@openora/create 0.4.1-canary.33 → 0.4.1-canary.331

package/dist/render.js

@@ -0,0 +1,125 @@
+import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, relative, sep } from 'node:path';
+const MCP_COMMAND = 'node';
+const MCP_ARGS = ['node_modules/@openora/mcp/dist/main.js'];
+const SKIPPED_BASENAMES = new Set();
+const USAGE = 'Usage: npm create @openora <target-dir> [--name <name>] [--no-telemetry]';
+function readFlag(args, index) {
+    const arg = args[index] ?? '';
+    const eq = arg.indexOf('=');
+    if (eq !== -1) {
+        return { value: arg.slice(eq + 1), next: index };
+    }
+    return { value: args[index + 1], next: index + 1 };
+}
+export function parseArgs(argv) {
+    const args = argv.slice(2);
+    let target;
+    let name;
+    let telemetry = true;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === undefined) {
+            continue;
+        }
+        if (arg === '--name' || arg.startsWith('--name=')) {
+            const flag = readFlag(args, i);
+            name = flag.value;
+            i = flag.next;
+        }
+        else if (arg === '--no-telemetry') {
+            telemetry = false;
+        }
+        else if (!arg.startsWith('-') && !target) {
+            target = arg;
+        }
+    }
+    if (!target) {
+        throw new Error(`missing target directory.\n  ${USAGE}`);
+    }
+    return name === undefined ? { target, telemetry } : { target, name, telemetry };
+}
+function isSet(flag) {
+    return flag !== undefined && ['1', 'true', 'yes'].includes(flag.trim().toLowerCase());
+}
+// Mirrors `isTelemetryEnabled` in core's server/runtime/telemetry.ts; change both together.
+export function isTelemetryEnabled(telemetry, env) {
+    return (telemetry &&
+        !isSet(env['OPENORA_TELEMETRY_DISABLED']) &&
+        !isSet(env['DO_NOT_TRACK']) &&
+        env['CI'] === undefined &&
+        env['NODE_ENV'] !== 'test');
+}
+export function sanitizeName(raw) {
+    return (raw
+        .toLowerCase()
+        .replace(/[^a-z0-9-_]/g, '-')
+        .replace(/^-+|-+$/g, '') || 'igaming-app');
+}
+export function posix(path) {
+    return path.split(sep).join('/');
+}
+export function substitute(content, vars) {
+    return content.replace(/\{\{(\w+)\}\}/g, (match, key) => {
+        const value = vars[key];
+        return value === undefined ? match : value;
+    });
+}
+function walk(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory()) {
+            out.push(...walk(full));
+        }
+        else {
+            out.push(full);
+        }
+    }
+    return out;
+}
+export function undotSegment(segment) {
+    return segment.startsWith('__dot__') ? `.${segment.slice('__dot__'.length)}` : segment;
+}
+export function outputPath(templateRel) {
+    const mapped = templateRel.split(sep).map(undotSegment).join(sep);
+    return mapped.endsWith('.tpl') ? mapped.slice(0, -'.tpl'.length) : mapped;
+}
+export function emitTree(srcRoot, vars, targetDir) {
+    for (const file of walk(srcRoot)) {
+        if (SKIPPED_BASENAMES.has(basename(file))) {
+            continue;
+        }
+        const outRel = outputPath(relative(srcRoot, file));
+        const raw = readFileSync(file, 'utf8');
+        const content = file.endsWith('.tpl') ? substitute(raw, vars) : raw;
+        const outPath = join(targetDir, outRel);
+        mkdirSync(dirname(outPath), { recursive: true });
+        writeFileSync(outPath, content);
+        console.log(`  + ${posix(outRel)}`);
+    }
+}
+// Operator coordinates the agent files reference. A fresh scaffold gets placeholders;
+// the consumer fills them in once in .rulesync/sync.json and `pnpm sync:agents`
+// re-renders every template-owned file from them.
+export function buildVars(name, versions) {
+    return {
+        name,
+        ...versions,
+        mcpCommand: MCP_COMMAND,
+        mcpArgsJson: JSON.stringify(MCP_ARGS),
+        scope: `@${name}`,
+        trackerKey: 'KEY',
+        jiraSite: '<your-site>.atlassian.net',
+        jiraCloudId: '<your-jira-cloud-id>',
+        wikiSpace: '<your-wiki-space>',
+        teamChannel: '#<your-team-channel>',
+        gitRemotePath: '<group>/<repo>',
+        ossDir: '../openora',
+        // Only meaningful once the consumer links a local platform checkout; until then the
+        // guard-core hook simply never matches.
+        ossFromRoot: '../openora',
+        mrTarget: 'dev',
+    };
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,QAAQ,GAAG,CAAC,wCAAwC,CAAC,CAAC;AAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;AAQpC,MAAM,KAAK,GAAG,0EAA0E,CAAC;AAEzF,SAAS,QAAQ,CAAC,IAAc,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAClB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,KAAK,CAAC,IAAwB;IACrC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,SAAkB,EAAE,GAAsB;IAC3E,OAAO,CACL,SAAS;QACT,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACzC,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;QACvB,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,CACL,GAAG;SACA,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,aAAa,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAA4B;IACtE,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAA4B,EAAE,SAAiB;IACvF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,gFAAgF;AAChF,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgC;IACtE,OAAO;QACL,IAAI;QACJ,GAAG,QAAQ;QACX,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrC,KAAK,EAAE,IAAI,IAAI,EAAE;QACjB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,2BAA2B;QACrC,WAAW,EAAE,sBAAsB;QACnC,SAAS,EAAE,mBAAmB;QAC9B,WAAW,EAAE,sBAAsB;QACnC,aAAa,EAAE,gBAAgB;QAC/B,MAAM,EAAE,YAAY;QACpB,oFAAoF;QACpF,wCAAwC;QACxC,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openora/create",
-  "version": "0.4.1-canary.33",
+  "version": "0.4.1-canary.331",
   "description": "npm initializer that scaffolds a headless Openora consumer app from the published @openora/* packages - no OSS checkout required",
   "keywords": [
     "ai-native",
@@ -28,16 +28,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "@types/node": "25.9.2",
+    "@types/node": "26.6.5",
     "typescript": "6.0.3",
-    "@openora/core": "0.4.1-canary.33"
+    "vitest": "4.1.12",
+    "@openora/core": "0.4.1-canary.331"
   },
   "engines": {
     "node": ">=26"
   },
   "scripts": {
-    "build": "node scripts/copy-template.mjs && node scripts/generate-core-version.mjs && tsc",
-    "typecheck": "node scripts/generate-core-version.mjs && tsc --noEmit",
-    "clean": "rm -rf dist template src/generated"
+    "build": "node scripts/copy-template.mjs && node scripts/generate-versions.mjs && tsc",
+    "check:types": "node scripts/generate-versions.mjs && tsc --noEmit",
+    "clean": "rm -rf dist template src/generated",
+    "test:unit": "vitest run"
   }
 }

package/template/README.md.tpl

@@ -13,7 +13,8 @@ in its own repo and talk to this api over HTTP via `@openora/react`.
 ```
 apps/
   api/          # Hono + oRPC API (:3001) - thin createApp entry + your extensions.config.ts
-.claude/agents/ # AI agents: builder, expert, qa
+.rulesync/      # source of truth for agent rules, subagents, commands, skills
+.claude/agents/ # generated AI agents
 turbo/generators/ # turbo gen: plugin, adapter
 ```
 
@@ -27,18 +28,20 @@ newest release; pin an exact version if you need reproducible installs.
 
 ```bash
 pnpm install               # pulls @openora/* from npm
-pnpm setup:mcp             # trust the MCP server + install the /start onboarding flow
-pnpm regen                 # regenerate OpenAPI + catalog + Drizzle client (after schema changes)
 cp .env.example .env       # set DATABASE_URL + AUTH_SECRET
 pnpm db:migrate            # apply the OSS schema to your database
 pnpm dev                   # api :3001
 ```
 
-After `pnpm setup:mcp`, restart your editor and run **`/start`** in Claude Code - it asks what
-you want to build and scaffolds it for you.
+The `oss` MCP server is declared in `.mcp.json`. Approve it in your editor, restart, then run
+**`/start`** in Claude Code - it asks what you want to build and scaffolds it for you.
 
 To pull the newest platform release, re-run `pnpm install` (the pin tracks the `latest` stable tag).
 
+The API sends anonymous usage telemetry (a random instance id, the version, the Node.js runtime and
+two active-player counts). Set `OPENORA_TELEMETRY_DISABLED=1` in `.env` to turn it off; every field
+is listed at https://openora.ai/documentation/telemetry.
+
 ## Extending
 
 | Need | Command |
@@ -52,10 +55,12 @@ a DI token wins).
 
 ## AI agents
 
-`.claude/agents/` ships three agents scoped to this repo:
+`.claude/agents/` ships agents scoped to this repo, generated from `.rulesync/subagents/`:
 
+- `planner` - plan a ticket: the blocking questions, or a plan with risk-driven test cases
 - `builder` - configure extensions, swap adapters, write overlays, customize UI
 - `expert` - turn product asks into requirements + acceptance criteria
-- `qa` - write/run Playwright E2E tests and triage bugs
+- `tester` - attack a built change against the running stack, return a verdict table, add the tests, triage bugs; once tests and review pass, record a video per AC on the final commit
+- `debugger`, `deployer`, `quality-reviewer`, `security-reviewer`, `compliance-reviewer` - root-cause, packaging, review
 
 The `oss` MCP server (`.mcp.json`) gives them read-only inspection of the platform surface.

package/template/__dot__claude/settings.json.tpl

@@ -1,49 +1,59 @@
 {
   "enableAllProjectMcpServers": false,
   "enabledMcpjsonServers": ["oss"],
+  "env": {
+    "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD": "1"
+  },
   "permissions": {
-    "deny": [
-      "Edit(./node_modules/**)",
-      "Write(./node_modules/**)"
-    ]
+    "deny": ["Edit(./node_modules/**)"],
+    "additionalDirectories": ["{{ossFromRoot}}"]
   },
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|Edit|Write",
+        "matcher": "Bash|Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PROJECT_DIR:-.}/.rulesync/hooks/guard-core.mjs\""
+          }
+        ]
+      },
+      {
+        "matcher": "Bash|Edit|Write|MultiEdit|NotebookEdit",
         "hooks": [
           {
             "type": "command",
-            "command": "node .rulesync/hooks/guard-core.mjs"
+            "command": "node \"${CLAUDE_PROJECT_DIR:-.}/.rulesync/hooks/guard-generated.mjs\""
           }
         ]
       },
       {
-        "matcher": "Edit|Write",
+        "matcher": "Bash",
         "hooks": [
           {
             "type": "command",
-            "command": "node .rulesync/hooks/guard-generated.mjs"
+            "command": "node \"${CLAUDE_PROJECT_DIR:-.}/.rulesync/hooks/guard-mr.mjs\""
           }
         ]
       },
       {
-        "matcher": "Task",
+        "matcher": "Task|Agent",
         "hooks": [
           {
             "type": "command",
-            "command": "node .rulesync/hooks/guard-subagent.mjs"
+            "command": "node \"${CLAUDE_PROJECT_DIR:-.}/.rulesync/hooks/guard-subagent.mjs\""
           }
         ]
       }
     ],
     "PostToolUse": [
       {
-        "matcher": "Edit|Write",
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
         "hooks": [
           {
             "type": "command",
-            "command": "node .rulesync/hooks/post-edit.mjs"
+            "command": "node \"${CLAUDE_PROJECT_DIR:-.}/.rulesync/hooks/post-edit.mjs\""
           }
         ]
       }

package/template/__dot__env.example

@@ -1,6 +1,13 @@
 # Database (Postgres). In dev link-mode this is typically the same local DB the
 # OSS checkout uses, so migrations run via `pnpm db:migrate` line up.
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/oss_igaming
+# Optional pool tuning: connections per process (default 10) and how long a query waits for
+# a free one before failing (default 5000 ms).
+# DATABASE_POOL_MAX=10
+# DATABASE_POOL_ACQUIRE_TIMEOUT_MS=5000
+# Optional read replicas, comma-separated. Only reads that opt into `drizzle.replica`
+# use them; everything else stays on DATABASE_URL. Each replica gets its own pool.
+# DATABASE_REPLICA_URLS=
 
 # Auth secret (min 32 chars). Generate one: openssl rand -base64 32
 AUTH_SECRET=change-me-in-production-min-32-chars
@@ -10,6 +17,9 @@ AUTH_SECRET=change-me-in-production-min-32-chars
 # up -d` starts this alongside Postgres.
 REDIS_URL=redis://localhost:6379
 
+# Anonymous usage telemetry is on by default: https://openora.ai/documentation/telemetry
+# OPENORA_TELEMETRY_DISABLED=1
+
 # Ports
 PORT=3001
 CORS_ORIGINS=http://localhost:3000,http://localhost:3002

package/template/__dot__gitignore

@@ -17,7 +17,7 @@ coverage
 .DS_Store
 
 # Generated by rulesync from .rulesync/ (single source of truth).
-# Regenerated on `pnpm install` (prepare) or `pnpm sync:agents`. Do not commit.
+# Regenerated on `pnpm install` (prepare) or `pnpm gen:agents`. Do not commit.
 /AGENTS.md
 /CLAUDE.md
 /.mcp.json
@@ -25,7 +25,12 @@ coverage
 .codex/
 .claude/agents/
 .claude/commands/
+.claude/worktrees/
+.claude/reviews/
 .github/copilot-instructions.md
 .github/agents/
 .github/prompts/
 .github/hooks/
+
+# Agent files rendered from the @openora/create consumer template on install.
+# The block below is rewritten by tools/sync-agents.mjs - do not edit by hand.

package/template/__dot__rulesync/commands/adr.md

@@ -0,0 +1,32 @@
+---
+targets:
+  - '*'
+description: 'Record an architectural decision in docs/adr/. Args: <title>. Numbers sequentially, follows the ADR-0001 format (Context / Decision / Consequences).'
+---
+
+Create `docs/adr/NNNN-<kebab-slug>.md` where `NNNN` is the next number after the highest existing one (`ls docs/adr/`).
+
+Structure (match `0001-modular-architecture.md`):
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+
+<the problem/forces, 2-5 lines - why a decision was needed>
+
+## Decision
+
+<what was decided, imperative and concrete; bullets for the specifics>
+
+## Consequences
+
+<what becomes easier/harder; follow-ups it creates>
+```
+
+Rules:
+
+- Fill it from the current conversation/diff - state the decision actually made, not options considered. If the decision isn't settled, say so and ask instead of writing a speculative ADR.
+- One ADR = one decision. Reference related ADRs by number.
+- If the decision changes agent-facing conventions, also update the matching `.rulesync/rules/*` file and run `pnpm gen:agents`.
+- Report the file path when done. Don't commit unless asked.

package/template/__dot__rulesync/commands/check.md

@@ -1,21 +1,22 @@
 ---
 targets:
   - '*'
-description: Run the local gate before a PR - typecheck + lint. There is no single `verify` script in this repo; this is it.
+description: Run the fast local gate - typecheck + lint + unit tests. Use `pnpm verify` for the full pre-MR gate (adds format check, boundaries, build).
 ---
 
-This repo has no `verify` script - typecheck and lint are separate. Run them in order and stop at the first failure.
+Run in order, stop at the first failure:
 
-1. `pnpm typecheck` - `turbo run typecheck` across all apps.
-2. `pnpm lint` - `oxlint .`.
+1. `pnpm check:types`
+2. `pnpm check:lint`
+3. `pnpm test:unit`
 
-If you have added a test runner (eg `vitest`), also run your test script.
-
-The generated agent files (AGENTS.md, CLAUDE.md, .codex/config.toml, Copilot mirrors) are gitignored and regenerated from `.rulesync/` on `pnpm install` - there is nothing to drift-check. If you changed agent instructions, edit `.rulesync/` and run `pnpm sync:agents`.
+`pnpm verify` is the pre-MR gate: these three plus whatever else the repo wires into that script (format, boundaries, build). It also records the verified commit, which the `guard-mr` hook checks before an MR/PR is opened.
 
 After running:
 
-- All green: report ready for PR; list changed files (`git diff --name-only`).
-- typecheck/lint fails: show the location, propose a fix.
+- All green: report ready; list changed files (`git diff --name-only`).
+- A step fails: show the exact location, propose a fix. Never report ready while any step is red.
+
+Agent files (`AGENTS.md`, `CLAUDE.md`, mirrors) are gitignored and generated from `.rulesync/` on install - nothing to drift-check. If you changed agent instructions, edit `.rulesync/` and run `pnpm gen:agents`.
 
-Do not touch `@openora/*` core or `node_modules` - this repo extends the platform from the outside only (overlay plugins, adapter rebindings, UI plugins, config). Never report ready for PR if any step fails.
+Do not touch `@openora/*` core or `node_modules` - this repo extends the platform from the outside only (overlay plugins, adapter rebindings, UI plugins, config).

package/template/__dot__rulesync/commands/doctor.md.tpl

@@ -0,0 +1,17 @@
+---
+targets:
+  - '*'
+description: Diagnose the local dev environment - linked {{ossDir}}, node, postgres, ports, caches. Read-only; reports findings + the fix command for each.
+---
+
+Run these checks and report a pass/fail line per item with the fix command for failures. Read-only - never apply fixes without being asked.
+
+1. **Node version**: `node -v` matches the major in `.nvmrc` (read the file, don't assume a number). Fix: `nvm use`.
+2. **OSS checkout linked** (only in repos that link a local platform checkout - a stock scaffold installs `@openora/*` from npm and skips this and the next check): `{{ossDir}}` exists and `node --input-type=module -e "import {createRequire} from 'node:module'; console.log(createRequire(process.cwd()+'/').resolve('@openora/core/react'))"` resolves. Fix: clone the OSS repo side by side at `{{ossDir}}`, run the repo's link script if it ships one (`pnpm link:oss`), then `pnpm install`.
+3. **OSS built**: the resolved path above points into a `dist/` that exists and is newer than `{{ossDir}}/packages/*/src`. Fix: rebuild the linked checkout with the repo's build script if it ships one (`pnpm build:oss`), otherwise build it from `{{ossDir}}`.
+4. **Database**: postgres reachable on :5432 (`nc -z localhost 5432`). Fix: `dev:infra` MCP tool (server `oss`) or the compose stack.
+5. **Services**: port 3001 (api), plus 3000 (web) and 3002 (backoffice) in repos that have those apps - report which are up. Fix: `pnpm dev`.
+6. **Stale bundler cache**: if this repo has a Next app and a build error persists after a fix, `rm -rf apps/*/.next` and rebuild (Turbopack caches across the link boundary).
+7. **Generated agent files**: `pnpm gen:agents` runs clean (regenerates from `.rulesync/`).
+
+If everything passes but a build still fails, hand off to the `debugger` agent with the verbatim error - it owns the deeper resolution table (turbopack.root, symlinked tsconfig, externalDir).

package/template/__dot__rulesync/commands/scaffold-module.md

@@ -1,5 +1,6 @@
 ---
-description: 'Generate a self-contained local add-on package (schema, service, router, plugin.ts, AGENTS.md) and register it. Args: <name>. Consumers rarely need this - prefer an overlay plugin.'
+targets: ['*']
+description: 'Generate a self-contained local add-on package (schema, service, router, plugin.ts) and register it. Args: <name>. Consumers rarely need this - prefer an overlay plugin.'
 ---
 
 > A consumer extends the platform with **overlay plugins** (`scaffold-plugin`) almost always. Reach
@@ -11,7 +12,7 @@ ships a buildable add-on - a `list` route wired contract -> router -> service ov
 so `/check` is green immediately. Then:
 
 1. `<name>/src/schema/index.ts` - Drizzle tables (`pgTable`, snake_case, `timestamp({ withTimezone:
-true })` per `db-conventions`).
+true })` per `docs/standards/database.md`).
 2. `<name>/src/schemas/index.ts` - Zod input/output schemas; types via `z.infer`.
 3. `<name>/src/service/<name>.service.ts` - business logic; inject `DRIZZLE` + `EVENT_BUS`, no inline
    fetch/SQL.

package/template/__dot__rulesync/commands/scaffold-plugin.md

@@ -1,5 +1,6 @@
 ---
-description: 'Generate an overlay extension under apps/api/src/extensions/<name>/. Adds routes, providers, event handlers, or MCP tools without touching @openora/* core. Args: <name>.'
+targets: ['*']
+description: 'Generate an overlay extension under apps/api/src/extensions/<name>/. Adds routes, providers, event handlers, agent tools, or agent action types without touching @openora/* core. Args: <name>.'
 ---
 
 Run `pnpm gen plugin $ARGUMENTS` in the repo root. For a vendor swap use
@@ -12,13 +13,28 @@ After the generator finishes, open `apps/api/src/extensions/<name>/plugin.ts` an
   compile + runtime).
 - `ctx.routers.add(namespace, (c) => router)` - mount oRPC routes (Zod input/output, no inline schemas).
 - `ctx.events.on(event, handler)` - subscribe to the typed `EventBus`.
-- `ctx.mcp.tool(definition)` - expose an MCP tool.
+- `ctx.triggers.listen((trigger, payload, envelope) => ...)` - hear the domain events the operator
+  allow-listed as agent triggers (`agents.triggers.topics`). Delivery is at-least-once: dedupe on
+  `envelope.eventId`, and drop what is older than you care about by `envelope.occurredAt`, since a
+  topic listed again can replay its backlog. The payload is raw and may hold personal data, so
+  never hand it to a model. Enqueue a job and return: a slow listener delays the topic's other
+  handlers.
+- `ctx.mcp.tool(defineMcpTool({...}), (c) => async (input, run) => output)` - register an agent tool,
+  a read a model makes during a run.
+- `ctx.actions.register(defineActionType({...}), (c) => ({ precondition, execute }))` - register an
+  agent action type, a change a model may only propose. `execute` performs nothing on a replay
+  while its effect still holds, and answers `already_applied`.
+
+Both are served only through the `MCP_KERNEL` token, which checks IAM, validates input, applies the
+output allow-list and audits every tool call and action execution; a shape it cannot serve fails
+boot with the fix. The one-argument `ctx.mcp.tool(definition)` still registers but the kernel does
+not serve it.
 
 Then:
 
 1. Register the plugin in `apps/api/src/extensions.config.ts`. Last registration of a DI token wins -
    list an adapter swap AFTER the module that owns the default binding.
-2. Tables go in the overlay's own `src/schema/index.ts` (follow `db-conventions`); run `pnpm db:migrate`.
+2. Tables go in the overlay's own `src/schema/index.ts` (follow `docs/standards/database.md`); run `pnpm db:migrate`.
 3. Audit every state-changing action (emit an event the `audit` add-on consumes, or `AUDIT_WRITER.record`).
 4. `/check` to confirm wiring compiles and boundary lint passes.
 

package/template/__dot__rulesync/commands/scaffold-route.md

@@ -1,4 +1,5 @@
 ---
+targets: ['*']
 description: 'Add an oRPC route stub to an overlay or local add-on. Args: <target> <GET|POST|PUT|PATCH|DELETE> <path>. Example: /scaffold-route promotions GET /active.'
 ---
 

package/template/__dot__rulesync/commands/start.md

@@ -6,6 +6,6 @@ description: First-run onboarding for this consumer igaming repo. Interview the
 
 Call the `start` MCP tool (server `oss`) with no arguments, then follow the script it returns exactly. If the user already described what they want to build, pass it as the `ask` argument.
 
-The returned script will have you: confirm the MCP server is connected, run a thorough requirements interview, call `enhance-intent`, then delegate the implementation to the `expert`, `builder`, and `qa` agents (via the Task tool). You gather requirements and orchestrate; you do not write feature code yourself, and you never modify `@openora/*` core.
+The returned script will have you: confirm the MCP server is connected, run a thorough requirements interview, call `enhance-intent`, then delegate the implementation to the `expert`, `builder`, and `tester` agents (via the Task tool). You gather requirements and orchestrate; you do not write feature code yourself, and you never modify `@openora/*` core.
 
-If the `start` tool is not available, the `oss` MCP server is not connected - tell the user to run `pnpm setup:mcp` and restart the editor.
+If the `start` tool is not available, the `oss` MCP server is not connected - tell the user to approve the `oss` server declared in `.mcp.json` (or run the repo's MCP setup script if it ships one) and restart the editor.

package/template/__dot__rulesync/hooks/_shared.mjs

@@ -2,7 +2,10 @@
 //
 // One script serves Claude Code, Copilot CLI, Codex CLI, and Gemini CLI. Each
 // passes the tool call as JSON on stdin but with a slightly different shape:
-//   Claude / Codex : { tool_name, tool_input: { command?, file_path? } }
+//   Claude         : { tool_name, tool_input: { command?, file_path? } }
+//   Codex          : same, except an edit is { tool_name: "apply_patch", tool_input: { command: "<patch>" } },
+//                    the paths only in its "*** Add File: <path>" style headers; an Edit|Write
+//                    matcher matches apply_patch
 //   Copilot        : { toolName,  toolArgs: "<json-string>" | object }
 //   Gemini         : { toolName/tool_name, ... } (best-effort)
 //
@@ -13,6 +16,7 @@
 
 import { readFileSync } from 'node:fs';
 
+/** Read the hook payload from stdin; {} on any error. */
 export function readPayload() {
   try {
     return JSON.parse(readFileSync(0, 'utf8') || '{}');
@@ -21,6 +25,7 @@ export function readPayload() {
   }
 }
 
+/** Copilot's toolArgs may be a JSON string; normalize to an object. */
 function toolArgsObject(payload) {
   const a = payload.toolArgs;
   if (typeof a === 'string') {
@@ -33,27 +38,35 @@ function toolArgsObject(payload) {
   return a && typeof a === 'object' ? a : {};
 }
 
-export function extractCommand(payload) {
+const PATCH_PATH = /^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm;
+
+function rawCommand(payload) {
   const ti = payload.tool_input ?? {};
   const ca = toolArgsObject(payload);
   return String(ti.command ?? ca.command ?? '');
 }
 
-export function extractFilePath(payload) {
+// Only the tool name tells a patch from a shell command: a Bash command can carry patch text too.
+const isPatch = (payload) => (payload.tool_name ?? payload.toolName) === 'apply_patch';
+
+/** The shell command string for this tool call, across tool shapes ('' if none or a patch). */
+export function extractCommand(payload) {
+  return isPatch(payload) ? '' : rawCommand(payload);
+}
+
+/** Every file an edit/write tool call touches, across tool shapes ([] if none). */
+export function extractFilePaths(payload) {
+  if (isPatch(payload)) {
+    return [...rawCommand(payload).matchAll(PATCH_PATH)].map((match) => match[1].trim());
+  }
   const ti = payload.tool_input ?? {};
   const ca = toolArgsObject(payload);
-  return String(
-    ti.file_path ??
-      ti.path ??
-      ca.path ??
-      ca.filePath ??
-      ca.file ??
-      ca.targetFile ??
-      ca.target_file ??
-      '',
-  );
+  const filePath =
+    ti.file_path ?? ti.path ?? ca.path ?? ca.filePath ?? ca.file ?? ca.targetFile ?? ca.target_file;
+  return filePath ? [String(filePath)] : [];
 }
 
+/** Deny the tool call (works on Claude, Copilot, Codex, Gemini). */
 export function deny(message) {
   process.stderr.write(message.endsWith('\n') ? message : message + '\n');
   process.exit(2);