@stjoseph/prumo 0.0.6 → 0.1.1

package/.prumo-templates/mcp/server.md

@@ -0,0 +1,54 @@
+# MCP server
+
+## Rule
+
+Serve MCP at `POST /api/mcp`, in `src/infra/http/controllers/mcp.controller.ts`. Protect it with
+`requireMcpAuth` from `@better-auth/mcp`, with the same `resource` as `mcp()` in `auth.factory.ts`:
+`mcpResource(env)`. The route is `public: true` for the session hook, because it answers a bearer access
+token, never a cookie.
+
+Build the server per request in `src/infra/mcp/mcp.server.ts` with `createMcpHandler` from
+`@modelcontextprotocol/server`, `legacy: 'reject'`. The user is the token's `sub`, passed through
+`authInfo.extra.userId`.
+
+Write a module's tools in `src/infra/mcp/tools/<module>.tool.ts`. A tool resolves a use case and calls
+`execute()`, exactly as a route handler does. Take its input schema from the module's `dto/`, and pass its
+result through the module's output schema with `.parse()` before returning it.
+
+Keep Better Auth the authorization server: `jwt()`, `mcp()` and `cimd()` in `auth.factory.ts`, discovery at
+`/.well-known/*`, sign-in and consent on the web app. Do not enable dynamic client registration.
+
+## Rationale
+
+MCP is a second edge of the product, beside HTTP, so it reaches the domain the same way: through use cases,
+with the user's identity as an argument. A tool that queried a repository would bypass the rules a route
+obeys.
+
+`.parse()` is required here and not in a route because Fastify drops a field the response schema does not
+list and MCP does not: a tool returns whatever it is handed, so an entity passed straight through publishes
+every column.
+
+`legacy: 'reject'` and CIMD follow the MCP 2026-07-28 profile, which Better Auth's plugin targets. The
+protocol is stateless, so a server per request costs nothing and knows only its caller. Dynamic client
+registration stays off because that profile deprecates it.
+
+## Applies to
+
+`src/infra/mcp/`, `mcp.controller.ts`, the MCP part of `auth.factory.ts`, and the web app's `/consent` route.
+
+## Examples
+
+```
+✅  async () => asResult(await container.resolve(FindProfileUseCase).execute(userId))
+❌  async () => ({ structuredContent: await em.findOne(Profile, { userId }) })
+
+✅  structuredContent: profileResponseSchema.parse(profile)
+❌  structuredContent: profile                       every column leaves
+```
+
+## Enforcement
+
+**Tests.** `mcp.controller.spec.ts` walks the whole authorization, consent included, connects the SDK's
+own client, and asserts a tool returns only the public fields.
+
+**Review only.** That a new tool goes through a use case and parses its output.

package/.prumo-templates/monorepo/dependencies.md

@@ -38,9 +38,9 @@ elsewhere, and an import breaks with nothing having changed. The repetition this
 every entry is the identical line `"react": "catalog:"`, not a version to keep in sync.
 
 An app depending on another app is tempting (importing a type from the API looks like the way to stop
-duplicating the contract), and it is wrong twice. **The type is the wrong one:** a response is an entity
-passed through `ClassSerializerInterceptor`, so every excluded property is absent from the JSON and present
-on the type, promising fields the payload never carries. **And an app is deployable:** the dependency means
+duplicating the contract), and it is wrong twice. **The type is the wrong one:** a response passes through
+the route's output schema, which drops every field it does not list, so a property can be present on the
+type and absent from the JSON, promising fields the payload never carries. **And an app is deployable:** the dependency means
 building one requires the other, CI needs both for either, and the boundary between two things with
 separate lifecycles stops existing.
 

package/.prumo-templates/monorepo/layout.md

@@ -82,7 +82,7 @@ with generic code, which is the code that belonged in the package.
 **A Vite app and a Next app consume the package as source with no configuration**: Next 16 needs no
 `transpilePackages`; a page importing it builds, stays static, and renders the imported value. Its `exports` points at `src/index.ts`,
 `tsc` with `moduleResolution: bundler` typechecks through it, and `vite build` bundles it, verified in a composed
-workspace. The API does not import the package, so Nest never compiles it.
+workspace. The API does not import the package, so its SWC build never compiles it.
 
 **Expo resolves workspace packages automatically from SDK 52**, with no `watchFolders` or
 `nodeModulesPaths` configuration. Older guidance about configuring Metro by hand no longer applies. Verified with

package/README.md

@@ -52,7 +52,7 @@ terminal a missing answer is an error rather than a default, so nothing importan
 silence:
 
 ```sh
-npx @stjoseph/prumo new my-app --types api,web --single-tenant
+npx @stjoseph/prumo new my-app --types api,web --single-tenant --no-mcp
 ```
 
 | Flag | What it answers |
@@ -60,6 +60,7 @@ npx @stjoseph/prumo new my-app --types api,web --single-tenant
 | `--types api,web,mobile,site` | What the project contains. More than one type makes a workspace |
 | `--alone` or `--monorepo` | How a single type is laid out |
 | `--multi-tenant` or `--single-tenant` | Whether the application serves several tenants |
+| `--mcp` or `--no-mcp` | With an api and a web: whether AI assistants reach the API through MCP, signed in as the user |
 | `--skip-install` | Stops after writing the files |
 
 ## Commands
@@ -81,7 +82,7 @@ is asked, and the exit code is 0 only when `ok` is true.
 
 | Type | What you get |
 |---|---|
-| `api` | NestJS, MikroORM on PostgreSQL, Better Auth in a schema of its own, Swagger, Vitest with Testcontainers |
+| `api` | Fastify with a domain/infra structure, tsyringe, Zod, MikroORM on PostgreSQL, Better Auth in a schema of its own, Swagger UI, Vitest with Testcontainers |
 | `web` | Vite, React, TanStack Router and Query, Tailwind, shadcn/ui, forms validated with Zod |
 | `mobile` | Expo with Expo Router, NativeWind, MMKV, and the session kept in `expo-secure-store` |
 | `site` | Next on the App Router, static by default, for pages that have to be indexed |
@@ -117,8 +118,8 @@ Once written, those documents belong to the team. Prumo does not come back and r
 |---|---|
 | [`docs/stack.md`](https://github.com/stjosephworks/prumo/blob/main/docs/stack.md) | What is locked, what was deliberately dropped, and the version floors |
 | [`docs/structure.md`](https://github.com/stjosephworks/prumo/blob/main/docs/structure.md) | The `.prumo/` layout, and the rule deciding which areas a project receives |
-| [`docs/DECISIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/DECISIONS.md) | Every decision, why it won, and what it costs |
-| [`docs/OPEN-QUESTIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/OPEN-QUESTIONS.md) | What has been raised and is still unresolved |
+| [`docs/document-template.md`](https://github.com/stjosephworks/prumo/blob/main/docs/document-template.md) | The shape every convention document fills |
+| [`docs/maintaining-templates.md`](https://github.com/stjosephworks/prumo/blob/main/docs/maintaining-templates.md) | How a template is changed, and how the change is proved |
 
 ## Releasing
 
@@ -130,7 +131,6 @@ without a token in the repository. Any other push to `main` publishes nothing.
 
 Prumo is in beta. `0.0.1` is the first published version: every template runs and every generated
 project is verified in CI, and what a generated project looks like can still change before 1.0.
-What is known to be missing is listed in [`docs/OPEN-QUESTIONS.md`](https://github.com/stjosephworks/prumo/blob/main/docs/OPEN-QUESTIONS.md), and
-updating a project's `.prumo/` in place comes after 1.0.
+Updating a project's `.prumo/` in place comes after 1.0.
 
 MIT licensed. See [`LICENSE`](https://github.com/stjosephworks/prumo/blob/main/LICENSE).

package/dist/asker.js

@@ -24,5 +24,9 @@ export function terminalAsker(validateName) {
             initialValue: 'alone',
         })),
         multiTenant: async () => answered(await prompt.confirm({ message: 'Is it multi-tenant?', initialValue: false })),
+        mcp: async () => answered(await prompt.confirm({
+            message: 'Let AI assistants use the API through MCP, signed in as the user?',
+            initialValue: false,
+        })),
     };
 }

package/dist/cli.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { resolve } from 'node:path';
 import { parseArgs } from 'node:util';
 import * as prompt from '@clack/prompts';
 import { terminalAsker } from "./asker.js";
@@ -13,11 +12,7 @@ import { generate } from "./generate.js";
 import { validateProjectName } from "./names.js";
 import { CliError, errorEnvelope, writeEnvelope } from "./output.js";
 import { resolveAnswers } from "./questions.js";
-function version() {
-    // src/cli.ts and dist/cli.js both sit one level below package.json.
-    const pkg = JSON.parse(readFileSync(join(import.meta.dirname, '..', 'package.json'), 'utf8'));
-    return pkg.version;
-}
+import { cliVersion } from "./version.js";
 function help(name) {
     if (name === undefined) {
         return { data: { commands: COMMANDS }, text: helpText() };
@@ -38,6 +33,8 @@ async function runNew(args, json) {
             monorepo: { type: 'boolean', default: false },
             'multi-tenant': { type: 'boolean', default: false },
             'single-tenant': { type: 'boolean', default: false },
+            mcp: { type: 'boolean', default: false },
+            'no-mcp': { type: 'boolean', default: false },
             'skip-install': { type: 'boolean', default: false },
             json: { type: 'boolean', default: false },
         },
@@ -54,6 +51,8 @@ async function runNew(args, json) {
         monorepo: values.monorepo,
         multiTenant: values['multi-tenant'],
         singleTenant: values['single-tenant'],
+        mcp: values.mcp,
+        noMcp: values['no-mcp'],
     }, interactive ? terminalAsker(validateProjectName) : undefined);
     if (!json && answers.types.length > 1) {
         prompt.log.info(`${answers.types.length} types make a workspace: apps/ and packages/ under one root.`);
@@ -126,7 +125,7 @@ async function main(argv) {
             result = help(topic);
         }
         else if (name === 'version') {
-            const current = version();
+            const current = cliVersion();
             result = { data: { version: current }, text: current };
         }
         else if (name === 'doctor') {

package/dist/commands.js

@@ -13,6 +13,8 @@ export const COMMANDS = [
             { flag: '--monorepo', description: 'A workspace, even for a single type' },
             { flag: '--multi-tenant', description: 'Tenant-aware api, web and mobile' },
             { flag: '--single-tenant', description: 'No tenancy' },
+            { flag: '--mcp', description: 'An MCP server on the api, authorized through the web' },
+            { flag: '--no-mcp', description: 'No MCP server' },
             { flag: '--skip-install', description: 'Do not run pnpm install' },
             JSON_OPTION,
         ],

package/dist/compose.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { prependProperty, readJsonc, removeWhatBaseDeclares, setJsonc } from "./jsonc.js";
+import { applyMcp } from "./mcp.js";
 const CLIENTS = ['web', 'mobile'];
 // One exception to one-version-per-dependency, recorded in DECISIONS.md: stable NativeWind needs Tailwind 3.
 const NAMED_CATALOGS = [{ name: 'tailwind3', dependency: 'tailwindcss', major: '3' }];
@@ -181,12 +182,15 @@ async function assertCatalogCovers(target, catalog) {
         }
     }
 }
-export async function composeWorkspace({ templates, target, types, mobileScheme = 'app', }) {
+export async function composeWorkspace({ templates, target, types, mobileScheme = 'app', mcp = false, }) {
     await mkdir(target, { recursive: true });
     await copyTemplate(join(templates, 'workspace'), target);
     const apps = [];
     for (const type of types) {
-        apps.push(await copyApp(templates, target, type));
+        const app = await copyApp(templates, target, type);
+        // Before the catalog is collected, so a dependency that leaves never reaches it.
+        await applyMcp(app, type, mcp);
+        apps.push(app);
     }
     const clients = CLIENTS.filter((client) => types.includes(client));
     if (clients.length > 0) {

package/dist/context.js

@@ -1,5 +1,6 @@
 import { cp, mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { cliVersion } from "./version.js";
 const CLIENTS = ['web', 'mobile', 'site'];
 export function areasFor(answers) {
     const has = (type) => answers.types.includes(type);
@@ -10,6 +11,7 @@ export function areasFor(answers) {
         ...CLIENTS.filter(has),
         ...(answers.architecture === 'monorepo' ? ['monorepo'] : []),
         ...(answers.multiTenant ? ['multi-tenancy'] : []),
+        ...(answers.mcp ? ['mcp'] : []),
     ];
 }
 async function titleOf(path) {
@@ -27,10 +29,13 @@ export async function writeContext(knowledge, root, answers) {
         }
     }
     await writeFile(join(prumo, 'INDEX.md'), `# Conventions\n\n${lines.join('\n')}\n`);
+    // The version that wrote the project, so a tool reading it can tell a project made by an older Prumo.
     const config = {
+        prumo: cliVersion(),
         types: answers.types,
         architecture: answers.architecture,
         multiTenant: answers.multiTenant,
+        mcp: answers.mcp,
     };
     await writeFile(join(prumo, 'config.json'), `${JSON.stringify(config, null, 2)}\n`);
     await writeFile(join(root, 'AGENTS.md'), `# ${answers.name}\n\nThis project's conventions live in \`.prumo/\`. Read [\`.prumo/INDEX.md\`](.prumo/INDEX.md) before changing how something is done.\n`);

package/dist/generate.js

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 import { composeWorkspace, copyTemplate } from "./compose.js";
 import { writeContext } from "./context.js";
 import { setJsonc } from "./jsonc.js";
+import { applyMcp } from "./mcp.js";
 import { schemeFor } from "./names.js";
 import { CliError } from "./output.js";
 async function rewrite(path, change) {
@@ -66,6 +67,7 @@ export async function generate({ templates, knowledge, target, answers, install,
     const [only] = answers.types;
     if (answers.architecture === 'alone' && only !== undefined) {
         await copyTemplate(join(templates, only), target);
+        await applyMcp(target, only, answers.mcp);
         await nameProject(target, answers.name);
         await writeLocalEnv(target, only);
         if (only === 'api') {
@@ -81,6 +83,7 @@ export async function generate({ templates, knowledge, target, answers, install,
             target,
             types: answers.types,
             mobileScheme: schemeFor(answers.name),
+            mcp: answers.mcp,
         });
         await nameProject(target, answers.name);
         for (const type of answers.types) {
@@ -99,5 +102,10 @@ export async function generate({ templates, knowledge, target, answers, install,
         run('pnpm', ['install'], target, childOutput);
         // Rewriting the contract import changes import grouping and line length; only the formatter can settle both.
         run('pnpm', ['exec', 'biome', 'check', '--write'], target, childOutput);
+        // The route tree is generated from the route files, and cutting MCP removed one.
+        if (answers.types.includes('web')) {
+            const web = answers.architecture === 'alone' ? target : join(target, 'apps', 'web');
+            run('pnpm', ['exec', 'tsr', 'generate'], web, childOutput);
+        }
     }
 }

package/dist/mcp.js

@@ -0,0 +1,100 @@
+import { existsSync } from 'node:fs';
+import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { setJsonc } from "./jsonc.js";
+// The api and web templates ship with MCP. A project that answered no receives them without it: these files are
+// deleted, these dependencies removed, and every marked line or block cut. Every other type has nothing to cut.
+const FILES = {
+    api: [
+        'src/infra/mcp',
+        'src/infra/http/controllers/mcp.controller.ts',
+        'test/infra/http/controllers/mcp.controller.spec.ts',
+    ],
+    web: ['src/features/oauth', 'src/routes/_authenticated/consent.tsx', 'test/features/oauth'],
+};
+const DEPENDENCIES = {
+    api: [
+        '@better-auth/cimd',
+        '@better-auth/mcp',
+        '@modelcontextprotocol/client',
+        '@modelcontextprotocol/server',
+    ],
+    web: ['@better-auth/oauth-provider'],
+};
+const BLOCK_START = /^\s*\/\/ prumo:mcp$/;
+const BLOCK_END = /^\s*\/\/ prumo:end-mcp$/;
+// A marked import keeps its marker as a trailing comment, which the import sorter carries along.
+const MARKED_LINE = /\s*\/\/ prumo:mcp$/;
+export function cutMcp(text, keep, file = 'a file') {
+    const kept = [];
+    let inBlock = false;
+    for (const line of text.split('\n')) {
+        if (BLOCK_START.test(line)) {
+            if (inBlock) {
+                throw new Error(`${file} opens a prumo:mcp block inside another`);
+            }
+            inBlock = true;
+        }
+        else if (BLOCK_END.test(line)) {
+            if (!inBlock) {
+                throw new Error(`${file} closes a prumo:mcp block it never opened`);
+            }
+            inBlock = false;
+        }
+        else if (MARKED_LINE.test(line)) {
+            if (keep) {
+                kept.push(line.replace(MARKED_LINE, ''));
+            }
+        }
+        else if (keep || !inBlock) {
+            kept.push(line);
+        }
+    }
+    if (inBlock) {
+        throw new Error(`${file} leaves a prumo:mcp block open`);
+    }
+    return kept.join('\n');
+}
+async function sourceFiles(directory) {
+    if (!existsSync(directory)) {
+        return [];
+    }
+    const entries = await readdir(directory, { withFileTypes: true, recursive: true });
+    return entries
+        .filter((entry) => entry.isFile() && /\.tsx?$/.test(entry.name))
+        .map((entry) => join(entry.parentPath, entry.name));
+}
+export async function applyMcp(app, type, enabled) {
+    const files = FILES[type];
+    const dependencies = DEPENDENCIES[type];
+    if (files === undefined || dependencies === undefined) {
+        return;
+    }
+    if (!enabled) {
+        for (const file of files) {
+            await rm(join(app, file), { recursive: true, force: true });
+        }
+        const manifest = join(app, 'package.json');
+        let text = await readFile(manifest, 'utf8');
+        for (const section of ['dependencies', 'devDependencies']) {
+            for (const dependency of dependencies) {
+                text = setJsonc(text, [section, dependency], undefined);
+            }
+        }
+        await writeFile(manifest, text);
+    }
+    const sources = [
+        ...(await sourceFiles(join(app, 'src'))),
+        ...(await sourceFiles(join(app, 'test'))),
+    ];
+    for (const source of sources) {
+        const text = await readFile(source, 'utf8');
+        const cut = cutMcp(text, enabled, source);
+        if (!enabled && dependencies.some((dependency) => cut.includes(`'${dependency}`))) {
+            throw new Error(`${source} still imports an MCP package outside a prumo:mcp marker`);
+        }
+        if (cut !== text) {
+            await writeFile(source, cut);
+        }
+    }
+}

package/dist/questions.js

@@ -17,6 +17,9 @@ export async function resolveAnswers(flags, asker) {
     if (flags.alone && flags.monorepo) {
         throw new CliError('invalid_input', 'Choose --alone or --monorepo, not both.');
     }
+    if (flags.mcp && flags.noMcp) {
+        throw new CliError('invalid_input', 'Choose --mcp or --no-mcp, not both.');
+    }
     if (flags.multiTenant && flags.singleTenant) {
         throw new CliError('invalid_input', 'Choose --multi-tenant or --single-tenant, not both.');
     }
@@ -60,5 +63,22 @@ export async function resolveAnswers(flags, asker) {
             missing('--multi-tenant or --single-tenant');
         }
     }
-    return { name, types, architecture, multiTenant };
+    // MCP authorizes through a sign-in and a consent page, which only a web app can serve.
+    const mcpCapable = types.includes('api') && types.includes('web');
+    let mcp = false;
+    if (!mcpCapable) {
+        if (flags.mcp) {
+            throw new CliError('invalid_input', '--mcp needs both api and web in --types.');
+        }
+    }
+    else if (flags.mcp || flags.noMcp) {
+        mcp = flags.mcp;
+    }
+    else if (asker !== undefined) {
+        mcp = await asker.mcp();
+    }
+    else {
+        missing('--mcp or --no-mcp');
+    }
+    return { name, types, architecture, multiTenant, mcp };
 }

package/dist/version.js

@@ -0,0 +1,7 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** This CLI's own version. src/*.ts and dist/*.js both sit one level below package.json. */
+export function cliVersion() {
+    const pkg = JSON.parse(readFileSync(join(import.meta.dirname, '..', 'package.json'), 'utf8'));
+    return pkg.version;
+}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.0.6",
+  "version": "0.1.1",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",
     "cli",
     "typescript",
-    "nestjs",
+    "fastify",
+    "mcp",
     "expo",
     "monorepo",
     "conventions",
@@ -35,7 +36,7 @@
   "scripts": {
     "lint": "biome check",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run --dir src",
+    "test": "vitest run --dir test",
     "prumo": "node src/cli.ts",
     "build": "tsc -p tsconfig.build.json && node scripts/copy-assets.mjs",
     "prepack": "pnpm build"

package/templates/api/.swcrc

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://swc.rs/schema.json",
+  "jsc": {
+    "parser": { "syntax": "typescript", "decorators": true },
+    "transform": { "legacyDecorator": true, "decoratorMetadata": true },
+    "target": "es2023",
+    "keepClassNames": true,
+    "baseUrl": "./",
+    "paths": { "@/*": ["./src/*"] }
+  },
+  "module": { "type": "commonjs" },
+  "sourceMaps": true
+}

package/templates/api/biome.jsonc

@@ -6,13 +6,15 @@
   "linter": {
     "rules": {
       "preset": "recommended",
-      // Nest injects by the emitted constructor type; `import type` erases it and breaks injection silently.
-      "style": { "useImportType": "off" }
+      // tsyringe injects by the emitted constructor type; `import type` erases it and breaks injection silently.
+      "style": { "useImportType": "off" },
+      // A file that only re-exports is how an invisible import cycle forms.
+      "performance": { "noBarrelFile": "error" }
     }
   },
   "javascript": {
     "formatter": { "quoteStyle": "single", "semicolons": "asNeeded" },
-    // Nest decorates constructor and handler parameters; Biome cannot parse those without this.
+    // Ports are injected with `@inject(TOKEN)` on constructor parameters; Biome cannot parse those without this.
     "parser": { "unsafeParameterDecoratorsEnabled": true }
   }
 }

package/templates/api/package.json

@@ -3,57 +3,51 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "build": "nest build",
-    "start": "nest start",
-    "start:dev": "nest start --watch",
+    "build": "swc src -d dist --strip-leading-paths --delete-dir-on-start --ignore \"**/*.spec.ts,**/*.d.ts\"",
+    "start": "node dist/infra/http/server.js",
+    "start:dev": "node --watch -r @swc-node/register src/infra/http/server.ts",
     "dev": "node scripts/database.mjs --check && node scripts/ports.mjs -- pnpm start:dev",
-    "start:prod": "node dist/main",
     "lint": "biome check",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:cov": "vitest run --coverage",
     "db:setup": "node scripts/database.mjs",
-    "db:migrate": "nest build && auth migrate --config dist/auth/auth.js --yes && mikro-orm migration:up",
+    "db:migrate": "pnpm build && auth migrate --config dist/infra/auth/auth.cli.js --yes && mikro-orm migration:up",
     "db:migration:create": "mikro-orm migration:create",
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.7.4",
+    "@better-auth/cimd": "1.7.6",
+    "@better-auth/expo": "1.7.6",
+    "@better-auth/mcp": "1.7.6",
+    "@fastify/cors": "11.3.0",
+    "@fastify/swagger": "9.9.0",
+    "@fastify/swagger-ui": "6.1.1",
     "@mikro-orm/core": "7.2.0",
     "@mikro-orm/migrations": "7.2.0",
-    "@mikro-orm/nestjs": "7.1.0",
     "@mikro-orm/postgresql": "7.2.0",
-    "@nestjs/common": "12.0.1",
-    "@nestjs/config": "12.0.0",
-    "@nestjs/core": "12.0.1",
-    "@nestjs/platform-express": "12.0.1",
-    "@nestjs/swagger": "12.0.1",
-    "@nestjs/terminus": "12.0.0",
-    "better-auth": "1.7.4",
-    "class-transformer": "0.5.1",
-    "class-validator": "0.15.1",
-    "nestjs-pino": "5.1.0",
+    "@modelcontextprotocol/server": "2.2.0",
+    "better-auth": "1.7.6",
+    "fastify": "5.12.5",
+    "fastify-type-provider-zod": "7.0.0",
     "pg": "8.23.0",
-    "pino": "10.3.1",
-    "pino-http": "11.0.0",
     "reflect-metadata": "0.2.2",
-    "rxjs": "7.8.2"
+    "tsyringe": "4.10.0",
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.13",
     "@mikro-orm/cli": "7.2.0",
-    "@nestjs/cli": "12.0.0",
-    "@nestjs/schematics": "12.0.1",
-    "@nestjs/testing": "12.0.1",
+    "@modelcontextprotocol/client": "2.2.0",
     "@swc-node/register": "1.12.1",
+    "@swc/cli": "0.8.1",
     "@swc/core": "1.16.2",
     "@testcontainers/postgresql": "12.1.0",
-    "@types/express": "5.0.6",
     "@types/node": "24.13.4",
     "@types/pg": "8.23.1",
     "@vitest/coverage-v8": "4.1.11",
-    "auth": "1.7.4",
+    "auth": "1.7.6",
     "pino-pretty": "13.1.3",
     "typescript": "6.0.3",
     "unplugin-swc": "1.6.0",
@@ -64,8 +58,8 @@
   },
   "mikro-orm": {
     "configPaths": [
-      "./src/mikro-orm.config.ts",
-      "./dist/mikro-orm.config.js"
+      "./src/infra/database/mikroorm/mikro-orm.config.ts",
+      "./dist/infra/database/mikroorm/mikro-orm.config.js"
     ]
   }
 }

package/templates/api/pnpm-workspace.yaml

@@ -1,6 +1,4 @@
 allowBuilds:
-  # Its install script only sends usage telemetry; it arrives through @nestjs/swagger's swagger-ui-dist.
-  '@scarf/scarf': false
   # Its platform binary arrives as an optional dependency, so the install script is not needed.
   '@swc/core': false
   # These three arrive through Testcontainers, and the suite runs without their native builds.

package/templates/api/src/domain/shared/errors/domain-error.ts

@@ -0,0 +1,5 @@
+export type DomainErrorKind = 'not_found' | 'conflict' | 'invalid' | 'forbidden' | 'unauthorized'
+
+export abstract class DomainError extends Error {
+  abstract readonly kind: DomainErrorKind
+}

package/templates/api/src/domain/shared/transactions/transaction-manager.ts

@@ -0,0 +1,5 @@
+export interface TransactionManager {
+  run<T>(work: () => Promise<T>): Promise<T>
+}
+
+export const TRANSACTION_MANAGER = Symbol('TransactionManager')

package/templates/api/src/domain/users/dto/profile-response.dto.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod'
+import { LOCALES } from '@/domain/users/entities/profile.entity'
+
+export const profileResponseSchema = z.object({
+  id: z.uuid(),
+  userId: z.uuid(),
+  displayName: z.string(),
+  locale: z.enum(LOCALES),
+  timezone: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+})
+
+export type ProfileResponseDto = z.infer<typeof profileResponseSchema>

package/templates/api/src/domain/users/dto/update-profile.dto.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod'
+import { LOCALES } from '@/domain/users/entities/profile.entity'
+
+export const updateProfileSchema = z.strictObject({
+  displayName: z.string().min(1).max(80).optional(),
+  locale: z.enum(LOCALES).optional(),
+  timezone: z.string().max(64).optional(),
+})
+
+export type UpdateProfileDto = z.infer<typeof updateProfileSchema>