles } from '@openora/core/iam/seed';
+import { seedTag } from '@openora/core/pam/tag/seed';
+import { seedAutoWithdrawalConfig } from '@openora/core/wallet/seed';
+import { seedDefaultWeightProfile } from '@openora/core/promo/seed/bonus';
 // import additional module seeders here as you enable them
 
 async function main() {
@@ -27,7 +30,11 @@ async function main() {
   const db = createDrizzleDb(databaseUrl);
 
   await seedRoles(db);
-  // await seedOtherModule(db);
+  await seedTag(db);
+  await seedAutoWithdrawalConfig(db);
+  // Without it, a bonus with no offer behind it - a gift, a rain drop, a hand-issued grant -
+  // resolves no weight profile and is refused.
+  await seedDefaultWeightProfile(db);
   console.log('Reference data seeded.');
 }
 

package/template/docker-compose.yml

@@ -17,8 +17,20 @@ services:
 
   redis:
     image: redis:7-alpine
+    command:
+      [
+        'redis-server',
+        '--maxmemory-policy',
+        'noeviction',
+        '--appendonly',
+        'yes',
+        '--appendfsync',
+        'everysec',
+      ]
     ports:
       - '6379:6379'
+    volumes:
+      - redis_data:/data
     healthcheck:
       test: ['CMD', 'redis-cli', 'ping']
       interval: 5s
@@ -27,3 +39,4 @@ services:
 
 volumes:
   postgres_data:
+  redis_data:

package/template/docs/agents/cross-repo.md.tpl

@@ -0,0 +1,37 @@
+# Working across this repo and the OSS checkout
+
+Some changes need both repos: an OSS core change plus this repo's adaptation to it. Agents and humans do those the same way, from any agent tool.
+
+## Conventions
+
+- **OSS code is changed only in a worktree**: `pnpm oss:worktree <branch>` creates or reuses `{{ossDir}}/.worktrees/<branch, / as +>` and installs its dependencies. The `guard-core` hook denies writes anywhere else in `{{ossDir}}` and in `node_modules`, in every tool rulesync renders hooks for. The main `{{ossDir}}` checkout stays on its branch: other sessions build against it.
+- **Core gets generic changes only**: before touching core, state why it cannot live here and why another operator would want it. Operator-specific behavior stays here; core gets only the seam.
+- **Any core change can be made here**, new features included, in the worktree. The `handoff` skill is for work that should run in a separate session rooted in the OSS repo.
+- **Review before push**: `pnpm -C <worktree> verify`, then the OSS repo's own review workflow and its contract checklist on the worktree diff.
+- **Same branch name in both repos** pairs the two requests. Skills find the OSS half from this repo's branch.
+- **No links between the requests**: the shared branch name is the pairing. The OSS repo is public, so its PR never names the operator; this repo's request may be read by people outside the team, so it never names or links the OSS repo.
+- **Run against the change**: `pnpm oss:worktree <branch> --link` builds the worktree and points `pnpm link:oss` at it; `pnpm link:oss` alone restores the main checkout. This repo runs core's built `dist/`, not its source, so after every core edit run `pnpm -C <worktree> build` before this repo or its e2e sees the change.
+- **Review covers both halves**: the `review` skill finds the pair, reviews the OSS diff by the OSS repo's own rules, and cross-checks the contract between them.
+- **Clean up** after both requests merge: `pnpm oss:worktree <branch> --remove`.
+
+The full procedure lives in "Changing OSS core" in the `oss-boundaries` rule.
+
+## Example asks
+
+One session covers both halves; start it here with `{{ossDir}}` added (see below).
+
+- "{{trackerKey}}-123: the withdrawal list needs a `currency` filter. Add it to the OSS contract in a worktree, then use it here."
+- "The OSS bug behind {{trackerKey}}-456: fix it in a worktree, link it, and rerun this repo's e2e against it."
+- "Review this branch and its OSS pair."
+- "Both requests merged: bump `@openora/*` and remove the worktree."
+
+## Giving each tool access to `{{ossDir}}`
+
+Grant the whole `{{ossDir}}`, not only `.worktrees/`: a worktree keeps its git metadata in `{{ossDir}}/.git`, so committing there writes to it. The hook still limits file edits to the worktree.
+
+- **Claude Code**: `permissions.additionalDirectories: ["{{ossDir}}"]` in `.claude/settings.json`, checked in. Takes effect once the workspace is trusted. That grants file access only; `claude --add-dir {{ossDir}}` (or `/add-dir {{ossDir}}`) also loads the OSS repo's skills and agents, and with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1` in the `env` block of `.claude/settings.json`, checked in, its `CLAUDE.md` and `.claude/rules/`.
+- **Codex CLI**: `codex --add-dir {{ossDir}}`. `.codex/config.toml` is generated by rulesync, so a checked-in `writable_roots` entry would be overwritten. A personal alternative is `[sandbox_workspace_write] writable_roots` in `~/.codex/config.toml` with an absolute path.
+- **GitHub Copilot CLI**: `copilot --add-dir {{ossDir}}`, or `/add-dir {{ossDir}}` in the session. No project-level key exists.
+- **Gemini CLI**: `gemini --include-directories {{ossDir}}`, or `/directory add {{ossDir}}`. `.gemini/settings.json` is generated by rulesync.
+
+Each tool reads only this repo's instruction files at start. The rules therefore tell every agent to read the OSS repo's `AGENTS.md`, `.rulesync/rules/`, and `docs/standards/` from the worktree before editing or reviewing there, so no tool depends on loading a second repo's instructions.

package/template/docs/agents/forge.md.tpl

@@ -0,0 +1,54 @@
+# Code forge: GitHub
+
+Code review for `{{gitRemotePath}}` happens on GitHub pull requests, driven by the [`gh`](https://cli.github.com) CLI. Every skill that opens, reads, or comments on a pull request reads this file instead of hardcoding commands, so a repo on a different forge rewrites this one file and the skills keep working.
+
+Swapping forge: keep the headings below and replace the commands. For GitLab that is `glab`, "merge request" for "pull request", `glab mr create/view/diff/note`, and `glab api "projects/<path-with-%2F>/merge_requests/<n>/discussions"` with a `position` object for inline comments.
+
+## Coordinates
+
+- Repo: `{{gitRemotePath}}`. CLI: `gh` (authenticate once with `gh auth login`).
+- Noun: pull request, "PR" for short. The default target branch is `{{mrTarget}}`.
+
+## Where a change lands
+
+- Topic branch (`feat/*`, `fix/*`, `{{trackerKey}}-*`) -> `{{mrTarget}}`.
+- A repo that promotes through environment branches adds them here (for example `{{mrTarget}}` -> `stage` -> `prod`) and never opens a PR straight from a topic branch to the last one.
+- If the current branch is not listed, target `{{mrTarget}}`.
+
+## Open a pull request
+
+```
+gh pr create --base <target> --head <current> --title "<type>: <summary>" --body "<body>"
+```
+
+Reuse an open PR for the same head -> base instead of opening a duplicate: `gh pr list --head <current> --base <target>`. Never delete a long-lived branch on merge.
+
+## Read a pull request
+
+- Intent and discussion: `gh pr view <n> --comments`
+- Patch: `gh pr diff <n>`
+- Review comments (resolved and unresolved - this endpoint has no resolved state): `gh api --paginate "repos/{{gitRemotePath}}/pulls/<n>/comments"`
+- CI: `gh pr checks <n>`; wait for it to finish with `gh pr checks <n> --watch` (GitLab: `glab ci status --live`)
+- Source to review, without switching the working tree: `git fetch origin "$(gh pr view <n> --json headRefName -q .headRefName)" && git worktree add --detach .claude/worktrees/review-<n> "$(gh pr view <n> --json headRefOid -q .headRefOid)"`
+- Last review marker (`review` skill §2a): `gh api --paginate "repos/{{gitRemotePath}}/issues/<n>/comments" --jq '[.[] | select(.body | contains("<!-- review:sha=")) | select(.author_association == "OWNER" or .author_association == "MEMBER" or .author_association == "COLLABORATOR") | select(.user.login != "<pr-author>")] | last | .body' | grep -o 'review:sha=[0-9a-f]*' | tail -1`, with `<pr-author>` from `gh pr view <n> --json author -q .author.login`. Both filters are load-bearing: anyone can post a comment containing the marker text for any SHA they like, so an outside contributor's marker and the PR author's own (a member can be both) are never trusted as a completed review. The marker only narrows an interactive review; `--ci` ignores it.
+
+## Attach evidence
+
+`gh` has no command to upload an image. Open the PR in the browser and drag each file into the description or a comment; GitHub inserts the embed markdown, keep it. If a file cannot be uploaded, say in the description that it is available from the author. Never paste a local path.
+
+## Inline review comments
+
+Anchor each comment to a line of the diff on the head commit:
+
+```
+gh api "repos/{{gitRemotePath}}/pulls/<n>/comments" \
+  -f body="<comment>" -f commit_id="<head-sha>" -f path="<file>" -F line=<new-line> -f side=RIGHT
+```
+
+Take `<head-sha>` from `gh pr view <n> --json headRefOid`. Anchor on the NEW-file line of an added line. Verify the response carries a non-null `line`; if it came back as a plain issue comment, delete it and retry rather than leaving an unanchored note. Post the verdict itself as one summary comment: `gh pr comment <n> --body "<one sentence>"`.
+
+## Rules
+
+- Never push without an explicit per-action confirmation from the user.
+- Never merge a pull request unless the user asks for that exact action.
+- Never resolve someone else's review thread.

package/template/docs/agents/issue-tracker.md.tpl

@@ -0,0 +1,42 @@
+# Issue tracker: Jira (project `{{trackerKey}}`) + Confluence + Slack
+
+Work for this operator is tracked in Jira project `{{trackerKey}}` on `{{jiraSite}}`. Requirements and reasoning live in Confluence space `{{wikiSpace}}`. Decisions that never made it into a ticket live in Slack `{{teamChannel}}`. Code review happens on `{{gitRemotePath}}` - see `docs/agents/forge.md`.
+
+Every skill that says "fetch the relevant ticket" reads this file.
+
+## Keys and where they appear
+
+- Ticket key: `{{trackerKey}}-<n>`. `{{trackerKey}}-0` means "no ticket" (chores).
+- Branch: `<type>/{{trackerKey}}-<n>/<slug>`. MR title: conventional commit subject; MR description ends with `Closes {{trackerKey}}-<n>` when it finishes the ticket, `Refs {{trackerKey}}-<n>` when it is one of several MRs for it. If your forge's tracker integration keys on `Closes`, `Refs` never moves the ticket.
+- Resolve the key from, in order: the argument the user gave, the MR description, the MR title, the branch name, commit subjects.
+
+## What "read the ticket" means
+
+A ticket is read when ALL of this has been seen - never from the description alone:
+
+1. Description and acceptance criteria (task items render as `- [ ]` / `- [x]`).
+2. Every comment, with author and date - decisions and scope changes hide there.
+3. Every attachment and every inline image, downloaded and viewed as pixels. Filenames, thumbnails, `blob:` links and metadata prove nothing.
+4. Parent epic and linked issues named by the AC.
+5. Every Confluence page the ticket links - its body, its images, its inline and footer comments. The AC are the spec; the page behind them is the reasoning.
+6. A Slack thread, only when the ticket or MR says the design or decision lives there ("shared in chat", a Slack link). Optional otherwise.
+
+How:
+
+- With the `atlassian-read` skill installed: `python3 ~/.claude/skills/atlassian-read/scripts/read.py issue {{trackerKey}}-<n>` then `page <id>` for each linked page. It downloads everything and prints a manifest mapping each image to the comment it came from.
+- Without it, REST with an Atlassian API token: Jira `GET /rest/api/3/issue/{{trackerKey}}-<n>?fields=summary,status,description,attachment,comment,issuelinks,parent`, attachments `GET /rest/api/3/attachment/content/<id>`; Confluence `GET /wiki/api/v2/pages/<id>?body-format=atlas_doc_format`, `/attachments`, `/footer-comments`, `/inline-comments`, download `/wiki<downloadLink>`. Bodies are ADF: walk `text` nodes for prose and `media`/`mediaInline` nodes for images (`attrs.alt` is the Jira attachment filename; on Confluence `attrs.id` is the attachment `fileId`).
+- The Atlassian MCP is fine for search, text and writes, but it returns no image bytes - it is never sufficient on its own when attachments exist.
+- Slack: the `slack-reader` agent when available, else the Slack MCP, scoped to the channel and thread named.
+
+Credentials are personal: `CONFLUENCE_EMAIL` / `CONFLUENCE_TOKEN` (an Atlassian API token) from a local, untracked env file. Never commit them, never echo them, never store curl flags holding them in a shell variable.
+
+## When a skill says "fetch the relevant ticket"
+
+Run the protocol above and distill: goal in one line, AC quoted as bullets, decisions from comments (who, when), design references (which screenshot shows what), out-of-scope lines. Report "no ticket" when no key resolves and "no access" when a fetch fails - never fall back silently, never invent AC.
+
+## Writing
+
+- Never comment on, transition, or edit a Jira issue or Confluence page unless the user asks for that exact write. Reading authorizes nothing.
+- The one standing exception: `/ship {{trackerKey}}-<n>` is the ask for its own writes on that ticket - the Plan, questions, blocker and MR-link comments, the test cases where the `test-plan` skill keeps them, and the transitions to In Progress and Code Review. Nothing else.
+- Review comments go through `review --post`, draft-and-confirm, using the commands in `docs/agents/forge.md`.
+- Slack: draft only, never send.

package/template/docs/standards/comments.md

@@ -0,0 +1,16 @@
+# Comments
+
+Read this before writing a comment or JSDoc.
+
+- Comment WHY, never WHAT: hidden constraint, invariant, bug workaround (link it), trade-off. If a
+  block needs a comment to be understood, rename/extract instead.
+- No section-divider comments (`// ---`, `// ===`).
+- Every JSDoc is multi-line, always - `/**`, the text, and `*/` each on their own line. A
+  single-line `/** ... */` is never allowed, even for one sentence. Add one only on an independent
+  function/class (not a React component or hook) that is >~15 lines or has non-obvious params. One
+  sentence; document the surprising contract, not the name.
+- Never JSDoc a React component or hook - a genuinely surprising note goes on the specific
+  prop/param type, or an inline comment at the call site.
+- Deferred work: `// TODO:` with the concrete follow-up, never a bare TODO.
+- Placeholder/sample data and stubs: greppable `// mock:` comment so throwaway code stays
+  findable.