@pattern-stack/codegen 0.6.4 → 0.6.5

package/dist/src/cli/index.js

@@ -2839,8 +2839,8 @@ function loadEntityFromYaml(filePath) {
 }
 function formatZodErrors(error) {
   return error.errors.map((err) => {
-    const path27 = err.path.join(".");
-    const location = path27 ? `at '${path27}'` : "at root";
+    const path29 = err.path.join(".");
+    const location = path29 ? `at '${path29}'` : "at root";
     return `${err.message} ${location}`;
   });
 }
@@ -3392,19 +3392,19 @@ function findCircularDependencies(graph) {
   const cycles = [];
   const visited = /* @__PURE__ */ new Set();
   const recursionStack = /* @__PURE__ */ new Set();
-  function dfs(node, path27) {
+  function dfs(node, path29) {
     visited.add(node);
     recursionStack.add(node);
     const outgoingEdges = graph.edges.filter((e) => e.from === node);
     for (const edge of outgoingEdges) {
       if (!visited.has(edge.to)) {
-        dfs(edge.to, [...path27, edge.to]);
+        dfs(edge.to, [...path29, edge.to]);
       } else if (recursionStack.has(edge.to)) {
-        const cycleStart = path27.indexOf(edge.to);
+        const cycleStart = path29.indexOf(edge.to);
         if (cycleStart !== -1) {
-          cycles.push([...path27.slice(cycleStart), edge.to]);
+          cycles.push([...path29.slice(cycleStart), edge.to]);
         } else {
-          cycles.push([...path27, edge.to]);
+          cycles.push([...path29, edge.to]);
         }
       }
     }
@@ -4001,8 +4001,8 @@ function suggestTransitiveRelationships(graph, options) {
   for (const [entityName, entity] of graph.entities) {
     if (shouldExcludeEntity(entityName, opts)) continue;
     const paths = findTransitivePaths(graph, entityName, opts);
-    for (const path27 of paths) {
-      suggestions.push(createSuggestion(path27));
+    for (const path29 of paths) {
+      suggestions.push(createSuggestion(path29));
     }
   }
   return suggestions;
@@ -4033,7 +4033,7 @@ function findTransitivePaths(graph, sourceEntity, opts) {
   while (queue.length > 0) {
     const current = queue.shift();
     if (!current) continue;
-    const { entity, depth, path: path27, visited } = current;
+    const { entity, depth, path: path29, visited } = current;
     if (depth >= opts.maxDepth) continue;
     const currentEntity = graph.entities.get(entity);
     if (!currentEntity) continue;
@@ -4044,7 +4044,7 @@ function findTransitivePaths(graph, sourceEntity, opts) {
       if (shouldExcludeEntity(target, opts)) continue;
       if (visited.has(target)) continue;
       const newPath = [
-        ...path27,
+        ...path29,
         {
           via: entity,
           relationship: relName,
@@ -4112,15 +4112,15 @@ function generateYamlSnippet(name, target, throughPath) {
     target: ${target}
     through: "${throughPath}"`;
 }
-function createSuggestion(path27) {
-  const pathDescription = [path27.source, ...path27.hops.map((h) => h.via), path27.target].join(" -> ");
+function createSuggestion(path29) {
+  const pathDescription = [path29.source, ...path29.hops.map((h) => h.via), path29.target].join(" -> ");
   return {
     severity: "info",
     type: "transitive_suggestion",
-    entity: path27.source,
+    entity: path29.source,
     message: `Potential transitive relationship: ${pathDescription}`,
-    suggestion: `Add "${path27.suggestedName}" relationship via "${path27.throughPath}"`,
-    path: path27
+    suggestion: `Add "${path29.suggestedName}" relationship via "${path29.throughPath}"`,
+    path: path29
   };
 }
 
@@ -7902,7 +7902,7 @@ var entity_default = entityNoun;
 
 // src/cli/commands/subsystem.ts
 import fs10 from "fs";
-import path19 from "path";
+import path21 from "path";
 import { Command as Command3, Option as Option3 } from "clipanion";
 
 // src/cli/shared/config-block-detect.ts
@@ -8146,9 +8146,90 @@ function localsToHygenArgs5(locals) {
   ];
 }
 
+// src/cli/shared/auth-scaffold-locals.ts
+import crypto2 from "crypto";
+import path17 from "path";
+var FALLBACK_BACKEND_SRC3 = "src";
+var DEFAULT_REDIRECT_URI_BASE = "http://localhost:3000";
+function resolveAuthScaffoldLocals(input) {
+  const { cwd, config } = input;
+  const backendSrc = typeof config?.paths?.backend_src === "string" && config.paths.backend_src.length > 0 ? config.paths.backend_src : FALLBACK_BACKEND_SRC3;
+  const subsystemsRoot = resolveSubsystemsRootFromConfig(cwd, config);
+  const authBlock = config?.auth ?? {};
+  const redirectRaw = authBlock.redirect_uri_base;
+  const redirectUriBase = typeof redirectRaw === "string" && redirectRaw.length > 0 ? redirectRaw : DEFAULT_REDIRECT_URI_BASE;
+  const tokenEncryptionKey = crypto2.randomBytes(32).toString("base64");
+  return {
+    appName: path17.basename(cwd),
+    configPath: path17.resolve(cwd, "codegen.config.yaml"),
+    schemaPath: path17.resolve(
+      subsystemsRoot,
+      "auth",
+      "auth-oauth-state.schema.ts"
+    ),
+    appModulePath: path17.resolve(cwd, backendSrc, "app.module.ts"),
+    envConfigPath: path17.resolve(cwd, ".env.config"),
+    redirectUriBase,
+    tokenEncryptionKey
+  };
+}
+function localsToHygenArgs6(locals) {
+  return [
+    "--appName",
+    locals.appName,
+    "--configPath",
+    locals.configPath,
+    "--schemaPath",
+    locals.schemaPath,
+    "--appModulePath",
+    locals.appModulePath,
+    "--envConfigPath",
+    locals.envConfigPath,
+    "--redirectUriBase",
+    locals.redirectUriBase,
+    "--tokenEncryptionKey",
+    locals.tokenEncryptionKey
+  ];
+}
+
+// src/cli/shared/auth-integrations-scaffold-locals.ts
+import path18 from "path";
+var FALLBACK_BACKEND_SRC4 = "src";
+var SHARED_DIR_NAME = "shared";
+var DEFAULT_DEFINITIONS_DIR = "definitions/entities";
+function resolveAuthIntegrationsScaffoldLocals(input) {
+  const { cwd, config } = input;
+  const backendSrc = typeof config?.paths?.backend_src === "string" && config.paths.backend_src.length > 0 ? config.paths.backend_src : FALLBACK_BACKEND_SRC4;
+  const sharedConfigured = config?.paths?.shared;
+  const sharedRoot = typeof sharedConfigured === "string" && sharedConfigured.length > 0 ? path18.resolve(cwd, sharedConfigured) : path18.resolve(cwd, backendSrc, SHARED_DIR_NAME);
+  const definitionsConfigured = config?.paths?.definitions;
+  const definitionsPath = typeof definitionsConfigured === "string" && definitionsConfigured.length > 0 ? path18.resolve(cwd, definitionsConfigured, "integration.yaml") : path18.resolve(cwd, DEFAULT_DEFINITIONS_DIR, "integration.yaml");
+  const appModulePath = path18.resolve(cwd, backendSrc, "app.module.ts");
+  let authModuleRegistered = false;
+  const appModuleSource = input.readFile(appModulePath);
+  if (appModuleSource && appModuleSource.includes("AuthModule.forRoot")) {
+    authModuleRegistered = true;
+  }
+  return {
+    appName: path18.basename(cwd),
+    appModulePath,
+    sharedRoot,
+    definitionsPath,
+    authModuleRegistered
+  };
+}
+function localsToHygenArgs7(locals) {
+  return [
+    "--appName",
+    locals.appName,
+    "--appModulePath",
+    locals.appModulePath
+  ];
+}
+
 // src/cli/shared/runtime-copier.ts
 import fs8 from "fs";
-import path17 from "path";
+import path19 from "path";
 function readIfExists(p) {
   try {
     return fs8.readFileSync(p, "utf-8");
@@ -8159,7 +8240,7 @@ function readIfExists(p) {
 function writeFile(target, content) {
   const existing = readIfExists(target);
   if (existing === content) return "unchanged";
-  fs8.mkdirSync(path17.dirname(target), { recursive: true });
+  fs8.mkdirSync(path19.dirname(target), { recursive: true });
   fs8.writeFileSync(target, content);
   return existing === null ? "written" : "updated";
 }
@@ -8173,8 +8254,8 @@ function extractRelativeImports(source) {
   return out;
 }
 function resolveSourceImport(sourceFile, specifier) {
-  const base = path17.resolve(path17.dirname(sourceFile), specifier);
-  const candidates = [base + ".ts", base + ".tsx", path17.join(base, "index.ts")];
+  const base = path19.resolve(path19.dirname(sourceFile), specifier);
+  const candidates = [base + ".ts", base + ".tsx", path19.join(base, "index.ts")];
   for (const c of candidates) {
     if (fs8.existsSync(c)) return c;
   }
@@ -8185,8 +8266,8 @@ async function copyRuntime(opts) {
   if (!fs8.existsSync(sourceDir) || !fs8.statSync(sourceDir).isDirectory()) {
     throw new Error(`runtime source directory not found: ${sourceDir}`);
   }
-  const runtimeRoot4 = opts.runtimeRoot ? path17.resolve(opts.runtimeRoot) : path17.resolve(sourceDir, "..", "..");
-  const depsTargetRoot = opts.depsTargetRoot ?? path17.resolve(targetDir, "..");
+  const runtimeRoot4 = opts.runtimeRoot ? path19.resolve(opts.runtimeRoot) : path19.resolve(sourceDir, "..", "..");
+  const depsTargetRoot = opts.depsTargetRoot ?? path19.resolve(targetDir, "..");
   const result = {
     written: [],
     updated: [],
@@ -8197,7 +8278,7 @@ async function copyRuntime(opts) {
   const queue = [];
   function walk(dir) {
     for (const entry of fs8.readdirSync(dir)) {
-      const src = path17.join(dir, entry);
+      const src = path19.join(dir, entry);
       const stat = fs8.statSync(src);
       if (stat.isDirectory()) {
         if (entry === "generated") continue;
@@ -8206,9 +8287,9 @@ async function copyRuntime(opts) {
       }
       if (!stat.isFile()) continue;
       if (!entry.endsWith(".ts") && !entry.endsWith(".tsx")) continue;
-      const rel = path17.relative(sourceDir, src);
+      const rel = path19.relative(sourceDir, src);
       if (filter && !filter(rel) && !filter(entry)) continue;
-      queue.push({ src, dest: path17.join(targetDir, rel), isDep: false });
+      queue.push({ src, dest: path19.join(targetDir, rel), isDep: false });
     }
   }
   walk(sourceDir);
@@ -8230,11 +8311,11 @@ async function copyRuntime(opts) {
       for (const spec of extractRelativeImports(content)) {
         const resolvedSrc = resolveSourceImport(next.src, spec);
         if (!resolvedSrc) continue;
-        const relToRuntime = path17.relative(runtimeRoot4, resolvedSrc);
-        if (relToRuntime.startsWith("..") || path17.isAbsolute(relToRuntime)) continue;
-        const relToSource = path17.relative(sourceDir, resolvedSrc);
-        if (!relToSource.startsWith("..") && !path17.isAbsolute(relToSource)) continue;
-        const depDest = path17.join(depsTargetRoot, relToRuntime);
+        const relToRuntime = path19.relative(runtimeRoot4, resolvedSrc);
+        if (relToRuntime.startsWith("..") || path19.isAbsolute(relToRuntime)) continue;
+        const relToSource = path19.relative(sourceDir, resolvedSrc);
+        if (!relToSource.startsWith("..") && !path19.isAbsolute(relToSource)) continue;
+        const depDest = path19.join(depsTargetRoot, relToRuntime);
         queue.push({ src: resolvedSrc, dest: depDest, isDep: true });
       }
     }
@@ -8244,7 +8325,7 @@ async function copyRuntime(opts) {
 
 // src/cli/shared/subsystem-detect.ts
 import fs9 from "fs";
-import path18 from "path";
+import path20 from "path";
 var SUBSYSTEMS = [
   {
     name: "events",
@@ -8301,21 +8382,49 @@ var SUBSYSTEMS = [
     description: "Observability combiner \u2014 composes sibling read ports via @Optional() DI (ADR-025)",
     backends: ["combiner"],
     defaultBackend: "combiner"
+  },
+  {
+    // #287. Auth subsystem (PR #289) — AuthModule + ports + OAuth state
+    // store + AuthController. Backends: drizzle (prod, persists OAuth
+    // state in `auth_oauth_state`) or memory (dev/tests). Detection in
+    // `detectInstalledSubsystems` is a special case: auth's protocols
+    // live under `protocols/`, not at the subsystem root, so we look
+    // for `auth.module.ts` instead of `*.protocol.ts`.
+    name: "auth",
+    description: "OAuth integration auth (AuthModule + ports + state store)",
+    backends: ["drizzle", "memory"],
+    defaultBackend: "drizzle"
+  },
+  {
+    // #287. Auth-integrations starter (PR #290) — vendored from
+    // `examples/auth-integrations/`, NOT from `runtime/subsystems/`.
+    // Bundles a canonical `integration` entity yaml + the three
+    // integration-store-port adapters + the `IntegrationsService`
+    // facade. Single-backend (drizzle); the runtime adapters call
+    // directly into the codegen-emitted `IntegrationService` from the
+    // entity layer. Detection: presence of
+    // `<sharedRoot>/integrations/integrations-auth.module.ts`.
+    name: "auth-integrations",
+    description: "Vendored integrations entity + adapters (consumes auth subsystem)",
+    backends: ["drizzle"],
+    defaultBackend: "drizzle"
   }
 ];
 var KNOWN_NAMES = SUBSYSTEMS.map((s) => s.name);
 function candidateRoots(cwd, configured) {
   const roots = [
-    ...configured ? [path18.resolve(cwd, configured)] : [],
-    path18.resolve(cwd, "src/shared/subsystems"),
-    path18.resolve(cwd, "src/subsystems"),
-    path18.resolve(cwd, "shared/subsystems")
+    ...configured ? [path20.resolve(cwd, configured)] : [],
+    path20.resolve(cwd, "src/shared/subsystems"),
+    path20.resolve(cwd, "src/subsystems"),
+    path20.resolve(cwd, "shared/subsystems")
   ];
   return Array.from(new Set(roots));
 }
 function inferBackend(dir, name) {
   if (name === "observability") return "combiner";
-  const hasDrizzle = fs9.existsSync(path18.join(dir, `${name.replace(/s$/, "")}-bus.drizzle-backend.ts`)) || fs9.readdirSync(dir).some((f) => f.endsWith(".drizzle-backend.ts"));
+  if (name === "auth") return "drizzle";
+  if (name === "auth-integrations") return "drizzle";
+  const hasDrizzle = fs9.existsSync(path20.join(dir, `${name.replace(/s$/, "")}-bus.drizzle-backend.ts`)) || fs9.readdirSync(dir).some((f) => f.endsWith(".drizzle-backend.ts"));
   const hasMemory = fs9.readdirSync(dir).some((f) => f.endsWith(".memory-backend.ts"));
   const hasLocal = fs9.readdirSync(dir).some((f) => f.includes("local"));
   if (hasDrizzle && hasMemory) return "drizzle";
@@ -8334,10 +8443,14 @@ async function detectInstalledSubsystems(ctx) {
     for (const name of KNOWN_NAMES) {
       if (seen.has(name)) continue;
       if (name === "openapi-config") continue;
-      const dir = path18.join(root, name);
+      if (name === "auth-integrations") continue;
+      const dir = path20.join(root, name);
       if (!fs9.existsSync(dir) || !fs9.statSync(dir).isDirectory()) continue;
       const files = fs9.readdirSync(dir);
-      const hasProtocol = files.some((f) => f.endsWith(".protocol.ts"));
+      let hasProtocol = files.some((f) => f.endsWith(".protocol.ts"));
+      if (name === "auth") {
+        hasProtocol = files.includes("auth.module.ts");
+      }
       if (!hasProtocol) continue;
       seen.add(name);
       found.push({
@@ -8348,7 +8461,7 @@ async function detectInstalledSubsystems(ctx) {
     }
   }
   if (!seen.has("openapi-config")) {
-    const configPath = path18.resolve(
+    const configPath = path20.resolve(
       ctx.cwd,
       ctx.config ? "codegen.config.yaml" : "codegen.config.yaml"
     );
@@ -8366,18 +8479,35 @@ async function detectInstalledSubsystems(ctx) {
       }
     }
   }
+  if (!seen.has("auth-integrations")) {
+    const backendSrc = ctx.config?.paths?.backend_src ?? "src";
+    const sharedConfigured = ctx.config?.paths?.shared;
+    const sharedRoot = typeof sharedConfigured === "string" && sharedConfigured.length > 0 ? path20.resolve(ctx.cwd, sharedConfigured) : path20.resolve(ctx.cwd, backendSrc, "shared");
+    const moduleFile = path20.join(
+      sharedRoot,
+      "integrations",
+      "integrations-auth.module.ts"
+    );
+    if (fs9.existsSync(moduleFile)) {
+      found.push({
+        name: "auth-integrations",
+        path: path20.dirname(moduleFile),
+        backend: "drizzle"
+      });
+    }
+  }
   return found;
 }
 
 // src/cli/commands/subsystem.ts
 function runtimeRoot() {
-  const pkgRoot = path19.resolve(import.meta.dirname, "..", "..", "..");
-  const topLevel = path19.join(pkgRoot, "runtime");
+  const pkgRoot = path21.resolve(import.meta.dirname, "..", "..", "..");
+  const topLevel = path21.join(pkgRoot, "runtime");
   if (fs10.existsSync(topLevel)) return topLevel;
-  return path19.join(pkgRoot, "dist", "runtime");
+  return path21.join(pkgRoot, "dist", "runtime");
 }
 function subsystemSource(name) {
-  return path19.join(runtimeRoot(), "subsystems", name);
+  return path21.join(runtimeRoot(), "subsystems", name);
 }
 function describeSubsystem(name) {
   return SUBSYSTEMS.find((s) => s.name === name) ?? null;
@@ -8404,7 +8534,7 @@ async function summary2(ctx) {
   }
   body.push(theme.muted("Installed:"));
   for (const i of installed) {
-    const rel = path19.relative(ctx.cwd, i.path) || i.path;
+    const rel = path21.relative(ctx.cwd, i.path) || i.path;
     body.push(
       `  ${theme.success(icons.check)} ${i.name.padEnd(10)} ${theme.muted(
         `${i.backend} backend`
@@ -8461,6 +8591,9 @@ function backendFileFilter(backend, subsystemName) {
     if (subsystemName === "sync" && file === "sync-audit.schema.ts") {
       return false;
     }
+    if (subsystemName === "auth" && file === "auth-oauth-state.schema.ts") {
+      return false;
+    }
     if (backend === "memory") {
       if (file.endsWith(".drizzle-backend.ts")) return false;
       if (file.endsWith(".schema.ts")) return false;
@@ -8519,6 +8652,9 @@ var SubsystemInstallCommand = class extends Command3 {
     if (desc3.name === "openapi-config") {
       return this.executeOpenApiConfig(ctx);
     }
+    if (desc3.name === "auth-integrations") {
+      return this.executeAuthIntegrations(ctx);
+    }
     const installed = await detectInstalledSubsystems(ctx);
     const already = installed.find((i) => i.name === desc3.name);
     if (already && !this.force) {
@@ -8536,14 +8672,14 @@ var SubsystemInstallCommand = class extends Command3 {
       return 0;
     }
     const targetRoot = resolveSubsystemsRoot(ctx, this.target);
-    const subsystemTarget = path19.join(targetRoot, desc3.name);
+    const subsystemTarget = path21.join(targetRoot, desc3.name);
     const source = subsystemSource(desc3.name);
     if (!fs10.existsSync(source)) {
       printError(`Runtime subsystem source missing: ${source}`);
       return 1;
     }
     if (!this.force) {
-      const gitCheck = checkGitSafety([path19.relative(ctx.cwd, subsystemTarget) || subsystemTarget], ctx.cwd);
+      const gitCheck = checkGitSafety([path21.relative(ctx.cwd, subsystemTarget) || subsystemTarget], ctx.cwd);
       if (gitCheck.inRepo && !gitCheck.clean) {
         printWarning(
           `Uncommitted changes under ${subsystemTarget}. Pass --force to overwrite.`
@@ -8552,7 +8688,7 @@ var SubsystemInstallCommand = class extends Command3 {
       }
     }
     if (!isJsonMode()) {
-      printInfo(`target = ${path19.relative(ctx.cwd, subsystemTarget) || subsystemTarget}`);
+      printInfo(`target = ${path21.relative(ctx.cwd, subsystemTarget) || subsystemTarget}`);
       printInfo(`backend = ${backend}`);
     }
     const result = await copyRuntime({
@@ -8561,7 +8697,7 @@ var SubsystemInstallCommand = class extends Command3 {
       filter: backendFileFilter(backend, desc3.name),
       resolveDeps: true,
       runtimeRoot: runtimeRoot(),
-      depsTargetRoot: path19.resolve(targetRoot, ".."),
+      depsTargetRoot: path21.resolve(targetRoot, ".."),
       dryRun: this.dryRun
     });
     const jobsScaffold = desc3.name === "jobs" ? runJobsScaffold(ctx.cwd, ctx.config, {
@@ -8589,6 +8725,11 @@ var SubsystemInstallCommand = class extends Command3 {
       json: isJsonMode(),
       forceConfig: this.forceConfig
     }) : null;
+    const authScaffold = desc3.name === "auth" ? runAuthScaffold(ctx.cwd, ctx.config, {
+      dryRun: this.dryRun,
+      json: isJsonMode(),
+      forceConfig: this.forceConfig
+    }) : null;
     if (jobsScaffold?.configBlockOutcome === "parse-error") {
       printError(
         "codegen.config.yaml is not valid YAML: refusing to inject jobs config block. Fix the YAML and re-run."
@@ -8619,6 +8760,12 @@ var SubsystemInstallCommand = class extends Command3 {
       );
       return 1;
     }
+    if (authScaffold?.configBlockOutcome === "parse-error") {
+      printError(
+        "codegen.config.yaml is not valid YAML: refusing to inject auth config block. Fix the YAML and re-run."
+      );
+      return 1;
+    }
     if (isJsonMode()) {
       printJson({
         command: "subsystem install",
@@ -8637,21 +8784,22 @@ var SubsystemInstallCommand = class extends Command3 {
         ...eventsScaffold ? { scaffold: eventsScaffold } : {},
         ...syncScaffold ? { scaffold: syncScaffold } : {},
         ...bridgeScaffold ? { scaffold: bridgeScaffold } : {},
-        ...observabilityScaffold ? { scaffold: observabilityScaffold } : {}
+        ...observabilityScaffold ? { scaffold: observabilityScaffold } : {},
+        ...authScaffold ? { scaffold: authScaffold } : {}
       });
       return 0;
     }
     if (this.dryRun) {
       printInfo(`Dry run \u2014 ${result.planned.length} files would be written`);
       for (const p of result.planned) {
-        console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+        console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
       }
       if (jobsScaffold?.planned?.length) {
         printInfo(
           `Jobs scaffold \u2014 ${jobsScaffold.planned.length} template targets`
         );
         for (const p of jobsScaffold.planned) {
-          console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
         }
       }
       if (eventsScaffold?.planned?.length) {
@@ -8659,7 +8807,7 @@ var SubsystemInstallCommand = class extends Command3 {
           `Events scaffold \u2014 ${eventsScaffold.planned.length} template targets`
         );
         for (const p of eventsScaffold.planned) {
-          console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
         }
       }
       if (syncScaffold?.planned?.length) {
@@ -8667,7 +8815,7 @@ var SubsystemInstallCommand = class extends Command3 {
           `Sync scaffold \u2014 ${syncScaffold.planned.length} template targets`
         );
         for (const p of syncScaffold.planned) {
-          console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
         }
       }
       if (bridgeScaffold?.planned?.length) {
@@ -8675,7 +8823,7 @@ var SubsystemInstallCommand = class extends Command3 {
           `Bridge scaffold \u2014 ${bridgeScaffold.planned.length} template targets`
         );
         for (const p of bridgeScaffold.planned) {
-          console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
         }
       }
       if (observabilityScaffold?.planned?.length) {
@@ -8683,7 +8831,15 @@ var SubsystemInstallCommand = class extends Command3 {
           `Observability scaffold \u2014 ${observabilityScaffold.planned.length} template targets`
         );
         for (const p of observabilityScaffold.planned) {
-          console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, p) || p}`);
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
+        }
+      }
+      if (authScaffold?.planned?.length) {
+        printInfo(
+          `Auth scaffold \u2014 ${authScaffold.planned.length} template targets`
+        );
+        for (const p of authScaffold.planned) {
+          console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`);
         }
       }
       return 0;
@@ -8750,11 +8906,29 @@ var SubsystemInstallCommand = class extends Command3 {
         );
       }
     }
+    if (authScaffold) {
+      if (authScaffold.ok) {
+        printSuccess(
+          `auth scaffold applied (schema, config block, app.module.ts hint, .env.config key)`
+        );
+      } else {
+        printWarning(
+          `auth scaffold (Hygen) failed \u2014 runtime files were written; re-run after fixing: ${authScaffold.error ?? "unknown error"}`
+        );
+      }
+    }
     printSuccess(`${desc3.name} subsystem installed with ${backend} backend.`);
     if (desc3.name === "observability") {
       printInfo(
         "Register `ObservabilityModule.forRoot()` AFTER Events/Jobs/Bridge/Sync in app.module.ts"
       );
+    } else if (desc3.name === "auth") {
+      printInfo("auth subsystem installed.");
+      printInfo("Next steps:");
+      printInfo("  1. Provide an IUserContext adapter (your app's session/JWT scheme \u2014 req is typed `unknown`, narrow to your framework's Request inside the adapter).");
+      printInfo("  2. Install the auth-integrations starter:  cdp subsystem install auth-integrations");
+      printInfo("  3. Bind per-provider strategies into STRATEGY_REGISTRY (HubSpot, SFDC, Google, ...).");
+      printInfo("  4. Configure provider client_id/client_secret in secrets/secrets.yaml.");
     } else {
       printInfo(
         `Register ${capitalize(desc3.name)}Module.forRoot({ backend: '${backend}' }) in your app.module.ts`
@@ -8778,7 +8952,7 @@ var SubsystemInstallCommand = class extends Command3 {
    * semantics as jobs/events/sync/bridge.
    */
   async executeOpenApiConfig(ctx) {
-    const configPath = path19.join(ctx.cwd, "codegen.config.yaml");
+    const configPath = path21.join(ctx.cwd, "codegen.config.yaml");
     const outcome = planConfigBlockAction(configPath, "openapi", this.forceConfig);
     if (outcome === "parse-error") {
       printError(
@@ -8797,7 +8971,7 @@ var SubsystemInstallCommand = class extends Command3 {
         });
       } else {
         printInfo(`Dry run \u2014 openapi config block would be ${outcome}`);
-        console.log(`  ${theme.muted(icons.arrow)} ${path19.relative(ctx.cwd, configPath) || configPath}`);
+        console.log(`  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, configPath) || configPath}`);
       }
       return 0;
     }
@@ -8833,6 +9007,87 @@ var SubsystemInstallCommand = class extends Command3 {
     );
     return 0;
   }
+  /**
+   * #287: install flow for the `auth-integrations` starter.
+   *
+   * Source is `examples/auth-integrations/`, NOT `runtime/subsystems/`,
+   * so this method short-circuits the `copyRuntime` flow. It vendors the
+   * adapters tree + the canonical `integration.yaml`, then invokes the
+   * `subsystem auth-integrations` Hygen action to append the
+   * `IntegrationsAuthModule` TODO to `app.module.ts`.
+   *
+   * Idempotent: pre-existing files are skipped unless `--force` is set.
+   */
+  async executeAuthIntegrations(ctx) {
+    const installed = await detectInstalledSubsystems(ctx);
+    const already = installed.find((i) => i.name === "auth-integrations");
+    if (already && !this.force) {
+      if (isJsonMode()) {
+        printJson({
+          command: "subsystem install",
+          subsystem: "auth-integrations",
+          status: "already-installed",
+          path: already.path,
+          backend: already.backend
+        });
+      } else {
+        printInfo(
+          `auth-integrations is already installed at ${already.path} (pass --force to reinstall)`
+        );
+      }
+      return 0;
+    }
+    const scaffold = runAuthIntegrationsScaffold(ctx.cwd, ctx.config, {
+      dryRun: this.dryRun,
+      json: isJsonMode(),
+      force: this.force
+    });
+    if (!scaffold.ok) {
+      printError(
+        `auth-integrations install failed: ${scaffold.error ?? "unknown error"}`
+      );
+      return 1;
+    }
+    if (isJsonMode()) {
+      printJson({
+        command: "subsystem install",
+        subsystem: "auth-integrations",
+        dryRun: this.dryRun,
+        planned: scaffold.planned,
+        written: scaffold.written ?? [],
+        skipped: scaffold.skipped ?? [],
+        authModuleRegistered: scaffold.authModuleRegistered ?? false
+      });
+      return 0;
+    }
+    if (this.dryRun) {
+      printInfo(
+        `Dry run \u2014 auth-integrations would vendor adapters + integration.yaml + append TODO`
+      );
+      for (const p of scaffold.planned) {
+        console.log(
+          `  ${theme.muted(icons.arrow)} ${path21.relative(ctx.cwd, p) || p}`
+        );
+      }
+      return 0;
+    }
+    const writtenCount = scaffold.written?.length ?? 0;
+    const skippedCount = scaffold.skipped?.length ?? 0;
+    printSuccess(
+      `auth-integrations starter vendored (${writtenCount} files written, ${skippedCount} skipped).`
+    );
+    if (scaffold.authModuleRegistered === false) {
+      printWarning(
+        "AuthModule.forRoot(...) not detected in app.module.ts. Run `cdp subsystem install auth` first \u2014 IntegrationsAuthModule requires ENCRYPTION_KEY from it."
+      );
+    }
+    printInfo("auth-integrations starter vendored.");
+    printInfo("Next steps:");
+    printInfo("  1. Run `cdp entity new integration` to scaffold the codegen layer (apps/api/src/modules/integrations/integration.service) the adapters import.");
+    printInfo("  2. Ensure AuthModule.forRoot(...) is registered in AppModule (run `cdp subsystem install auth` if not).");
+    printInfo("  3. Wire IntegrationsAuthModule into AppModule (see TODO appended to app.module.ts).");
+    return 0;
+  }
 };
 function planConfigBlockAction(configPath, subsystem, forceConfig) {
   if (!fs10.existsSync(configPath)) {
@@ -9171,6 +9426,183 @@ function runObservabilityScaffold(cwd, config, opts) {
   }
   return { ok: true, planned, configBlockOutcome };
 }
+function runAuthScaffold(cwd, config, opts) {
+  const locals = resolveAuthScaffoldLocals({
+    cwd,
+    config
+  });
+  const planned = [
+    locals.schemaPath,
+    locals.configPath,
+    locals.appModulePath,
+    locals.envConfigPath
+  ];
+  const configBlockOutcome = planConfigBlockAction(
+    locals.configPath,
+    "auth",
+    opts.forceConfig
+  );
+  if (configBlockOutcome === "parse-error") {
+    return { ok: false, planned, configBlockOutcome };
+  }
+  if (opts.dryRun) {
+    return { ok: true, planned, configBlockOutcome };
+  }
+  if (!fs10.existsSync(locals.envConfigPath)) {
+    fs10.mkdirSync(path21.dirname(locals.envConfigPath), { recursive: true });
+    fs10.writeFileSync(locals.envConfigPath, "", "utf-8");
+  }
+  const result = invokeHygen({
+    generator: "subsystem",
+    action: "auth",
+    cwd,
+    args: localsToHygenArgs6(locals),
+    inherit: !opts.json
+  });
+  if (!result.ok) {
+    return {
+      ok: false,
+      planned,
+      error: result.stderr?.trim() || "hygen exited non-zero",
+      configBlockOutcome
+    };
+  }
+  const configResult = runConfigBlockAction({
+    cwd,
+    actionFolder: "auth-config",
+    configPath: locals.configPath,
+    subsystem: "auth",
+    outcome: configBlockOutcome,
+    json: opts.json
+  });
+  if (!configResult.ok) {
+    return {
+      ok: false,
+      planned,
+      error: configResult.error,
+      configBlockOutcome
+    };
+  }
+  return { ok: true, planned, configBlockOutcome };
+}
+function authIntegrationsExamplesRoot() {
+  const pkgRoot = path21.resolve(import.meta.dirname, "..", "..", "..");
+  const topLevel = path21.join(pkgRoot, "examples", "auth-integrations");
+  if (fs10.existsSync(topLevel)) return topLevel;
+  return path21.join(pkgRoot, "dist", "examples", "auth-integrations");
+}
+function copyTreeIdempotent(srcDir, destDir, force) {
+  const written = [];
+  const skipped = [];
+  const walk = (src, dest) => {
+    const entries = fs10.readdirSync(src, { withFileTypes: true });
+    for (const entry of entries) {
+      const srcPath = path21.join(src, entry.name);
+      const destPath = path21.join(dest, entry.name);
+      if (entry.isDirectory()) {
+        fs10.mkdirSync(destPath, { recursive: true });
+        walk(srcPath, destPath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (fs10.existsSync(destPath) && !force) {
+        skipped.push(destPath);
+        continue;
+      }
+      fs10.mkdirSync(path21.dirname(destPath), { recursive: true });
+      fs10.copyFileSync(srcPath, destPath);
+      written.push(destPath);
+    }
+  };
+  if (!fs10.existsSync(srcDir)) return { written, skipped };
+  fs10.mkdirSync(destDir, { recursive: true });
+  walk(srcDir, destDir);
+  return { written, skipped };
+}
+function runAuthIntegrationsScaffold(cwd, config, opts) {
+  const locals = resolveAuthIntegrationsScaffoldLocals({
+    cwd,
+    config,
+    fileExists: (p) => fs10.existsSync(p),
+    readFile: (p) => fs10.existsSync(p) ? fs10.readFileSync(p, "utf-8") : null
+  });
+  const examplesRoot = authIntegrationsExamplesRoot();
+  if (!fs10.existsSync(examplesRoot)) {
+    return {
+      ok: false,
+      planned: [],
+      error: `auth-integrations starter source missing: ${examplesRoot}`
+    };
+  }
+  const adaptersSrc = path21.join(examplesRoot, "runtime", "integrations");
+  const adaptersDest = path21.join(locals.sharedRoot, "integrations");
+  const integrationYamlSrc = path21.join(
+    examplesRoot,
+    "definitions",
+    "entities",
+    "integration.yaml"
+  );
+  const integrationYamlDest = locals.definitionsPath;
+  const planned = [
+    adaptersDest,
+    integrationYamlDest,
+    locals.appModulePath
+  ];
+  if (opts.dryRun) {
+    return {
+      ok: true,
+      planned,
+      authModuleRegistered: locals.authModuleRegistered
+    };
+  }
+  const adapterCopy = copyTreeIdempotent(
+    adaptersSrc,
+    adaptersDest,
+    opts.force
+  );
+  let yamlWritten = false;
+  let yamlSkipped = false;
+  try {
+    if (fs10.existsSync(integrationYamlDest) && !opts.force) {
+      yamlSkipped = true;
+    } else if (fs10.existsSync(integrationYamlSrc)) {
+      fs10.mkdirSync(path21.dirname(integrationYamlDest), { recursive: true });
+      fs10.copyFileSync(integrationYamlSrc, integrationYamlDest);
+      yamlWritten = true;
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      planned,
+      error: `failed to vendor integration.yaml: ${err instanceof Error ? err.message : String(err)}`,
+      authModuleRegistered: locals.authModuleRegistered
+    };
+  }
+  const result = invokeHygen({
+    generator: "subsystem",
+    action: "auth-integrations",
+    cwd,
+    args: localsToHygenArgs7(locals),
+    inherit: !opts.json
+  });
+  if (!result.ok) {
+    return {
+      ok: false,
+      planned,
+      error: result.stderr?.trim() || "hygen exited non-zero",
+      written: adapterCopy.written.concat(yamlWritten ? [integrationYamlDest] : []),
+      skipped: adapterCopy.skipped.concat(yamlSkipped ? [integrationYamlDest] : []),
+      authModuleRegistered: locals.authModuleRegistered
+    };
+  }
+  return {
+    ok: true,
+    planned,
+    written: adapterCopy.written.concat(yamlWritten ? [integrationYamlDest] : []),
+    skipped: adapterCopy.skipped.concat(yamlSkipped ? [integrationYamlDest] : []),
+    authModuleRegistered: locals.authModuleRegistered
+  };
+}
 function capitalize(s) {
   return s.length === 0 ? s : s[0].toUpperCase() + s.slice(1);
 }
@@ -9200,7 +9632,7 @@ var SubsystemListCommand = class extends Command3 {
         name: s.name,
         status: inst ? "installed" : "available",
         backend: inst ? inst.backend : null,
-        path: inst ? path19.relative(ctx.cwd, inst.path) || inst.path : null
+        path: inst ? path21.relative(ctx.cwd, inst.path) || inst.path : null
       };
     });
     if (isJsonMode()) {
@@ -9261,27 +9693,27 @@ var subsystem_default = subsystemNoun;
 
 // src/cli/commands/project.ts
 import fs13 from "fs";
-import path22 from "path";
+import path24 from "path";
 import readline from "readline";
 import { Command as Command5, Option as Option5 } from "clipanion";
 import { stringify as stringifyYaml2 } from "yaml";
 
 // src/cli/shared/init-scaffold.ts
 import fs11 from "fs";
-import path20 from "path";
+import path22 from "path";
 import { stringify as stringifyYaml } from "yaml";
 function runtimeRoot2() {
-  const pkgRoot = path20.resolve(import.meta.dirname, "..", "..", "..");
-  const topLevel = path20.join(pkgRoot, "runtime");
+  const pkgRoot = path22.resolve(import.meta.dirname, "..", "..", "..");
+  const topLevel = path22.join(pkgRoot, "runtime");
   if (fs11.existsSync(topLevel)) return topLevel;
-  return path20.join(pkgRoot, "dist", "runtime");
+  return path22.join(pkgRoot, "dist", "runtime");
 }
 function resolveRuntimePath(cwd) {
-  const shimDir = path20.join(cwd, "src", "shared", "base-classes");
-  return path20.relative(shimDir, runtimeRoot2());
+  const shimDir = path22.join(cwd, "src", "shared", "base-classes");
+  return path22.relative(shimDir, runtimeRoot2());
 }
 function loadRuntimeFile(relPath2) {
-  return fs11.readFileSync(path20.join(runtimeRoot2(), relPath2), "utf-8");
+  return fs11.readFileSync(path22.join(runtimeRoot2(), relPath2), "utf-8");
 }
 var VENDORED_RUNTIME_FILES = [
   // base-classes — consumer-facing inheritance targets
@@ -9678,7 +10110,7 @@ function mergeTsconfig(raw) {
   };
 }
 function relOf(cwd, abs) {
-  return path20.relative(cwd, abs) || abs;
+  return path22.relative(cwd, abs) || abs;
 }
 function fileEntry(cwd, absPath, content, opts) {
   const exists = fs11.existsSync(absPath);
@@ -9728,7 +10160,7 @@ async function buildInitPlan(ctx, options) {
   const runtimePath = options.runtimePath ?? resolveRuntimePath(cwd);
   const entries = [];
   {
-    const configPath = path20.join(cwd, "codegen.config.yaml");
+    const configPath = path22.join(cwd, "codegen.config.yaml");
     const config = {
       paths: {
         backend_src: "src",
@@ -9758,7 +10190,7 @@ async function buildInitPlan(ctx, options) {
     entries.push(fileEntry(cwd, configPath, content, { force }));
   }
   {
-    const tsconfigPath = path20.join(cwd, "tsconfig.json");
+    const tsconfigPath = path22.join(cwd, "tsconfig.json");
     if (fs11.existsSync(tsconfigPath)) {
       const raw = fs11.readFileSync(tsconfigPath, "utf-8");
       const merged = mergeTsconfig(raw);
@@ -9805,20 +10237,20 @@ async function buildInitPlan(ctx, options) {
   entries.push(
     fileEntry(
       cwd,
-      path20.join(cwd, "src", "shared", "database", "database.module.ts"),
+      path22.join(cwd, "src", "shared", "database", "database.module.ts"),
       databaseModuleContent(),
       { force }
     )
   );
   for (const v of VENDORED_RUNTIME_FILES) {
     entries.push(
-      fileEntry(cwd, path20.join(cwd, v.target), loadRuntimeFile(v.runtime), { force })
+      fileEntry(cwd, path22.join(cwd, v.target), loadRuntimeFile(v.runtime), { force })
     );
   }
   entries.push(
     fileEntry(
       cwd,
-      path20.join(cwd, "src", "generated", "modules.ts"),
+      path22.join(cwd, "src", "generated", "modules.ts"),
       emptyModulesBarrel(),
       { force }
     )
@@ -9826,13 +10258,13 @@ async function buildInitPlan(ctx, options) {
   entries.push(
     fileEntry(
       cwd,
-      path20.join(cwd, "src", "generated", "schema.ts"),
+      path22.join(cwd, "src", "generated", "schema.ts"),
       emptySchemaBarrel(),
       { force }
     )
   );
   {
-    const appModulePath = path20.join(cwd, "src", "app.module.ts");
+    const appModulePath = path22.join(cwd, "src", "app.module.ts");
     if (!fs11.existsSync(appModulePath)) {
       entries.push({
         path: appModulePath,
@@ -9850,7 +10282,7 @@ async function buildInitPlan(ctx, options) {
     }
   }
   {
-    const mainPath = path20.join(cwd, "src", "main.ts");
+    const mainPath = path22.join(cwd, "src", "main.ts");
     if (!fs11.existsSync(mainPath)) {
       entries.push({
         path: mainPath,
@@ -9868,7 +10300,7 @@ async function buildInitPlan(ctx, options) {
     }
   }
   {
-    const schemaPath = path20.join(cwd, "src", "schema.ts");
+    const schemaPath = path22.join(cwd, "src", "schema.ts");
     if (!fs11.existsSync(schemaPath)) {
       entries.push({
         path: schemaPath,
@@ -9885,10 +10317,10 @@ async function buildInitPlan(ctx, options) {
       });
     }
   }
-  entries.push(dirEntry(cwd, path20.join(cwd, "entities")));
+  entries.push(dirEntry(cwd, path22.join(cwd, "entities")));
   {
-    const entitiesDir = path20.join(cwd, "entities");
-    const examplePath = path20.join(entitiesDir, "example.yaml");
+    const entitiesDir = path22.join(cwd, "entities");
+    const examplePath = path22.join(entitiesDir, "example.yaml");
     const hasOtherYamls = fs11.existsSync(entitiesDir) && fs11.readdirSync(entitiesDir).some(
       (f) => (f.endsWith(".yaml") || f.endsWith(".yml")) && f !== "example.yaml"
     );
@@ -9946,7 +10378,7 @@ function writePlan(plan) {
       skipped.push(e);
       continue;
     }
-    fs11.mkdirSync(path20.dirname(e.path), { recursive: true });
+    fs11.mkdirSync(path22.dirname(e.path), { recursive: true });
     fs11.writeFileSync(e.path, e.content, "utf-8");
     if (e.action === "create") created.push(e);
     else if (e.action === "merge") merged.push(e);
@@ -9957,7 +10389,7 @@ function writePlan(plan) {
 
 // src/cli/commands/project-upgrade-openapi.ts
 import fs12 from "fs";
-import path21 from "path";
+import path23 from "path";
 import { Command as Command4, Option as Option4 } from "clipanion";
 import { Project, IndentationText, QuoteKind, NewLineKind } from "ts-morph";
 
@@ -10196,31 +10628,31 @@ var MAIN_SWAGGER_IMPORTS = [
   "import { OPENAPI_REGISTRY, OpenApiRegistry } from './shared/openapi';"
 ];
 function runtimeRoot3() {
-  const pkgRoot = path21.resolve(import.meta.dirname, "..", "..", "..");
-  const topLevel = path21.join(pkgRoot, "runtime");
+  const pkgRoot = path23.resolve(import.meta.dirname, "..", "..", "..");
+  const topLevel = path23.join(pkgRoot, "runtime");
   if (fs12.existsSync(topLevel)) return topLevel;
-  return path21.join(pkgRoot, "dist", "runtime");
+  return path23.join(pkgRoot, "dist", "runtime");
 }
 function loadRuntimeFile2(rel) {
-  return fs12.readFileSync(path21.join(runtimeRoot3(), rel), "utf-8");
+  return fs12.readFileSync(path23.join(runtimeRoot3(), rel), "utf-8");
 }
 function resolveProjectRoot(startDir) {
-  let dir = path21.resolve(startDir);
+  let dir = path23.resolve(startDir);
   for (let i = 0; i < 16; i++) {
-    if (fs12.existsSync(path21.join(dir, "codegen.config.yaml")) || fs12.existsSync(path21.join(dir, "package.json"))) {
+    if (fs12.existsSync(path23.join(dir, "codegen.config.yaml")) || fs12.existsSync(path23.join(dir, "package.json"))) {
       return dir;
     }
-    const parent = path21.dirname(dir);
+    const parent = path23.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path21.resolve(startDir);
+  return path23.resolve(startDir);
 }
 async function runUpgradeOpenapi(opts) {
   const { projectRoot, dryRun, force } = opts;
   const changes = [];
   for (const v of OPENAPI_VENDORED_FILES) {
-    const target = path21.join(projectRoot, v.target);
+    const target = path23.join(projectRoot, v.target);
     const exists = fs12.existsSync(target);
     const newContent = loadRuntimeFile2(v.runtime);
     if (exists && !force) {
@@ -10236,7 +10668,7 @@ async function runUpgradeOpenapi(opts) {
       }
     } else {
       if (!dryRun) {
-        fs12.mkdirSync(path21.dirname(target), { recursive: true });
+        fs12.mkdirSync(path23.dirname(target), { recursive: true });
         fs12.writeFileSync(target, newContent);
       }
       changes.push({
@@ -10245,7 +10677,7 @@ async function runUpgradeOpenapi(opts) {
       });
     }
   }
-  const appModulePath = path21.join(projectRoot, "src", "app.module.ts");
+  const appModulePath = path23.join(projectRoot, "src", "app.module.ts");
   if (!fs12.existsSync(appModulePath)) {
     return {
       projectRoot,
@@ -10329,7 +10761,7 @@ async function runUpgradeOpenapi(opts) {
   } else {
     changes.push({ path: "src/app.module.ts", action: "unchanged" });
   }
-  const mainPath = path21.join(projectRoot, "src", "main.ts");
+  const mainPath = path23.join(projectRoot, "src", "main.ts");
   if (fs12.existsSync(mainPath)) {
     const mainSource = project.addSourceFileAtPath(mainPath);
     const mainBefore = mainSource.getFullText();
@@ -10410,7 +10842,7 @@ var ProjectUpgradeOpenapiCommand = class extends Command4 {
   json = Option4.Boolean("--json", false);
   async execute() {
     if (this.json) setJsonMode(true);
-    const startDir = this.pathOpt ? path21.resolve(this.pathOpt) : process.cwd();
+    const startDir = this.pathOpt ? path23.resolve(this.pathOpt) : process.cwd();
     if (!fs12.existsSync(startDir)) {
       printError(`Directory not found: ${startDir}`);
       return 1;
@@ -10695,8 +11127,8 @@ var ProjectScanCommand = class extends Command5 {
   cwd = Option5.String("--cwd", { required: false });
   async execute() {
     if (this.json) setJsonMode(true);
-    const baseCwd = this.cwd ? path22.resolve(this.cwd) : process.cwd();
-    const target = this.directory ? path22.resolve(baseCwd, this.directory) : baseCwd;
+    const baseCwd = this.cwd ? path24.resolve(this.cwd) : process.cwd();
+    const target = this.directory ? path24.resolve(baseCwd, this.directory) : baseCwd;
     if (!fs13.existsSync(target)) {
       printError(`Directory not found: ${target}`);
       return 1;
@@ -10747,7 +11179,7 @@ var ProjectScanCommand = class extends Command5 {
         `architecture: ${profile.architecture.evidence.join(", ") || "\u2014"}`
       ]);
     }
-    const outPath = path22.join(target, "codegen.config.yaml");
+    const outPath = path24.join(target, "codegen.config.yaml");
     const existsNow = fs13.existsSync(outPath);
     if (this.dryRun) {
       console.log("");
@@ -10868,8 +11300,8 @@ var ProjectInspectCommand = class extends Command5 {
     return 2;
   }
   resolveEntitiesDir(ctx) {
-    if (this.dir) return path22.resolve(ctx.cwd, this.dir);
-    return ctx.entitiesDir ?? path22.resolve(ctx.cwd, "entities");
+    if (this.dir) return path24.resolve(ctx.cwd, this.dir);
+    return ctx.entitiesDir ?? path24.resolve(ctx.cwd, "entities");
   }
   async runAnalysis(ctx, kind) {
     const entitiesDir = this.resolveEntitiesDir(ctx);
@@ -11072,15 +11504,15 @@ var ProjectGraphCommand = class extends Command5 {
       json: this.json,
       skipDetection: true
     });
-    const entitiesDir = this.dir ? path22.resolve(ctx.cwd, this.dir) : ctx.entitiesDir ?? path22.resolve(ctx.cwd, "entities");
+    const entitiesDir = this.dir ? path24.resolve(ctx.cwd, this.dir) : ctx.entitiesDir ?? path24.resolve(ctx.cwd, "entities");
     if (!fs13.existsSync(entitiesDir)) {
       printError(`Entity directory not found: ${entitiesDir}`);
       return 1;
     }
     const relCandidates = [
-      path22.resolve(path22.dirname(entitiesDir), "relationships"),
-      path22.resolve(entitiesDir, "relationships"),
-      path22.resolve(ctx.cwd, "relationships")
+      path24.resolve(path24.dirname(entitiesDir), "relationships"),
+      path24.resolve(entitiesDir, "relationships"),
+      path24.resolve(ctx.cwd, "relationships")
     ];
     const relationshipsDir = relCandidates.find((d) => fs13.existsSync(d));
     const result = await analyzeDomain(entitiesDir, relationshipsDir);
@@ -11096,20 +11528,20 @@ var ProjectGraphCommand = class extends Command5 {
       return 0;
     }
     if (this.output) {
-      const outPath = path22.resolve(ctx.cwd, this.output);
+      const outPath = path24.resolve(ctx.cwd, this.output);
       fs13.writeFileSync(outPath, JSON.stringify(serialized, null, 2));
       printSuccess(`Graph written to ${outPath}`);
       printInfo(`${result.entities.length} entities, ${result.relationshipDefinitions.length} relationships, ${result.graph.edges.length} edges`);
       return 0;
     }
     const os = await import("os");
-    const tmpDir = fs13.mkdtempSync(path22.join(os.default.tmpdir(), "codegen-graph-"));
-    const graphPath = path22.join(tmpDir, "graph.json");
+    const tmpDir = fs13.mkdtempSync(path24.join(os.default.tmpdir(), "codegen-graph-"));
+    const graphPath = path24.join(tmpDir, "graph.json");
     fs13.writeFileSync(graphPath, JSON.stringify(serialized, null, 2));
-    const viewerDir = path22.resolve(import.meta.dirname, "..", "..", "..", "tools", "schema-graph-viewer");
-    const viewerDist = path22.join(viewerDir, "dist", "index.html");
+    const viewerDir = path24.resolve(import.meta.dirname, "..", "..", "..", "tools", "schema-graph-viewer");
+    const viewerDist = path24.join(viewerDir, "dist", "index.html");
     if (fs13.existsSync(viewerDist)) {
-      fs13.copyFileSync(graphPath, path22.join(viewerDir, "dist", "graph.json"));
+      fs13.copyFileSync(graphPath, path24.join(viewerDir, "dist", "graph.json"));
       printSuccess("Graph exported");
       printInfo(`${result.entities.length} entities, ${result.relationshipDefinitions.length} relationships, ${result.graph.edges.length} edges`);
       printInfo(`Graph JSON: ${graphPath}`);
@@ -11140,7 +11572,7 @@ var project_default = projectNoun;
 
 // src/cli/commands/dev.ts
 import fs14 from "fs";
-import path23 from "path";
+import path25 from "path";
 import { execSync as execSync3, spawn, spawnSync } from "child_process";
 import { Command as Command6, Option as Option6 } from "clipanion";
 var DEFAULT_APP_PORT = 3e3;
@@ -11173,14 +11605,14 @@ function getRedisPort(_ctx) {
   return Number(process.env.DEV_REDIS_PORT ?? DEFAULT_REDIS_PORT);
 }
 function composeFilePath(cwd) {
-  const devPath = path23.join(cwd, COMPOSE_FILE);
+  const devPath = path25.join(cwd, COMPOSE_FILE);
   if (fs14.existsSync(devPath)) return devPath;
-  const rootPath = path23.join(cwd, "docker-compose.yml");
+  const rootPath = path25.join(cwd, "docker-compose.yml");
   if (fs14.existsSync(rootPath)) return rootPath;
   return devPath;
 }
 function pidFilePath(cwd) {
-  return path23.join(cwd, PID_FILE);
+  return path25.join(cwd, PID_FILE);
 }
 function readAppPid(cwd) {
   const p = pidFilePath(cwd);
@@ -11249,7 +11681,7 @@ function formatServiceLine(svc) {
   return `${icon} ${svc.name.padEnd(12)}  ${theme.muted(`${svc.host}:${svc.port}`)}    ${status}${pidStr}`;
 }
 function ensureComposeFile(cwd, pgPort, redisPort) {
-  const composePath = path23.join(cwd, COMPOSE_FILE);
+  const composePath = path25.join(cwd, COMPOSE_FILE);
   if (fs14.existsSync(composePath)) return composePath;
   const content = `# Auto-generated by codegen dev
 # Ports offset from defaults to avoid conflicts with other local services.
@@ -11334,7 +11766,7 @@ var DevUpCommand = class extends Command6 {
     if (!pgReady) printWarning("postgres did not become healthy in time");
     if (!redisReady) printWarning("redis did not become healthy in time");
     const drizzleConfig = ["drizzle.config.ts", "drizzle.config.js"].find(
-      (f) => fs14.existsSync(path23.join(ctx.cwd, f))
+      (f) => fs14.existsSync(path25.join(ctx.cwd, f))
     );
     if (drizzleConfig) {
       if (!isJsonMode()) printInfo("pushing database schema...");
@@ -11354,7 +11786,7 @@ var DevUpCommand = class extends Command6 {
         if (!isJsonMode()) printInfo("starting NestJS app...");
         const dbUrl = `postgres://postgres:postgres@localhost:${pgPort}/codegen_dev`;
         const redisUrl = `redis://localhost:${redisPort}`;
-        const logFile = path23.join(ctx.cwd, ".dev-app.log");
+        const logFile = path25.join(ctx.cwd, ".dev-app.log");
         const logFd = fs14.openSync(logFile, "a");
         const child = spawn("bun", ["src/main.ts"], {
           cwd: ctx.cwd,
@@ -11512,7 +11944,7 @@ var DevLogsCommand = class extends Command6 {
       }
       return 0;
     }
-    const logFile = path23.join(ctx.cwd, ".dev-app.log");
+    const logFile = path25.join(ctx.cwd, ".dev-app.log");
     if (!fs14.existsSync(logFile)) {
       printInfo("no app logs found \u2014 is the app running?");
       return 0;
@@ -11556,7 +11988,7 @@ var DevRestartCommand = class extends Command6 {
     spawnSync("sleep", ["1"]);
     const dbUrl = `postgres://postgres:postgres@localhost:${pgPort}/codegen_dev`;
     const redisUrl = `redis://localhost:${redisPort}`;
-    const logFile = path23.join(ctx.cwd, ".dev-app.log");
+    const logFile = path25.join(ctx.cwd, ".dev-app.log");
     const logFd = fs14.openSync(logFile, "a");
     const child = spawn("bun", ["src/main.ts"], {
       cwd: ctx.cwd,
@@ -11686,14 +12118,14 @@ var dev_default = devNoun;
 
 // src/cli/commands/relationship.ts
 import fs15 from "fs";
-import path24 from "path";
+import path26 from "path";
 import { Command as Command7, Option as Option7 } from "clipanion";
 function listRelationshipYamls2(dir) {
   if (!fs15.existsSync(dir)) return [];
   return fs15.readdirSync(dir).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml")).filter((f) => {
-    const fullPath = path24.join(dir, f);
+    const fullPath = path26.join(dir, f);
     return detectYamlType(fullPath) === "relationship";
-  }).map((f) => path24.join(dir, f));
+  }).map((f) => path26.join(dir, f));
 }
 function summarizeRelationshipFile(filePath) {
   const result = loadRelationshipFromYaml(filePath);
@@ -11714,7 +12146,7 @@ function padRight2(s, n) {
   return s.length >= n ? s : s + " ".repeat(n - s.length);
 }
 async function summary5(ctx) {
-  const relDir = path24.resolve(ctx.cwd, "relationships");
+  const relDir = path26.resolve(ctx.cwd, "relationships");
   const files = listRelationshipYamls2(relDir);
   if (files.length === 0) {
     return {
@@ -11784,14 +12216,14 @@ var RelationshipNewCommand = class extends Command7 {
     }
     let targets = [];
     if (this.all) {
-      const dir = path24.resolve(ctx.cwd, "relationships");
+      const dir = path26.resolve(ctx.cwd, "relationships");
       targets = listRelationshipYamls2(dir);
       if (targets.length === 0) {
         printError(`No relationship YAML files found in ${dir}`);
         return 1;
       }
     } else if (this.yaml) {
-      targets = [path24.resolve(ctx.cwd, this.yaml)];
+      targets = [path26.resolve(ctx.cwd, this.yaml)];
     } else {
       printError("Missing YAML path. Pass a file or --all.");
       return 2;
@@ -11808,7 +12240,7 @@ var RelationshipNewCommand = class extends Command7 {
     }
     if (invalid.length > 0) {
       for (const i of invalid) {
-        printError(`${path24.basename(i.file)} \u2014 ${i.message}`);
+        printError(`${path26.basename(i.file)} \u2014 ${i.message}`);
       }
       if (!isJsonMode()) return 1;
     }
@@ -11839,7 +12271,7 @@ var RelationshipNewCommand = class extends Command7 {
     }
     const succeeded = [];
     const failed = [
-      ...invalid.map((i) => ({ name: path24.basename(i.file), file: i.file, message: i.message }))
+      ...invalid.map((i) => ({ name: path26.basename(i.file), file: i.file, message: i.message }))
     ];
     for (const v of validated) {
       if (!isJsonMode()) {
@@ -11858,8 +12290,8 @@ var RelationshipNewCommand = class extends Command7 {
         if (!isJsonMode()) printError(`${v.name} \u2014 ${res.stderr ?? "failed"}`);
       }
     }
-    const entitiesDir = ctx.entitiesDir ?? path24.resolve(ctx.cwd, "entities");
-    const relationshipsDir = path24.resolve(ctx.cwd, "relationships");
+    const entitiesDir = ctx.entitiesDir ?? path26.resolve(ctx.cwd, "entities");
+    const relationshipsDir = path26.resolve(ctx.cwd, "relationships");
     const generatedDir = resolveGeneratedDir(ctx);
     const architecture = resolveArchitecture(ctx);
     let barrelResult = null;
@@ -11904,7 +12336,7 @@ var RelationshipNewCommand = class extends Command7 {
       }
       if (barrelResult) {
         printInfo(
-          `barrels regenerated (${barrelResult.entityCount} modules) \u2192 ${path24.relative(ctx.cwd, barrelResult.modulesBarrel)}, ${path24.relative(ctx.cwd, barrelResult.schemaBarrel)}`
+          `barrels regenerated (${barrelResult.entityCount} modules) \u2192 ${path26.relative(ctx.cwd, barrelResult.modulesBarrel)}, ${path26.relative(ctx.cwd, barrelResult.schemaBarrel)}`
         );
       }
     }
@@ -11927,7 +12359,7 @@ var RelationshipListCommand = class extends Command7 {
       json: this.json,
       skipDetection: true
     });
-    const relDir = path24.resolve(ctx.cwd, "relationships");
+    const relDir = path26.resolve(ctx.cwd, "relationships");
     const files = listRelationshipYamls2(relDir);
     if (files.length === 0) {
       printInfo("No relationship definitions found.");
@@ -11968,7 +12400,7 @@ var relationship_default = relationshipNoun;
 
 // src/cli/commands/events.ts
 import fs16 from "fs";
-import path25 from "path";
+import path27 from "path";
 import ts2 from "typescript";
 import { Command as Command8, Option as Option8 } from "clipanion";
 function scanSourceFileForConsumers(sourceFile, filePath, eventType) {
@@ -12104,7 +12536,7 @@ function suggestEventTypes(target, known, limit = 3) {
   return known.map((t) => ({ t, d: levenshtein(target, t) })).sort((a, b) => a.d - b.d).slice(0, limit).map((x) => x.t);
 }
 function renderConsumerReport(result, cwd) {
-  const rel = (p) => path25.relative(cwd, p) || p;
+  const rel = (p) => path27.relative(cwd, p) || p;
   const lines = [];
   const total = result.tier3.length + result.tier2.length + result.tier1.length;
   lines.push(`Event: ${result.eventType}`);
@@ -12140,7 +12572,7 @@ function renderConsumerReport(result, cwd) {
   return lines;
 }
 function runConsumersScan(opts) {
-  const scanRoot = opts.scanRoot ?? path25.join(opts.cwd, "src");
+  const scanRoot = opts.scanRoot ?? path27.join(opts.cwd, "src");
   const handlersDir = opts.handlersDir ?? scanRoot;
   const allTriggers = scanHandlerFiles(handlersDir);
   const tier3 = allTriggers.filter((t) => t.event === opts.eventType).map((t) => ({
@@ -12150,7 +12582,7 @@ function runConsumersScan(opts) {
     sourceLine: t.sourceLine
   }));
   const tier21 = fs16.existsSync(scanRoot) ? scanDirectoryForConsumers(scanRoot, opts.eventType) : { tier2: [], tier1: [], hasEventFlowImport: false };
-  const eventsGeneratedDir = opts.eventsGeneratedDir ?? path25.join(
+  const eventsGeneratedDir = opts.eventsGeneratedDir ?? path27.join(
     resolveSubsystemsRootFromContext(opts.cwd, opts.config),
     "events",
     "generated"
@@ -12171,11 +12603,11 @@ function runConsumersScan(opts) {
 function resolveSubsystemsRootFromContext(cwd, config) {
   const configured = config?.paths?.subsystems;
   if (typeof configured === "string" && configured.length > 0) {
-    return path25.resolve(cwd, configured);
+    return path27.resolve(cwd, configured);
   }
   const backendSrc = config?.paths?.backend_src;
   const base = typeof backendSrc === "string" && backendSrc.length > 0 ? backendSrc : "src";
-  return path25.resolve(cwd, base, "shared", "subsystems");
+  return path27.resolve(cwd, base, "shared", "subsystems");
 }
 var EventsConsumersCommand = class extends Command8 {
   static paths = [["events", "consumers"]];
@@ -12264,7 +12696,7 @@ var eventsNoun = {
 var events_default = eventsNoun;
 
 // src/cli/commands/orchestration.ts
-import path26 from "path";
+import path28 from "path";
 import { Command as Command9, Option as Option9 } from "clipanion";
 var DEFAULT_PATTERN_GLOBS = ["src/patterns/*.pattern.ts"];
 function resolvePatternGlobs(ctx) {
@@ -12278,10 +12710,10 @@ function resolveOrchestrationOutputRoot(ctx) {
   const paths = ctx.config?.paths;
   const explicit = paths?.orchestration_src;
   if (typeof explicit === "string" && explicit.length > 0) {
-    return path26.resolve(ctx.cwd, explicit);
+    return path28.resolve(ctx.cwd, explicit);
   }
   const backendSrc = typeof paths?.backend_src === "string" && paths.backend_src.length > 0 ? paths.backend_src : "app/backend/src";
-  return path26.resolve(ctx.cwd, backendSrc, "orchestration");
+  return path28.resolve(ctx.cwd, backendSrc, "orchestration");
 }
 async function reloadRegistry(ctx) {
   _resetRegistryForTests({ includeLibrary: false });
@@ -12370,12 +12802,12 @@ var OrchestrationGenCommand = class extends Command9 {
         );
         for (const f of result.files) {
           console.log(
-            `  ${theme.muted(icons.arrow)} ${path26.relative(ctx.cwd, f.outputPath)}`
+            `  ${theme.muted(icons.arrow)} ${path28.relative(ctx.cwd, f.outputPath)}`
           );
         }
       } else {
         printSuccess(
-          `Emitted ${result.files.length} file(s) across ${targets.length} pattern(s) \u2192 ${path26.relative(ctx.cwd, outputRoot)}`
+          `Emitted ${result.files.length} file(s) across ${targets.length} pattern(s) \u2192 ${path28.relative(ctx.cwd, outputRoot)}`
         );
       }
       return 0;