@stjoseph/prumo 0.0.5 → 0.1.0

package/.prumo-templates/mcp/server.md

@@ -0,0 +1,54 @@
+# MCP server
+
+## Rule
+
+Serve MCP at `POST /api/mcp`, in `src/infra/http/controllers/mcp.controller.ts`. Protect it with
+`requireMcpAuth` from `@better-auth/mcp`, with the same `resource` as `mcp()` in `auth.factory.ts`:
+`mcpResource(env)`. The route is `public: true` for the session hook, because it answers a bearer access
+token, never a cookie.
+
+Build the server per request in `src/infra/mcp/mcp.server.ts` with `createMcpHandler` from
+`@modelcontextprotocol/server`, `legacy: 'reject'`. The user is the token's `sub`, passed through
+`authInfo.extra.userId`.
+
+Write a module's tools in `src/infra/mcp/tools/<module>.tool.ts`. A tool resolves a use case and calls
+`execute()`, exactly as a route handler does. Take its input schema from the module's `dto/`, and pass its
+result through the module's output schema with `.parse()` before returning it.
+
+Keep Better Auth the authorization server: `jwt()`, `mcp()` and `cimd()` in `auth.factory.ts`, discovery at
+`/.well-known/*`, sign-in and consent on the web app. Do not enable dynamic client registration.
+
+## Rationale
+
+MCP is a second edge of the product, beside HTTP, so it reaches the domain the same way: through use cases,
+with the user's identity as an argument. A tool that queried a repository would bypass the rules a route
+obeys.
+
+`.parse()` is required here and not in a route because Fastify drops a field the response schema does not
+list and MCP does not: a tool returns whatever it is handed, so an entity passed straight through publishes
+every column.
+
+`legacy: 'reject'` and CIMD follow the MCP 2026-07-28 profile, which Better Auth's plugin targets. The
+protocol is stateless, so a server per request costs nothing and knows only its caller. Dynamic client
+registration stays off because that profile deprecates it.
+
+## Applies to
+
+`src/infra/mcp/`, `mcp.controller.ts`, the MCP part of `auth.factory.ts`, and the web app's `/consent` route.
+
+## Examples
+
+```
+✅  async () => asResult(await container.resolve(FindProfileUseCase).execute(userId))
+❌  async () => ({ structuredContent: await em.findOne(Profile, { userId }) })
+
+✅  structuredContent: profileResponseSchema.parse(profile)
+❌  structuredContent: profile                       every column leaves
+```
+
+## Enforcement
+
+**Tests.** `mcp.controller.spec.ts` walks the whole authorization, consent included, connects the SDK's
+own client, and asserts a tool returns only the public fields.
+
+**Review only.** That a new tool goes through a use case and parses its output.

package/.prumo-templates/monorepo/dependencies.md

@@ -38,9 +38,9 @@ elsewhere, and an import breaks with nothing having changed. The repetition this
 every entry is the identical line `"react": "catalog:"`, not a version to keep in sync.
 
 An app depending on another app is tempting (importing a type from the API looks like the way to stop
-duplicating the contract), and it is wrong twice. **The type is the wrong one:** a response is an entity
-passed through `ClassSerializerInterceptor`, so every excluded property is absent from the JSON and present
-on the type, promising fields the payload never carries. **And an app is deployable:** the dependency means
+duplicating the contract), and it is wrong twice. **The type is the wrong one:** a response passes through
+the route's output schema, which drops every field it does not list, so a property can be present on the
+type and absent from the JSON, promising fields the payload never carries. **And an app is deployable:** the dependency means
 building one requires the other, CI needs both for either, and the boundary between two things with
 separate lifecycles stops existing.
 

package/.prumo-templates/monorepo/layout.md

@@ -82,7 +82,7 @@ with generic code, which is the code that belonged in the package.
 **A Vite app and a Next app consume the package as source with no configuration**: Next 16 needs no
 `transpilePackages`; a page importing it builds, stays static, and renders the imported value. Its `exports` points at `src/index.ts`,
 `tsc` with `moduleResolution: bundler` typechecks through it, and `vite build` bundles it, verified in a composed
-workspace. The API does not import the package, so Nest never compiles it.
+workspace. The API does not import the package, so its SWC build never compiles it.
 
 **Expo resolves workspace packages automatically from SDK 52**, with no `watchFolders` or
 `nodeModulesPaths` configuration. Older guidance about configuring Metro by hand no longer applies. Verified with

package/README.md

@@ -52,7 +52,7 @@ terminal a missing answer is an error rather than a default, so nothing importan
 silence:
 
 ```sh
-npx @stjoseph/prumo new my-app --types api,web --single-tenant
+npx @stjoseph/prumo new my-app --types api,web --single-tenant --no-mcp
 ```
 
 | Flag | What it answers |
@@ -60,6 +60,7 @@ npx @stjoseph/prumo new my-app --types api,web --single-tenant
 | `--types api,web,mobile,site` | What the project contains. More than one type makes a workspace |
 | `--alone` or `--monorepo` | How a single type is laid out |
 | `--multi-tenant` or `--single-tenant` | Whether the application serves several tenants |
+| `--mcp` or `--no-mcp` | With an api and a web: whether AI assistants reach the API through MCP, signed in as the user |
 | `--skip-install` | Stops after writing the files |
 
 ## Commands
@@ -81,7 +82,7 @@ is asked, and the exit code is 0 only when `ok` is true.
 
 | Type | What you get |
 |---|---|
-| `api` | NestJS, MikroORM on PostgreSQL, Better Auth in a schema of its own, Swagger, Vitest with Testcontainers |
+| `api` | Fastify with a domain/infra structure, tsyringe, Zod, MikroORM on PostgreSQL, Better Auth in a schema of its own, Swagger UI, Vitest with Testcontainers |
 | `web` | Vite, React, TanStack Router and Query, Tailwind, shadcn/ui, forms validated with Zod |
 | `mobile` | Expo with Expo Router, NativeWind, MMKV, and the session kept in `expo-secure-store` |
 | `site` | Next on the App Router, static by default, for pages that have to be indexed |
@@ -117,14 +118,19 @@ Once written, those documents belong to the team. Prumo does not come back and r
 |---|---|
 | [`docs/stack.md`](https://github.com/stjosephworks/prumo/blob/main/docs/stack.md) | What is locked, what was deliberately dropped, and the version floors |
 | [`docs/structure.md`](https://github.com/stjosephworks/prumo/blob/main/docs/structure.md) | The `.prumo/` layout, and the rule deciding which areas a project receives |
-| [`docs/DECISIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/DECISIONS.md) | Every decision, why it won, and what it costs |
-| [`docs/OPEN-QUESTIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/OPEN-QUESTIONS.md) | What has been raised and is still unresolved |
+| [`docs/document-template.md`](https://github.com/stjosephworks/prumo/blob/main/docs/document-template.md) | The shape every convention document fills |
+| [`docs/maintaining-templates.md`](https://github.com/stjosephworks/prumo/blob/main/docs/maintaining-templates.md) | How a template is changed, and how the change is proved |
+
+## Releasing
+
+`main` publishes itself. A push to `main` runs the whole CI, and when `cli/package.json` carries a version the
+registry does not have yet, the `publish` job sends it to npm through npm's trusted publishing, with provenance and
+without a token in the repository. Any other push to `main` publishes nothing.
 
 ## Status
 
 Prumo is in beta. `0.0.1` is the first published version: every template runs and every generated
 project is verified in CI, and what a generated project looks like can still change before 1.0.
-What is known to be missing is listed in [`docs/OPEN-QUESTIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/OPEN-QUESTIONS.md), and
-updating a project's `.prumo/` in place comes after 1.0.
+Updating a project's `.prumo/` in place comes after 1.0.
 
 MIT licensed. See [`LICENSE`](https://github.com/stjosephworks/prumo/blob/main/LICENSE).

package/dist/asker.js

@@ -24,5 +24,9 @@ export function terminalAsker(validateName) {
             initialValue: 'alone',
         })),
         multiTenant: async () => answered(await prompt.confirm({ message: 'Is it multi-tenant?', initialValue: false })),
+        mcp: async () => answered(await prompt.confirm({
+            message: 'Let AI assistants use the API through MCP, signed in as the user?',
+            initialValue: false,
+        })),
     };
 }

package/dist/clean.js

@@ -17,7 +17,7 @@ export const README_PARAGRAPH = '`DATABASE_URL` starts as `MISSING`. While it is
 const README_REPLACEMENT = 'Before the first `pnpm dev`, start Postgres with `docker compose up -d --wait` and run `pnpm db:migrate`.\n' +
     '`.env.example` points at that service on port 5432; when `POSTGRES_PORT` changes, change both URLs with it.\n';
 export const README_ROW = '| `pnpm db:setup` | Creates a development database in Docker, writes its URL into `.env`, and migrates |\n';
-export const WORKSPACE_SENTENCE = 'If the workspace holds `api` and its database is not set up yet, it offers to create one first. ';
+export const WORKSPACE_SENTENCE = 'If the workspace holds `api` and its database is not set up yet, `pnpm dev` offers to create the database first.\n\n';
 function textRule(id, file, description, from, to, marker) {
     return {
         id,
@@ -55,7 +55,7 @@ function rulesFor(root, api, templates) {
         textRule('api-readme-row', at('README.md'), 'Remove `db:setup` from the README', README_ROW, '', '`pnpm db:setup`'),
     ];
     if (api !== root) {
-        rules.push(devRule('root-dev-check', 'package.json', ROOT_DEV_PREFIX), textRule('root-readme', 'README.md', 'Remove the database offer from the README', WORKSPACE_SENTENCE, '', 'offers to create one'));
+        rules.push(devRule('root-dev-check', 'package.json', ROOT_DEV_PREFIX), textRule('root-readme', 'README.md', 'Remove the database offer from the README', WORKSPACE_SENTENCE, '', 'offers to create the database'));
     }
     return { rules, script: join(templates, 'api', 'scripts', 'database.mjs') };
 }

package/dist/cli.js

@@ -38,6 +38,8 @@ async function runNew(args, json) {
             monorepo: { type: 'boolean', default: false },
             'multi-tenant': { type: 'boolean', default: false },
             'single-tenant': { type: 'boolean', default: false },
+            mcp: { type: 'boolean', default: false },
+            'no-mcp': { type: 'boolean', default: false },
             'skip-install': { type: 'boolean', default: false },
             json: { type: 'boolean', default: false },
         },
@@ -54,6 +56,8 @@ async function runNew(args, json) {
         monorepo: values.monorepo,
         multiTenant: values['multi-tenant'],
         singleTenant: values['single-tenant'],
+        mcp: values.mcp,
+        noMcp: values['no-mcp'],
     }, interactive ? terminalAsker(validateProjectName) : undefined);
     if (!json && answers.types.length > 1) {
         prompt.log.info(`${answers.types.length} types make a workspace: apps/ and packages/ under one root.`);

package/dist/commands.js

@@ -13,6 +13,8 @@ export const COMMANDS = [
             { flag: '--monorepo', description: 'A workspace, even for a single type' },
             { flag: '--multi-tenant', description: 'Tenant-aware api, web and mobile' },
             { flag: '--single-tenant', description: 'No tenancy' },
+            { flag: '--mcp', description: 'An MCP server on the api, authorized through the web' },
+            { flag: '--no-mcp', description: 'No MCP server' },
             { flag: '--skip-install', description: 'Do not run pnpm install' },
             JSON_OPTION,
         ],

package/dist/compose.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { prependProperty, readJsonc, removeWhatBaseDeclares, setJsonc } from "./jsonc.js";
+import { applyMcp } from "./mcp.js";
 const CLIENTS = ['web', 'mobile'];
 // One exception to one-version-per-dependency, recorded in DECISIONS.md: stable NativeWind needs Tailwind 3.
 const NAMED_CATALOGS = [{ name: 'tailwind3', dependency: 'tailwindcss', major: '3' }];
@@ -181,12 +182,15 @@ async function assertCatalogCovers(target, catalog) {
         }
     }
 }
-export async function composeWorkspace({ templates, target, types, mobileScheme = 'app', }) {
+export async function composeWorkspace({ templates, target, types, mobileScheme = 'app', mcp = false, }) {
     await mkdir(target, { recursive: true });
     await copyTemplate(join(templates, 'workspace'), target);
     const apps = [];
     for (const type of types) {
-        apps.push(await copyApp(templates, target, type));
+        const app = await copyApp(templates, target, type);
+        // Before the catalog is collected, so a dependency that leaves never reaches it.
+        await applyMcp(app, type, mcp);
+        apps.push(app);
     }
     const clients = CLIENTS.filter((client) => types.includes(client));
     if (clients.length > 0) {
@@ -204,12 +208,12 @@ export async function composeWorkspace({ templates, target, types, mobileScheme
         });
     }
     // One command for everything and one per app. Each app answers to `dev`, so the root never needs to know how.
-    // The API's database check is the exception: it may ask a question, which the interleaved output of a parallel
-    // run would bury, so the root asks it first and the API's own check then finds nothing to do.
-    const parallelDev = 'pnpm -r --parallel dev';
-    const dev = types.includes('api')
-        ? `node apps/api/scripts/database.mjs --check && ${parallelDev}`
-        : parallelDev;
+    // The database and the ports are the exception: both may ask a question, which the interleaved output of a
+    // parallel run would bury, so the root asks first and each app's own check then finds nothing to do.
+    // `pnpm -r --parallel` starts each app in its own process group, so Ctrl+C reaches pnpm and leaves the apps
+    // running. The ports script wraps the run, remembers what it started, and stops all of it on the way out.
+    const database = types.includes('api') ? 'node apps/api/scripts/database.mjs --check && ' : '';
+    const dev = `${database}node scripts/ports.mjs --all -- pnpm -r --parallel dev`;
     await rewriteText(join(target, 'package.json'), (text) => types.reduce((pkg, type) => setJsonc(pkg, ['scripts', type], `pnpm --filter ${type} dev`), setJsonc(text, ['scripts', 'dev'], dev)));
     const manifests = await Promise.all(apps.map(async (app) => readJsonc(await readFile(join(app, 'package.json'), 'utf8'))));
     const catalogs = collectCatalog(manifests);

package/dist/context.js

@@ -10,6 +10,7 @@ export function areasFor(answers) {
         ...CLIENTS.filter(has),
         ...(answers.architecture === 'monorepo' ? ['monorepo'] : []),
         ...(answers.multiTenant ? ['multi-tenancy'] : []),
+        ...(answers.mcp ? ['mcp'] : []),
     ];
 }
 async function titleOf(path) {
@@ -31,6 +32,7 @@ export async function writeContext(knowledge, root, answers) {
         types: answers.types,
         architecture: answers.architecture,
         multiTenant: answers.multiTenant,
+        mcp: answers.mcp,
     };
     await writeFile(join(prumo, 'config.json'), `${JSON.stringify(config, null, 2)}\n`);
     await writeFile(join(root, 'AGENTS.md'), `# ${answers.name}\n\nThis project's conventions live in \`.prumo/\`. Read [\`.prumo/INDEX.md\`](.prumo/INDEX.md) before changing how something is done.\n`);

package/dist/generate.js

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 import { composeWorkspace, copyTemplate } from "./compose.js";
 import { writeContext } from "./context.js";
 import { setJsonc } from "./jsonc.js";
+import { applyMcp } from "./mcp.js";
 import { schemeFor } from "./names.js";
 import { CliError } from "./output.js";
 async function rewrite(path, change) {
@@ -66,6 +67,7 @@ export async function generate({ templates, knowledge, target, answers, install,
     const [only] = answers.types;
     if (answers.architecture === 'alone' && only !== undefined) {
         await copyTemplate(join(templates, only), target);
+        await applyMcp(target, only, answers.mcp);
         await nameProject(target, answers.name);
         await writeLocalEnv(target, only);
         if (only === 'api') {
@@ -81,6 +83,7 @@ export async function generate({ templates, knowledge, target, answers, install,
             target,
             types: answers.types,
             mobileScheme: schemeFor(answers.name),
+            mcp: answers.mcp,
         });
         await nameProject(target, answers.name);
         for (const type of answers.types) {
@@ -99,5 +102,10 @@ export async function generate({ templates, knowledge, target, answers, install,
         run('pnpm', ['install'], target, childOutput);
         // Rewriting the contract import changes import grouping and line length; only the formatter can settle both.
         run('pnpm', ['exec', 'biome', 'check', '--write'], target, childOutput);
+        // The route tree is generated from the route files, and cutting MCP removed one.
+        if (answers.types.includes('web')) {
+            const web = answers.architecture === 'alone' ? target : join(target, 'apps', 'web');
+            run('pnpm', ['exec', 'tsr', 'generate'], web, childOutput);
+        }
     }
 }

package/dist/mcp.js

@@ -0,0 +1,100 @@
+import { existsSync } from 'node:fs';
+import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { setJsonc } from "./jsonc.js";
+// The api and web templates ship with MCP. A project that answered no receives them without it: these files are
+// deleted, these dependencies removed, and every marked line or block cut. Every other type has nothing to cut.
+const FILES = {
+    api: [
+        'src/infra/mcp',
+        'src/infra/http/controllers/mcp.controller.ts',
+        'test/infra/http/controllers/mcp.controller.spec.ts',
+    ],
+    web: ['src/features/oauth', 'src/routes/_authenticated/consent.tsx', 'test/features/oauth'],
+};
+const DEPENDENCIES = {
+    api: [
+        '@better-auth/cimd',
+        '@better-auth/mcp',
+        '@modelcontextprotocol/client',
+        '@modelcontextprotocol/server',
+    ],
+    web: ['@better-auth/oauth-provider'],
+};
+const BLOCK_START = /^\s*\/\/ prumo:mcp$/;
+const BLOCK_END = /^\s*\/\/ prumo:end-mcp$/;
+// A marked import keeps its marker as a trailing comment, which the import sorter carries along.
+const MARKED_LINE = /\s*\/\/ prumo:mcp$/;
+export function cutMcp(text, keep, file = 'a file') {
+    const kept = [];
+    let inBlock = false;
+    for (const line of text.split('\n')) {
+        if (BLOCK_START.test(line)) {
+            if (inBlock) {
+                throw new Error(`${file} opens a prumo:mcp block inside another`);
+            }
+            inBlock = true;
+        }
+        else if (BLOCK_END.test(line)) {
+            if (!inBlock) {
+                throw new Error(`${file} closes a prumo:mcp block it never opened`);
+            }
+            inBlock = false;
+        }
+        else if (MARKED_LINE.test(line)) {
+            if (keep) {
+                kept.push(line.replace(MARKED_LINE, ''));
+            }
+        }
+        else if (keep || !inBlock) {
+            kept.push(line);
+        }
+    }
+    if (inBlock) {
+        throw new Error(`${file} leaves a prumo:mcp block open`);
+    }
+    return kept.join('\n');
+}
+async function sourceFiles(directory) {
+    if (!existsSync(directory)) {
+        return [];
+    }
+    const entries = await readdir(directory, { withFileTypes: true, recursive: true });
+    return entries
+        .filter((entry) => entry.isFile() && /\.tsx?$/.test(entry.name))
+        .map((entry) => join(entry.parentPath, entry.name));
+}
+export async function applyMcp(app, type, enabled) {
+    const files = FILES[type];
+    const dependencies = DEPENDENCIES[type];
+    if (files === undefined || dependencies === undefined) {
+        return;
+    }
+    if (!enabled) {
+        for (const file of files) {
+            await rm(join(app, file), { recursive: true, force: true });
+        }
+        const manifest = join(app, 'package.json');
+        let text = await readFile(manifest, 'utf8');
+        for (const section of ['dependencies', 'devDependencies']) {
+            for (const dependency of dependencies) {
+                text = setJsonc(text, [section, dependency], undefined);
+            }
+        }
+        await writeFile(manifest, text);
+    }
+    const sources = [
+        ...(await sourceFiles(join(app, 'src'))),
+        ...(await sourceFiles(join(app, 'test'))),
+    ];
+    for (const source of sources) {
+        const text = await readFile(source, 'utf8');
+        const cut = cutMcp(text, enabled, source);
+        if (!enabled && dependencies.some((dependency) => cut.includes(`'${dependency}`))) {
+            throw new Error(`${source} still imports an MCP package outside a prumo:mcp marker`);
+        }
+        if (cut !== text) {
+            await writeFile(source, cut);
+        }
+    }
+}

package/dist/questions.js

@@ -17,6 +17,9 @@ export async function resolveAnswers(flags, asker) {
     if (flags.alone && flags.monorepo) {
         throw new CliError('invalid_input', 'Choose --alone or --monorepo, not both.');
     }
+    if (flags.mcp && flags.noMcp) {
+        throw new CliError('invalid_input', 'Choose --mcp or --no-mcp, not both.');
+    }
     if (flags.multiTenant && flags.singleTenant) {
         throw new CliError('invalid_input', 'Choose --multi-tenant or --single-tenant, not both.');
     }
@@ -60,5 +63,22 @@ export async function resolveAnswers(flags, asker) {
             missing('--multi-tenant or --single-tenant');
         }
     }
-    return { name, types, architecture, multiTenant };
+    // MCP authorizes through a sign-in and a consent page, which only a web app can serve.
+    const mcpCapable = types.includes('api') && types.includes('web');
+    let mcp = false;
+    if (!mcpCapable) {
+        if (flags.mcp) {
+            throw new CliError('invalid_input', '--mcp needs both api and web in --types.');
+        }
+    }
+    else if (flags.mcp || flags.noMcp) {
+        mcp = flags.mcp;
+    }
+    else if (asker !== undefined) {
+        mcp = await asker.mcp();
+    }
+    else {
+        missing('--mcp or --no-mcp');
+    }
+    return { name, types, architecture, multiTenant, mcp };
 }

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.0.5",
+  "version": "0.1.0",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",
     "cli",
     "typescript",
-    "nestjs",
+    "fastify",
+    "mcp",
     "expo",
     "monorepo",
     "conventions",
@@ -35,7 +36,7 @@
   "scripts": {
     "lint": "biome check",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run --dir src",
+    "test": "vitest run --dir test",
     "prumo": "node src/cli.ts",
     "build": "tsc -p tsconfig.build.json && node scripts/copy-assets.mjs",
     "prepack": "pnpm build"

package/templates/api/.swcrc

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://swc.rs/schema.json",
+  "jsc": {
+    "parser": { "syntax": "typescript", "decorators": true },
+    "transform": { "legacyDecorator": true, "decoratorMetadata": true },
+    "target": "es2023",
+    "keepClassNames": true,
+    "baseUrl": "./",
+    "paths": { "@/*": ["./src/*"] }
+  },
+  "module": { "type": "commonjs" },
+  "sourceMaps": true
+}

package/templates/api/README.md

@@ -19,7 +19,16 @@ starts Postgres from `docker-compose.yml` on port 5432 or the next free one (kep
 into `.env`, and migrates. `pnpm db:setup` does the same at any time. Without a terminal every answer comes from a
 flag: `--name`, `--port`, `--skip-migrate`, and `--json` for one JSON result on stdout.
 
-The API listens on `http://localhost:3000`. Outside production, its documentation is at `/api/docs`.
+The API listens on the port in `PORT`, `http://localhost:3000` by default. Outside production, its documentation is
+at `/api/docs`.
+
+Before it starts, `pnpm dev` checks that the port is free. When something else holds it, it says what does, by
+name and pid, and asks whether to stop that process or to move this app to the next free port. Moving it writes the
+new port to `.env`, along with every URL that pointed at the old one. Without a terminal, pass `--kill` or
+`--change` to `scripts/ports.mjs`, or the command stops rather than choosing for you.
+
+Ctrl+C stops everything `pnpm dev` started, not only what the terminal signals: the script remembers the processes
+it spawned, stops them, and frees the port. Anything it did not start is named and left alone.
 
 `pnpm db:migrate` builds first, then runs Better Auth's migrations and then the application's. Before
 migrating, Better Auth logs `Database schema mismatch` because its tables do not exist yet; the migration

package/templates/api/biome.jsonc

@@ -6,13 +6,15 @@
   "linter": {
     "rules": {
       "preset": "recommended",
-      // Nest injects by the emitted constructor type; `import type` erases it and breaks injection silently.
-      "style": { "useImportType": "off" }
+      // tsyringe injects by the emitted constructor type; `import type` erases it and breaks injection silently.
+      "style": { "useImportType": "off" },
+      // A file that only re-exports is how an invisible import cycle forms.
+      "performance": { "noBarrelFile": "error" }
     }
   },
   "javascript": {
     "formatter": { "quoteStyle": "single", "semicolons": "asNeeded" },
-    // Nest decorates constructor and handler parameters; Biome cannot parse those without this.
+    // Ports are injected with `@inject(TOKEN)` on constructor parameters; Biome cannot parse those without this.
     "parser": { "unsafeParameterDecoratorsEnabled": true }
   }
 }

package/templates/api/package.json

@@ -3,57 +3,51 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "build": "nest build",
-    "start": "nest start",
-    "start:dev": "nest start --watch",
-    "dev": "node scripts/database.mjs --check && pnpm start:dev",
-    "start:prod": "node dist/main",
+    "build": "swc src -d dist --strip-leading-paths --delete-dir-on-start --ignore \"**/*.spec.ts,**/*.d.ts\"",
+    "start": "node dist/infra/http/server.js",
+    "start:dev": "node --watch -r @swc-node/register src/infra/http/server.ts",
+    "dev": "node scripts/database.mjs --check && node scripts/ports.mjs -- pnpm start:dev",
     "lint": "biome check",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:cov": "vitest run --coverage",
     "db:setup": "node scripts/database.mjs",
-    "db:migrate": "nest build && auth migrate --config dist/auth/auth.js --yes && mikro-orm migration:up",
+    "db:migrate": "pnpm build && auth migrate --config dist/infra/auth/auth.cli.js --yes && mikro-orm migration:up",
     "db:migration:create": "mikro-orm migration:create",
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.7.4",
+    "@better-auth/cimd": "1.7.6",
+    "@better-auth/expo": "1.7.6",
+    "@better-auth/mcp": "1.7.6",
+    "@fastify/cors": "11.3.0",
+    "@fastify/swagger": "9.9.0",
+    "@fastify/swagger-ui": "6.1.1",
     "@mikro-orm/core": "7.2.0",
     "@mikro-orm/migrations": "7.2.0",
-    "@mikro-orm/nestjs": "7.1.0",
     "@mikro-orm/postgresql": "7.2.0",
-    "@nestjs/common": "12.0.1",
-    "@nestjs/config": "12.0.0",
-    "@nestjs/core": "12.0.1",
-    "@nestjs/platform-express": "12.0.1",
-    "@nestjs/swagger": "12.0.1",
-    "@nestjs/terminus": "12.0.0",
-    "better-auth": "1.7.4",
-    "class-transformer": "0.5.1",
-    "class-validator": "0.15.1",
-    "nestjs-pino": "5.1.0",
+    "@modelcontextprotocol/server": "2.2.0",
+    "better-auth": "1.7.6",
+    "fastify": "5.12.5",
+    "fastify-type-provider-zod": "7.0.0",
     "pg": "8.23.0",
-    "pino": "10.3.1",
-    "pino-http": "11.0.0",
     "reflect-metadata": "0.2.2",
-    "rxjs": "7.8.2"
+    "tsyringe": "4.10.0",
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.13",
     "@mikro-orm/cli": "7.2.0",
-    "@nestjs/cli": "12.0.0",
-    "@nestjs/schematics": "12.0.1",
-    "@nestjs/testing": "12.0.1",
+    "@modelcontextprotocol/client": "2.2.0",
     "@swc-node/register": "1.12.1",
+    "@swc/cli": "0.8.1",
     "@swc/core": "1.16.2",
     "@testcontainers/postgresql": "12.1.0",
-    "@types/express": "5.0.6",
     "@types/node": "24.13.4",
     "@types/pg": "8.23.1",
     "@vitest/coverage-v8": "4.1.11",
-    "auth": "1.7.4",
+    "auth": "1.7.6",
     "pino-pretty": "13.1.3",
     "typescript": "6.0.3",
     "unplugin-swc": "1.6.0",
@@ -64,8 +58,8 @@
   },
   "mikro-orm": {
     "configPaths": [
-      "./src/mikro-orm.config.ts",
-      "./dist/mikro-orm.config.js"
+      "./src/infra/database/mikroorm/mikro-orm.config.ts",
+      "./dist/infra/database/mikroorm/mikro-orm.config.js"
     ]
   }
 }

package/templates/api/pnpm-workspace.yaml

@@ -1,6 +1,4 @@
 allowBuilds:
-  # Its install script only sends usage telemetry; it arrives through @nestjs/swagger's swagger-ui-dist.
-  '@scarf/scarf': false
   # Its platform binary arrives as an optional dependency, so the install script is not needed.
   '@swc/core': false
   # These three arrive through Testcontainers, and the suite runs without their native builds.