@opensaas/stack-cli 0.29.0 → 0.30.0

package/dist/mcp/lib/generators/feature-generator.js

@@ -1,6 +1,26 @@
 /**
  * Feature generator - Generates code, config, and documentation for features
+ *
+ * Emitted code must match the current stack APIs. Canonical references:
+ * - examples/starter-auth (authPlugin, access helpers, lib/auth wiring)
+ * - examples/file-upload-demo (storage config, file/image fields)
+ * - examples/rag-openai-chatbot and examples/rag-ollama-demo (ragPlugin, searchable)
  */
+const SQLITE_DB_BLOCK = `db: {
+    provider: 'sqlite',
+    prismaClientConstructor: (PrismaClient) => {
+      const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL || 'file:./dev.db' })
+      return new PrismaClient({ adapter })
+    },
+  }`;
+const POSTGRES_DB_BLOCK = `db: {
+    provider: 'postgresql',
+    prismaClientConstructor: (PrismaClient) => {
+      const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL })
+      const adapter = new PrismaPg(pool)
+      return new PrismaClient({ adapter })
+    },
+  }`;
 export class FeatureGenerator {
     feature;
     answers;
@@ -43,121 +63,188 @@ export class FeatureGenerator {
             : null;
         const userFields = this.answers['user-fields'] || [];
         const emailVerification = this.answers['email-verification'];
-        const hasOAuth = authMethods.some((m) => ['Google OAuth', 'GitHub OAuth'].includes(m));
+        const hasGoogle = authMethods.includes('Google OAuth');
+        const hasGithub = authMethods.includes('GitHub OAuth');
+        const hasOAuth = hasGoogle || hasGithub;
         const hasPassword = authMethods.includes('Email & Password');
-        const hasMagicLink = authMethods.includes('Magic Links');
-        // Build User list fields
-        const fields = ['email: text({ validation: { isRequired: true } })'];
-        if (hasPassword) {
-            fields.push('password: password({ validation: { isRequired: true } })');
-        }
-        fields.push('name: text()');
+        // Custom User fields go through authPlugin's extendUserList — the plugin
+        // auto-generates the User/Session/Account/Verification lists. Passwords
+        // live on the Account list managed by Better-auth; never add a password
+        // field to User.
+        const extendFields = [];
         if (hasRoles && roles) {
-            fields.push(`role: select({ options: [${roles.map((r) => `'${r}'`).join(', ')}], defaultValue: '${roles[roles.length - 1]}' })`);
+            const options = roles.map((r) => `{ label: '${r[0].toUpperCase()}${r.slice(1)}', value: '${r}' }`);
+            extendFields.push(`role: select({ options: [${options.join(', ')}], defaultValue: '${roles[roles.length - 1]}' })`);
         }
         if (userFields.includes('Avatar')) {
-            fields.push('avatar: text()');
+            extendFields.push(`avatar: text() // or an image() field — see the file-upload feature`);
         }
         if (userFields.includes('Bio')) {
-            fields.push('bio: text({ ui: { displayMode: "textarea" } })');
+            extendFields.push(`bio: text({ ui: { displayMode: 'textarea' } })`);
         }
         if (userFields.includes('Phone')) {
-            fields.push('phone: text()');
+            extendFields.push(`phone: text()`);
         }
         if (userFields.includes('Location')) {
-            fields.push('location: text()');
+            extendFields.push(`location: text()`);
         }
         if (userFields.includes('Website')) {
-            fields.push('website: text()');
+            extendFields.push(`website: text()`);
         }
-        // Config updates
-        const configUpdates = `import { config, list } from '@opensaas/stack-core';
-import { text, password, select } from '@opensaas/stack-core/fields';
-import { authPlugin } from '@opensaas/stack-auth';
+        const fieldImports = ['text'];
+        if (hasRoles)
+            fieldImports.push('select');
+        const socialProvidersBlock = hasOAuth
+            ? `
+      socialProviders: {
+        ${hasGoogle ? `google: {\n          clientId: process.env.GOOGLE_CLIENT_ID!,\n          clientSecret: process.env.GOOGLE_CLIENT_SECRET!,\n        },` : ''}
+        ${hasGithub ? `github: {\n          clientId: process.env.GITHUB_CLIENT_ID!,\n          clientSecret: process.env.GITHUB_CLIENT_SECRET!,\n        },` : ''}
+      },`
+            : '';
+        const configUpdates = `import { config, list } from '@opensaas/stack-core'
+import type { AccessControl } from '@opensaas/stack-core'
+import { ${fieldImports.join(', ')} } from '@opensaas/stack-core/fields'
+import { authPlugin } from '@opensaas/stack-auth'
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+
+// Access control helpers (see lib/access-control.ts for the full set)
+const isSignedIn: AccessControl = ({ session }) => !!session
 
 export default config({
   plugins: [
     authPlugin({
-      emailAndPassword: { enabled: ${hasPassword} },
-      ${hasOAuth
-            ? `oauth: {
-        google: { enabled: ${authMethods.includes('Google OAuth')} },
-        github: { enabled: ${authMethods.includes('GitHub OAuth')} },
-      },`
-            : ''}
-      ${hasMagicLink ? `magicLink: { enabled: true },` : ''}
+      emailAndPassword: { enabled: ${hasPassword} },${socialProvidersBlock}
       ${emailVerification ? `emailVerification: { enabled: true },` : ''}
       sessionFields: ['userId', 'email', 'name'${hasRoles ? ", 'role'" : ''}],
-    }),
-  ],
-  db: {
-    provider: 'postgresql', // or 'sqlite'
-    url: process.env.DATABASE_URL,
-  },
-  lists: {
-    User: list({
-      fields: {
-        ${fields.join(',\n        ')}
-      },
+      ${extendFields.length > 0
+            ? `// Custom fields on the auto-generated User list
+      extendUserList: {
+        fields: {
+          ${extendFields.join(',\n          ')},
+        },
+      },`
+            : ''}
+      // The auth lists ship closed (deny-by-default) — grant the access your
+      // app needs here (ADR-0013).
       access: {
-        operation: {
-          query: () => true,
-          create: () => true, // Public sign-up
-          update: ({ session, item }) => session?.userId === item.id,
-          delete: ({ session }) => session?.role === 'admin',
+        user: {
+          operation: {
+            query: isSignedIn,
+            update: ({ session, item }) => session?.userId === item?.id,
+            delete: ({ session, item }) => ${hasRoles ? `session?.role === 'admin' || session?.userId === item?.id` : `session?.userId === item?.id`},
+          },
         },
       },
     }),
-    // Add your other lists here
+  ],
+  ${SQLITE_DB_BLOCK},
+  // For PostgreSQL use @prisma/adapter-pg instead:
+  // ${POSTGRES_DB_BLOCK.replace(/\n/g, '\n  // ')}
+  lists: {
+    // Your app lists go here. User, Session, Account, and Verification are
+    // added automatically by authPlugin.
+  },
+  ui: {
+    basePath: '/admin',
   },
-});`;
-        // Generated files
+})`;
         const files = [];
+        // Better-auth server instance
+        files.push({
+            path: 'lib/auth.ts',
+            language: 'typescript',
+            description: 'Better-auth server instance and session helper',
+            content: `import { createAuth } from '@opensaas/stack-auth/server'
+import { headers } from 'next/headers'
+import config from '../opensaas.config'
+import { rawOpensaasContext } from '@/.opensaas/context'
+
+export const auth = createAuth(config, rawOpensaasContext)
+
+/**
+ * Get the current session in OpenSaas format (the configured sessionFields).
+ */
+export async function getSession() {
+  const session = await auth.api.getSession({ headers: await headers() })
+  if (!session || !session.user) return null
+  return {
+    userId: session.user.id,
+    email: session.user.email,
+    name: session.user.name,${hasRoles ? `\n    role: (session.user as { role?: string }).role,` : ''}
+  }
+}
+
+export const GET = auth.handler
+export const POST = auth.handler`,
+        });
+        // Auth API route
+        files.push({
+            path: 'app/api/auth/[...all]/route.ts',
+            language: 'typescript',
+            description: 'Better-auth API route (handles all /api/auth/* endpoints)',
+            content: `export { GET, POST } from '@/lib/auth'`,
+        });
+        // Auth client
+        files.push({
+            path: 'lib/auth-client.ts',
+            language: 'typescript',
+            description: 'Client-side Better-auth instance for React components',
+            content: `'use client'
+
+import { createClient } from '@opensaas/stack-auth/client'
+
+export const authClient = createClient({
+  baseURL: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000',
+})`,
+        });
         // Sign-in page
-        if (hasPassword || hasOAuth) {
-            files.push({
-                path: 'app/sign-in/page.tsx',
-                language: 'tsx',
-                description: 'Sign-in page with form and OAuth buttons',
-                content: `import { SignInForm } from '@opensaas/stack-auth/ui';
+        files.push({
+            path: 'app/sign-in/page.tsx',
+            language: 'tsx',
+            description: 'Sign-in page using the pre-built SignInForm',
+            content: `import { SignInForm } from '@opensaas/stack-auth/ui'
+import { authClient } from '@/lib/auth-client'
+import Link from 'next/link'
 
 export default function SignInPage() {
   return (
-    <div className="min-h-screen flex items-center justify-center">
+    <div className="min-h-screen flex items-center justify-center p-4">
       <div className="w-full max-w-md">
         <h1 className="text-2xl font-bold mb-6">Sign In</h1>
         <SignInForm
-          ${hasPassword ? 'emailAndPassword' : ''}
-          ${hasOAuth ? `oauth={[${authMethods.includes('Google OAuth') ? "'google'" : ''}${authMethods.includes('GitHub OAuth') ? ", 'github'" : ''}]}` : ''}
-          redirectTo="/dashboard"
+          authClient={authClient}
+          redirectTo="/admin"
+          showSocialProviders={${hasOAuth}}
         />
+        ${hasPassword
+                ? `<div className="mt-4 text-center text-sm">
+          Don&apos;t have an account?{' '}
+          <Link href="/sign-up" className="underline">Sign up</Link>
+        </div>`
+                : ''}
       </div>
     </div>
-  );
+  )
 }`,
-            });
-        }
+        });
         // Sign-up page
         if (hasPassword) {
             files.push({
                 path: 'app/sign-up/page.tsx',
                 language: 'tsx',
-                description: 'Sign-up page with registration form',
-                content: `import { SignUpForm } from '@opensaas/stack-auth/ui';
+                description: 'Sign-up page using the pre-built SignUpForm',
+                content: `import { SignUpForm } from '@opensaas/stack-auth/ui'
+import { authClient } from '@/lib/auth-client'
 
 export default function SignUpPage() {
   return (
-    <div className="min-h-screen flex items-center justify-center">
+    <div className="min-h-screen flex items-center justify-center p-4">
       <div className="w-full max-w-md">
         <h1 className="text-2xl font-bold mb-6">Create Account</h1>
-        <SignUpForm
-          fields={['email', 'password', 'name']}
-          redirectTo="/dashboard"
-          ${emailVerification ? 'requireEmailVerification' : ''}
-        />
+        <SignUpForm authClient={authClient} redirectTo="/admin" />
       </div>
     </div>
-  );
+  )
 }`,
             });
         }
@@ -166,54 +253,49 @@ export default function SignUpPage() {
             path: 'lib/access-control.ts',
             language: 'typescript',
             description: 'Reusable access control functions',
-            content: `import type { AccessControl } from '@opensaas/stack-core';
-
-export const isAuthenticated: AccessControl = ({ session }) => {
-  return !!session?.userId;
-};
+            content: `import type { AccessControl } from '@opensaas/stack-core'
 
+export const isSignedIn: AccessControl = ({ session }) => !!session
 ${hasRoles
-                ? `export const isAdmin: AccessControl = ({ session }) => {
-  return session?.role === 'admin';
-};
-
-export const isOwner: AccessControl = ({ session, item }) => {
-  return session?.userId === item.id;
-};
-
-export const isAdminOrOwner: AccessControl = ({ session, item }) => {
-  return session?.role === 'admin' || session?.userId === item.id;
-};`
-                : ''}
-
-export const requireAuth: AccessControl = ({ session }) => {
-  if (!session?.userId) {
-    throw new Error('Authentication required');
-  }
-  return true;
-};`,
+                ? `
+export const isAdmin: AccessControl = ({ session }) => session?.role === 'admin'
+
+export const isSelf: AccessControl = ({ session, item }) => session?.userId === item?.id
+
+export const isAdminOrSelf: AccessControl = ({ session, item }) =>
+  session?.role === 'admin' || session?.userId === item?.id
+`
+                : `
+export const isSelf: AccessControl = ({ session, item }) => session?.userId === item?.id
+`}
+// Filter-based access: scope queries to rows the user owns.
+// Returning a Prisma filter (instead of a boolean) narrows results silently.
+export const ownRecordsOnly: AccessControl = ({ session }) =>
+  session ? { userId: { equals: session.userId } } : false`,
         });
         // Environment variables
         const envVars = {
-            DATABASE_URL: 'postgresql://user:password@localhost:5432/mydb',
+            DATABASE_URL: 'file:./dev.db',
             BETTER_AUTH_SECRET: '<generate-with-openssl-rand-base64-32>',
             BETTER_AUTH_URL: 'http://localhost:3000',
+            NEXT_PUBLIC_APP_URL: 'http://localhost:3000',
         };
-        if (authMethods.includes('Google OAuth')) {
+        if (hasGoogle) {
             envVars.GOOGLE_CLIENT_ID = '<your-google-client-id>';
             envVars.GOOGLE_CLIENT_SECRET = '<your-google-client-secret>';
         }
-        if (authMethods.includes('GitHub OAuth')) {
+        if (hasGithub) {
             envVars.GITHUB_CLIENT_ID = '<your-github-client-id>';
             envVars.GITHUB_CLIENT_SECRET = '<your-github-client-secret>';
         }
         // Next steps
         const nextSteps = [
-            'Copy the config updates to your `opensaas.config.ts`',
+            'Install dependencies: `pnpm add @opensaas/stack-auth @prisma/adapter-better-sqlite3`',
+            'Merge the config updates into your `opensaas.config.ts`',
             'Create the files shown above in your project',
             'Add environment variables to your `.env` file',
             hasOAuth ? 'Set up OAuth applications in Google/GitHub developer consoles' : null,
-            'Run `pnpm generate` to update Prisma schema',
+            'Run `pnpm generate` to update the Prisma schema and generated context',
             'Run `pnpm db:push` to update your database',
             'Start your dev server: `pnpm dev`',
             `Visit http://localhost:3000/${hasPassword ? 'sign-up' : 'sign-in'} to test authentication`,
@@ -221,44 +303,44 @@ export const requireAuth: AccessControl = ({ session }) => {
         // Dev guide section
         const devGuideSection = `## Authentication Feature
 
-This project uses Better-auth for authentication with the following configuration:
+This project uses Better-auth (via \`@opensaas/stack-auth\`) with:
 
 ${authMethods.map((m) => `- ${m}`).join('\n')}
 ${hasRoles ? `\n**User Roles**: ${roles?.join(', ')}` : ''}
 
-### Access Control Helpers
+The User, Session, Account, and Verification lists are auto-generated by
+\`authPlugin\`. They ship closed (deny-by-default) — access is granted through
+the plugin's \`access\` option in \`opensaas.config.ts\`.
 
-Use these functions in your list configurations:
+### Access Control Helpers
 
 \`\`\`typescript
-import { isAuthenticated${hasRoles ? ', isAdmin, isOwner' : ''} } from './lib/access-control';
+import { isSignedIn${hasRoles ? ', isAdmin, isSelf' : ', isSelf'} } from './lib/access-control'
 
 // In your list config:
 access: {
   operation: {
     query: () => true,
-    create: isAuthenticated,
-    update: isOwner,
-    delete: ${hasRoles ? 'isAdmin' : 'isOwner'},
-  }
+    create: isSignedIn,
+    update: ({ session, item }) => session?.userId === item?.authorId,
+    delete: ${hasRoles ? 'isAdmin' : '({ session, item }) => session?.userId === item?.authorId'},
+  },
 }
 \`\`\`
 
 ### Protected Routes
 
-To protect a route, check the session in your server components:
+Check the session in server components:
 
 \`\`\`typescript
-import { auth } from '@/lib/auth';
+import { redirect } from 'next/navigation'
+import { getSession } from '@/lib/auth'
 
 export default async function ProtectedPage() {
-  const session = await auth();
-
-  if (!session) {
-    redirect('/sign-in');
-  }
+  const session = await getSession()
+  if (!session) redirect('/sign-in')
 
-  return <div>Protected content for {session.user.name}</div>;
+  return <div>Signed in as {session.name}</div>
 }
 \`\`\`
 
@@ -267,12 +349,14 @@ export default async function ProtectedPage() {
 In server actions or API routes:
 
 \`\`\`typescript
-import { getContext } from '@/.opensaas/context';
-
-const context = await getContext();
-const currentUser = await context.db.user.findUnique({
-  where: { id: context.session?.userId }
-});
+import { getSession } from '@/lib/auth'
+import { getContext } from '@/.opensaas/context'
+
+const session = await getSession()
+const context = await getContext(session)
+const currentUser = session
+  ? await context.db.user.findUnique({ where: { id: session.userId } })
+  : null
 \`\`\``;
         return {
             configUpdates,
@@ -292,31 +376,35 @@ const currentUser = await context.db.user.findUnique({
         const taxonomy = this.answers['taxonomy'] || [];
         const postFields = this.answers['post-fields'] || [];
         const useTiptap = contentEditor === 'Rich text editor (Tiptap)';
-        const useMarkdown = contentEditor === 'Markdown';
+        const hasCategories = taxonomy.includes('Categories');
+        const hasTags = taxonomy.includes('Tags');
         // Build Post fields
         const fields = [
             'title: text({ validation: { isRequired: true } })',
-            'slug: text({ validation: { isRequired: true } })',
+            "slug: text({ validation: { isRequired: true }, isIndexed: 'unique' })",
         ];
         if (useTiptap) {
             fields.push('content: richText({ validation: { isRequired: true } })');
         }
-        else if (useMarkdown) {
-            fields.push('content: text({ ui: { displayMode: "textarea" }, validation: { isRequired: true } })');
-        }
         else {
-            fields.push('content: text({ ui: { displayMode: "textarea" }, validation: { isRequired: true } })');
+            fields.push("content: text({ ui: { displayMode: 'textarea' }, validation: { isRequired: true } })");
         }
-        fields.push('author: relationship({ ref: "User.posts" })');
+        fields.push("author: relationship({ ref: 'User.posts' })");
         if (hasStatus) {
-            fields.push("status: select({ options: ['draft', 'published'], defaultValue: 'draft' })");
+            fields.push("status: select({ options: [{ label: 'Draft', value: 'draft' }, { label: 'Published', value: 'published' }], defaultValue: 'draft' })");
             fields.push('publishedAt: timestamp()');
         }
+        if (hasCategories) {
+            fields.push("category: relationship({ ref: 'Category.posts' })");
+        }
+        if (hasTags) {
+            fields.push("tags: relationship({ ref: 'Tag.posts', many: true })");
+        }
         if (postFields.includes('Featured image')) {
-            fields.push('featuredImage: text()');
+            fields.push('featuredImage: text() // URL — or an image() field, see the file-upload feature');
         }
         if (postFields.includes('Excerpt/summary')) {
-            fields.push('excerpt: text({ ui: { displayMode: "textarea" } })');
+            fields.push("excerpt: text({ ui: { displayMode: 'textarea' } })");
         }
         if (postFields.includes('SEO metadata (title, description)')) {
             fields.push('seoTitle: text()');
@@ -325,76 +413,113 @@ const currentUser = await context.db.user.findUnique({
         if (postFields.includes('Reading time estimate')) {
             fields.push('readingTime: integer()');
         }
-        const configUpdates = `import { config, list } from '@opensaas/stack-core';
-import { text, select, relationship, timestamp${useTiptap ? '' : ', integer'} } from '@opensaas/stack-core/fields';
-${useTiptap ? "import { richText } from '@opensaas/stack-tiptap/fields';" : ''}
-
-export default config({
-  lists: {
+        const fieldImports = ['text', 'relationship'];
+        if (hasStatus)
+            fieldImports.push('select', 'timestamp');
+        if (postFields.includes('Reading time estimate'))
+            fieldImports.push('integer');
+        const configUpdates = `// Add these imports and lists to your existing opensaas.config.ts
+import { ${fieldImports.join(', ')} } from '@opensaas/stack-core/fields'
+${useTiptap ? "import { richText } from '@opensaas/stack-tiptap/fields'" : ''}
+
+// Inside config({ lists: { ... } }):
     Post: list({
       fields: {
         ${fields.join(',\n        ')},
       },
       access: {
         operation: {
-          query: ({ session }) => {
-            ${hasStatus ? "if (!session) return { status: { equals: 'published' } };" : ''}
-            return true;
-          },
-          create: ({ session }) => !!session?.userId,
-          update: ({ session, item }) => session?.userId === item.authorId,
+          ${hasStatus
+            ? `// Anonymous visitors only see published posts (filter-based access)
+          query: ({ session }) => (session ? true : { status: { equals: 'published' } }),`
+            : 'query: () => true,'}
+          create: ({ session }) => !!session,
+          update: ({ session, item }) => session?.userId === item?.authorId,
           delete: ({ session, item }) =>
-            session?.role === 'admin' || session?.userId === item.authorId,
+            session?.role === 'admin' || session?.userId === item?.authorId,
         },
       },
       hooks: {
-        ${hasStatus
-            ? `resolveInput: async ({ resolvedData, operation }) => {
-          // Auto-set publishedAt when publishing
-          if (operation === 'update' && resolvedData.status === 'published' && !resolvedData.publishedAt) {
-            resolvedData.publishedAt = new Date();
+        resolveInput: async ({ operation, resolvedData, item, context }) => {
+          const data = { ...resolvedData }
+          // Auto-connect the author on create
+          if (operation === 'create' && !data.author && context.session?.userId) {
+            data.author = { connect: { id: context.session.userId } }
           }
-          return resolvedData;
-        },`
+          ${hasStatus
+            ? `// Auto-set publishedAt when publishing
+          if (operation === 'create' && data.status === 'published') {
+            data.publishedAt = new Date()
+          } else if (operation === 'update' && data.status === 'published' && !item?.publishedAt) {
+            data.publishedAt = new Date()
+          }`
             : ''}
+          return data
+        },
       },
     }),
-    ${taxonomy.includes('Categories')
+    ${hasCategories
             ? `Category: list({
       fields: {
         name: text({ validation: { isRequired: true } }),
-        slug: text({ validation: { isRequired: true } }),
+        slug: text({ validation: { isRequired: true }, isIndexed: 'unique' }),
         posts: relationship({ ref: 'Post.category', many: true }),
       },
+      access: {
+        operation: {
+          query: () => true,
+          create: ({ session }) => session?.role === 'admin',
+          update: ({ session }) => session?.role === 'admin',
+          delete: ({ session }) => session?.role === 'admin',
+        },
+      },
     }),`
             : ''}
-    ${taxonomy.includes('Tags')
+    ${hasTags
             ? `Tag: list({
       fields: {
         name: text({ validation: { isRequired: true } }),
         posts: relationship({ ref: 'Post.tags', many: true }),
       },
+      access: {
+        operation: {
+          query: () => true,
+          create: ({ session }) => !!session,
+          update: ({ session }) => session?.role === 'admin',
+          delete: ({ session }) => session?.role === 'admin',
+        },
+      },
     }),`
             : ''}
-  },
-});`;
+
+// If you use authPlugin, give the auto-generated User list the other side of
+// the author relationship via extendUserList:
+//
+//   authPlugin({
+//     ...,
+//     extendUserList: {
+//       fields: {
+//         posts: relationship({ ref: 'Post.author', many: true }),
+//       },
+//     },
+//   })`;
         const files = [];
         // Blog list page
         files.push({
             path: 'app/blog/page.tsx',
             language: 'tsx',
             description: 'Blog listing page',
-            content: `import { getContext } from '@/.opensaas/context';
-import Link from 'next/link';
+            content: `import { getContext } from '@/.opensaas/context'
+import Link from 'next/link'
 
 export default async function BlogPage() {
-  const context = await getContext();
+  const context = await getContext()
 
   const posts = await context.db.post.findMany({
-    ${hasStatus ? "where: { status: 'published' }," : ''}
+    ${hasStatus ? "where: { status: { equals: 'published' } }," : ''}
     orderBy: { ${hasStatus ? 'publishedAt' : 'createdAt'}: 'desc' },
     include: { author: true },
-  });
+  })
 
   return (
     <div className="container mx-auto py-8">
@@ -403,19 +528,17 @@ export default async function BlogPage() {
         {posts.map((post) => (
           <article key={post.id} className="border rounded-lg p-6">
             <Link href={\`/blog/\${post.slug}\`}>
-              <h2 className="text-2xl font-bold hover:underline">
-                {post.title}
-              </h2>
+              <h2 className="text-2xl font-bold hover:underline">{post.title}</h2>
             </Link>
             ${postFields.includes('Excerpt/summary') ? '<p className="mt-2 text-gray-600">{post.excerpt}</p>' : ''}
             <div className="mt-4 text-sm text-gray-500">
-              By {post.author.name} · ${hasStatus ? '{post.publishedAt?.toLocaleDateString()}' : '{post.createdAt.toLocaleDateString()}'}
+              By {post.author?.name ?? 'Unknown'} · ${hasStatus ? '{post.publishedAt?.toLocaleDateString()}' : '{post.createdAt.toLocaleDateString()}'}
             </div>
           </article>
         ))}
       </div>
     </div>
-  );
+  )
 }`,
         });
         // Blog post page
@@ -423,78 +546,69 @@ export default async function BlogPage() {
             path: 'app/blog/[slug]/page.tsx',
             language: 'tsx',
             description: 'Individual blog post page',
-            content: `import { getContext } from '@/.opensaas/context';
-import { notFound } from 'next/navigation';
+            content: `import { getContext } from '@/.opensaas/context'
+import { notFound } from 'next/navigation'
 
 export default async function BlogPostPage({
   params,
 }: {
-  params: { slug: string };
+  params: Promise<{ slug: string }>
 }) {
-  const context = await getContext();
+  const { slug } = await params
+  const context = await getContext()
 
   const post = await context.db.post.findFirst({
     where: {
-      slug: params.slug,
-      ${hasStatus ? "status: 'published'," : ''}
+      slug: { equals: slug },
+      ${hasStatus ? "status: { equals: 'published' }," : ''}
     },
     include: { author: true },
-  });
+  })
 
   if (!post) {
-    notFound();
+    notFound()
   }
 
   return (
     <article className="container mx-auto py-8 max-w-3xl">
       <h1 className="text-4xl font-bold mb-4">{post.title}</h1>
       <div className="text-gray-600 mb-8">
-        By {post.author.name} · ${hasStatus ? '{post.publishedAt?.toLocaleDateString()}' : '{post.createdAt.toLocaleDateString()}'}
+        By {post.author?.name ?? 'Unknown'} · ${hasStatus ? '{post.publishedAt?.toLocaleDateString()}' : '{post.createdAt.toLocaleDateString()}'}
       </div>
-      ${useTiptap ? '<div className="prose max-w-none" dangerouslySetInnerHTML={{ __html: post.content }} />' : useMarkdown ? '<div className="prose max-w-none">{/* Render markdown here */}{post.content}</div>' : '<div className="prose max-w-none whitespace-pre-wrap">{post.content}</div>'}
+      ${useTiptap
+                ? `{/* richText stores Tiptap JSON. Render it to HTML with
+          generateHTML(post.content, [StarterKit]) from '@tiptap/html' +
+          '@tiptap/starter-kit', or build a custom renderer. */}
+      <div className="prose max-w-none">{JSON.stringify(post.content)}</div>`
+                : '<div className="prose max-w-none whitespace-pre-wrap">{post.content}</div>'}
     </article>
-  );
+  )
 }`,
         });
         const nextSteps = [
-            'Copy the config updates to your `opensaas.config.ts`',
-            'Add the `posts` relationship field to your User list',
-            useTiptap ? 'Install Tiptap package: `pnpm add @opensaas/stack-tiptap`' : null,
+            'Merge the config updates into your `opensaas.config.ts`',
+            'Add the `posts` relationship to the User list (via authPlugin `extendUserList` shown above)',
+            useTiptap ? 'Install the Tiptap package: `pnpm add @opensaas/stack-tiptap`' : null,
+            useTiptap
+                ? 'For public rendering of rich text, add `@tiptap/html` and `@tiptap/starter-kit`'
+                : null,
             'Create the blog pages in your `app/` directory',
-            'Run `pnpm generate` to update Prisma schema',
-            'Run `pnpm db:push` to update database',
-            'Create your first blog post in the admin UI',
+            'Run `pnpm generate` to update the Prisma schema',
+            'Run `pnpm db:push` to update the database',
+            'Create your first blog post in the admin UI at /admin',
         ].filter(Boolean);
         const devGuideSection = `## Blog Feature
 
 This project includes a blog system with:
 
 - ${contentEditor} for writing posts
-${hasStatus ? '- Draft/publish workflow' : ''}
+${hasStatus ? '- Draft/publish workflow (publishedAt is set automatically by a resolveInput hook)' : ''}
 ${taxonomy.length > 0 ? `- ${taxonomy.join(' and ')} for organization` : ''}
 
-### Creating a Post
-
-${hasStatus
-            ? `Posts start as drafts and can be published when ready:
-
-\`\`\`typescript
-const post = await context.db.post.create({
-  data: {
-    title: 'My Post',
-    slug: 'my-post',
-    content: '...',
-    authorId: session.userId,
-    status: 'draft', // or 'published'
-  }
-});
-\`\`\``
-            : ''}
-
 ### Access Control
 
-- Anyone can read ${hasStatus ? 'published posts' : 'posts'}
-- Only authenticated users can create posts
+- Anyone can read ${hasStatus ? 'published posts; signed-in users see drafts too (filter-based access)' : 'posts'}
+- Only authenticated users can create posts (author is auto-connected from the session)
 - Only authors can update their own posts
 - Admins and authors can delete posts`;
         return {
@@ -502,44 +616,326 @@ const post = await context.db.post.create({
             files,
             instructions: nextSteps,
             devGuideSection,
-            envVars: useTiptap ? {} : undefined,
+            envVars: undefined,
             nextSteps,
         };
     }
     /**
-     * Generate comments feature (stub - to be implemented)
+     * Generate comments feature
      */
     generateComments() {
+        const targets = this.answers['comment-targets'] || ['Posts'];
+        const nestedReplies = this.answers['nested-replies'];
+        const moderation = this.answers['moderation'];
+        const requiresApproval = moderation === 'Require admin approval';
+        // Build one relationship per commentable list (Posts → Post, Products → Product)
+        const targetLists = targets
+            .filter((t) => t !== 'Other')
+            .map((t) => (t.endsWith('s') ? t.slice(0, -1) : t));
+        const fields = [
+            "content: text({ validation: { isRequired: true }, ui: { displayMode: 'textarea' } })",
+            "author: relationship({ ref: 'User.comments' })",
+            ...targetLists.map((target) => `${target.toLowerCase()}: relationship({ ref: '${target}.comments' })`),
+        ];
+        if (nestedReplies) {
+            fields.push("parent: relationship({ ref: 'Comment.replies' })");
+            fields.push("replies: relationship({ ref: 'Comment.parent', many: true })");
+        }
+        if (requiresApproval) {
+            fields.push("status: select({ options: [{ label: 'Pending', value: 'pending' }, { label: 'Approved', value: 'approved' }], defaultValue: 'pending' })");
+        }
+        const fieldImports = ['text', 'relationship'];
+        if (requiresApproval)
+            fieldImports.push('select');
+        const configUpdates = `// Add these imports and lists to your existing opensaas.config.ts
+import { ${fieldImports.join(', ')} } from '@opensaas/stack-core/fields'
+
+// Inside config({ lists: { ... } }):
+    Comment: list({
+      fields: {
+        ${fields.join(',\n        ')},
+      },
+      access: {
+        operation: {
+          ${requiresApproval
+            ? `// Everyone sees approved comments; authors see their own pending
+          // ones; admins see everything (filter-based access).
+          query: ({ session }) => {
+            if (session?.role === 'admin') return true
+            if (session) {
+              return {
+                OR: [
+                  { status: { equals: 'approved' } },
+                  { authorId: { equals: session.userId } },
+                ],
+              }
+            }
+            return { status: { equals: 'approved' } }
+          },`
+            : 'query: () => true,'}
+          create: ({ session }) => !!session,
+          update: ({ session, item }) =>
+            session?.role === 'admin' || session?.userId === item?.authorId,
+          delete: ({ session, item }) =>
+            session?.role === 'admin' || session?.userId === item?.authorId,
+        },
+      },
+      hooks: {
+        resolveInput: async ({ operation, resolvedData, context }) => {
+          const data = { ...resolvedData }
+          // Auto-connect the author on create
+          if (operation === 'create' && !data.author && context.session?.userId) {
+            data.author = { connect: { id: context.session.userId } }
+          }
+          return data
+        },
+      },
+    }),
+
+// Add the other side of each relationship:
+${targetLists
+            .map((target) => `// - On the ${target} list: comments: relationship({ ref: 'Comment.${target.toLowerCase()}', many: true })`)
+            .join('\n')}
+// - On the User list (via authPlugin extendUserList):
+//     comments: relationship({ ref: 'Comment.author', many: true })`;
+        const nextSteps = [
+            'Merge the config updates into your `opensaas.config.ts`',
+            ...targetLists.map((target) => `Add the \`comments\` relationship field to your ${target} list`),
+            'Add the `comments` relationship to the User list (via authPlugin `extendUserList`)',
+            'Run `pnpm generate` to update the Prisma schema',
+            'Run `pnpm db:push` to update the database',
+            requiresApproval
+                ? 'Moderate comments in the admin UI at /admin/comment (flip status to approved)'
+                : 'View comments in the admin UI at /admin/comment',
+        ];
+        const devGuideSection = `## Comments Feature
+
+Threaded comments on: ${targetLists.join(', ')}
+
+- ${nestedReplies ? 'Nested replies via a self-referential parent/replies relationship' : 'Flat comment threads'}
+- ${moderation}
+- Authors are auto-connected from the session by a resolveInput hook
+- Authors can edit/delete their own comments; admins can moderate everything${requiresApproval
+            ? '\n- Anonymous visitors only see approved comments (filter-based access)'
+            : ''}`;
         return {
-            configUpdates: '// Comments feature implementation coming soon',
+            configUpdates,
             files: [],
-            instructions: ['Feature implementation in progress'],
-            devGuideSection: '## Comments Feature\n\nComing soon...',
-            nextSteps: ['Feature implementation in progress'],
+            instructions: nextSteps,
+            devGuideSection,
+            nextSteps,
         };
     }
     /**
-     * Generate file upload feature (stub - to be implemented)
+     * Generate file upload feature
      */
     generateFileUpload() {
+        const provider = this.answers['storage-provider'];
+        const associations = this.answers['file-associations'] || [];
+        const fileTypes = this.answers['file-types'] || [];
+        const imagesOnly = fileTypes.length === 1 && fileTypes.includes('Images (jpg, png, webp)');
+        let storageImport;
+        let storageBlock;
+        let extraDependency = null;
+        const envVars = {};
+        if (provider === 'AWS S3' || provider === 'Cloudflare R2') {
+            const isR2 = provider === 'Cloudflare R2';
+            storageImport = "import { s3Storage } from '@opensaas/stack-storage-s3'";
+            extraDependency = '@opensaas/stack-storage-s3';
+            storageBlock = `storage: {
+    uploads: s3Storage({
+      bucket: process.env.S3_BUCKET!,
+      region: process.env.S3_REGION${isR2 ? " || 'auto'" : '!'},
+      accessKeyId: process.env.S3_ACCESS_KEY_ID,
+      secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,${isR2
+                ? `\n      // R2 is S3-compatible — point the endpoint at your account
+      endpoint: process.env.S3_ENDPOINT, // https://<account-id>.r2.cloudflarestorage.com`
+                : ''}
+    }),
+  },`;
+            envVars.S3_BUCKET = '<your-bucket>';
+            envVars.S3_REGION = isR2 ? 'auto' : 'us-east-1';
+            envVars.S3_ACCESS_KEY_ID = '<access-key-id>';
+            envVars.S3_SECRET_ACCESS_KEY = '<secret-access-key>';
+            if (isR2)
+                envVars.S3_ENDPOINT = 'https://<account-id>.r2.cloudflarestorage.com';
+        }
+        else if (provider === 'Vercel Blob') {
+            storageImport = "import { vercelBlobStorage } from '@opensaas/stack-storage-vercel'";
+            extraDependency = '@opensaas/stack-storage-vercel';
+            storageBlock = `storage: {
+    uploads: vercelBlobStorage({
+      token: process.env.BLOB_READ_WRITE_TOKEN,
+    }),
+  },`;
+            envVars.BLOB_READ_WRITE_TOKEN = '<vercel-blob-read-write-token>';
+        }
+        else {
+            storageImport = "import { localStorage } from '@opensaas/stack-storage'";
+            storageBlock = `storage: {
+    uploads: localStorage({
+      uploadDir: './public/uploads',
+      serveUrl: '/uploads',
+    }),
+  },`;
+        }
+        const imageFieldExample = `image({
+          storage: 'uploads',
+          transformations: {
+            thumbnail: { width: 100, height: 100, fit: 'cover', format: 'webp' },
+          },
+          validation: {
+            maxFileSize: 5 * 1024 * 1024, // 5MB
+            acceptedMimeTypes: ['image/jpeg', 'image/png', 'image/webp'],
+          },
+        })`;
+        const fileFieldExample = `file({
+          storage: 'uploads',
+          validation: {
+            maxFileSize: 25 * 1024 * 1024, // 25MB
+          },
+        })`;
+        const fieldExamples = [];
+        if (associations.includes('User avatars')) {
+            fieldExamples.push(`// On the User list (via authPlugin extendUserList):
+        avatar: ${imageFieldExample},`);
+        }
+        if (associations.includes('Post featured images') || associations.includes('Product images')) {
+            const listName = associations.includes('Post featured images') ? 'Post' : 'Product';
+            fieldExamples.push(`// On the ${listName} list:
+        ${associations.includes('Post featured images') ? 'featuredImage' : 'images'}: ${imageFieldExample},`);
+        }
+        if (associations.includes('General attachments') || !imagesOnly) {
+            fieldExamples.push(`// General attachments on any list:
+        attachment: ${fileFieldExample},`);
+        }
+        const configUpdates = `// Add these imports to your opensaas.config.ts
+${storageImport}
+import { file, image } from '@opensaas/stack-storage/fields'
+
+// Add a top-level storage config alongside db and lists:
+export default config({
+  ${storageBlock}
+  // ...
+  lists: {
+    // Use file()/image() fields, referencing the storage key by name:
+        ${fieldExamples.join('\n        ')}
+  },
+})`;
+        const nextSteps = [
+            `Install dependencies: \`pnpm add @opensaas/stack-storage${extraDependency ? ` ${extraDependency}` : ''}\``,
+            'Merge the storage config and fields into your `opensaas.config.ts`',
+            Object.keys(envVars).length > 0 ? 'Add environment variables to your `.env` file' : null,
+            'Run `pnpm generate` to update the Prisma schema',
+            'Run `pnpm db:push` to update the database',
+            'Upload files through the admin UI — the image/file fields render an upload widget automatically',
+        ].filter(Boolean);
+        const devGuideSection = `## File Upload Feature
+
+Storage provider: ${provider}
+
+- Files are stored via the \`storage\` config block; fields reference a storage
+  key by name (\`storage: 'uploads'\`)
+- \`image()\` fields support transformations (resize/format) and validation
+- \`file()\` fields handle any file type with size validation
+- Access control on the owning list applies to the field like any other field`;
         return {
-            configUpdates: '// File upload feature implementation coming soon',
+            configUpdates,
             files: [],
-            instructions: ['Feature implementation in progress'],
-            devGuideSection: '## File Upload Feature\n\nComing soon...',
-            nextSteps: ['Feature implementation in progress'],
+            instructions: nextSteps,
+            devGuideSection,
+            envVars: Object.keys(envVars).length > 0 ? envVars : undefined,
+            nextSteps,
         };
     }
     /**
-     * Generate semantic search feature (stub - to be implemented)
+     * Generate semantic search feature
      */
     generateSemanticSearch() {
+        const searchableContent = this.answers['searchable-content'] || ['Posts'];
+        const embeddingProvider = this.answers['embedding-provider'];
+        const searchFields = this.answers['search-fields'] || ['Title', 'Content/body'];
+        const useOllama = embeddingProvider?.startsWith('Ollama');
+        const providerBlock = useOllama
+            ? `provider: ollamaEmbeddings({
+        baseURL: process.env.OLLAMA_BASE_URL || 'http://localhost:11434',
+        model: 'nomic-embed-text',
+      }),
+      storage: sqliteVssStorage({
+        distanceFunction: 'cosine',
+      }),`
+            : `provider: openaiEmbeddings({
+        apiKey: process.env.OPENAI_API_KEY!,
+        model: 'text-embedding-3-small',
+      }),
+      // pgvectorStorage requires the postgresql db provider.
+      // On SQLite, use sqliteVssStorage from '@opensaas/stack-rag' instead.
+      storage: pgvectorStorage({
+        distanceFunction: 'cosine',
+      }),`;
+        const ragImports = useOllama
+            ? "import { ragPlugin, ollamaEmbeddings, sqliteVssStorage } from '@opensaas/stack-rag'"
+            : "import { ragPlugin, openaiEmbeddings, pgvectorStorage } from '@opensaas/stack-rag'";
+        const targetList = searchableContent[0]?.endsWith('s')
+            ? searchableContent[0].slice(0, -1)
+            : searchableContent[0] || 'Post';
+        const envVars = useOllama
+            ? { OLLAMA_BASE_URL: 'http://localhost:11434' }
+            : { OPENAI_API_KEY: '<your-openai-api-key>' };
+        const configUpdates = `// Add these imports to your opensaas.config.ts
+${ragImports}
+import { searchable } from '@opensaas/stack-rag/fields'
+
+// Add the RAG plugin alongside your other plugins:
+export default config({
+  plugins: [
+    ragPlugin({
+      ${providerBlock}
+    }),
+    // ...your other plugins
+  ],
+  // ...
+  lists: {
+    ${targetList}: list({
+      fields: {
+        // Wrap the fields you want indexed with searchable() —
+        // embeddings update automatically when the content changes.
+        ${searchFields.includes('Title') ? `title: searchable(text({ validation: { isRequired: true } })),` : ''}
+        ${searchFields.includes('Content/body')
+            ? `content: searchable(
+          text({ validation: { isRequired: true }, ui: { displayMode: 'textarea' } }),
+        ),`
+            : ''}
+        // ...your other fields
+      },
+    }),
+  },
+})`;
+        const nextSteps = [
+            'Install the RAG package: `pnpm add @opensaas/stack-rag`',
+            useOllama
+                ? 'Install and start Ollama, then pull the embedding model: `ollama pull nomic-embed-text`'
+                : 'Set OPENAI_API_KEY in your `.env` file (pgvector storage requires PostgreSQL)',
+            'Merge the plugin and searchable() fields into your `opensaas.config.ts`',
+            'Run `pnpm generate` to update the Prisma schema',
+            'Run `pnpm db:push` to update the database',
+            `Query with the RAG runtime — see the ${useOllama ? 'rag-ollama-demo' : 'rag-openai-chatbot'} example for a full search API route`,
+        ];
+        const devGuideSection = `## Semantic Search Feature
+
+AI-powered search over: ${searchableContent.join(', ')}
+
+- Embedding provider: ${embeddingProvider}
+- Fields wrapped in \`searchable()\` are embedded automatically on create/update
+- Search respects the list's access control — users only find what they can read
+- See the ${useOllama ? 'rag-ollama-demo' : 'rag-openai-chatbot'} example in the stack repo for a complete search UI`;
         return {
-            configUpdates: '// Semantic search feature implementation coming soon',
+            configUpdates,
             files: [],
-            instructions: ['Feature implementation in progress'],
-            devGuideSection: '## Semantic Search Feature\n\nComing soon...',
-            nextSteps: ['Feature implementation in progress'],
+            instructions: nextSteps,
+            devGuideSection,
+            envVars,
+            nextSteps,
         };
     }
 }