@tatara/cli 0.0.0-stage → 0.1.1

package/dist/bin.mjs

@@ -0,0 +1,3001 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import pc from "picocolors";
+import { spawn } from "node:child_process";
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { glob } from "tinyglobby";
+import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
+import { x } from "tinyexec";
+import { parseEnv } from "node:util";
+import * as p from "@clack/prompts";
+import { randomBytes } from "node:crypto";
+import { stringify } from "yaml";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/commands/app-cli.ts
+const NODE_FLAGS = ["--env-file-if-exists=.env", "--disable-warning=ExperimentalWarning"];
+/** Runs `src/apps/cli/index.ts <args>` in the app, streaming output. Resolves the exit code. */
+function runAppCli(project, args, env) {
+	return new Promise((resolve) => {
+		const child = spawn(process.execPath, [
+			...NODE_FLAGS,
+			"src/apps/cli/index.ts",
+			...args
+		], {
+			cwd: project.root,
+			stdio: "inherit",
+			env: {
+				...process.env,
+				...env
+			}
+		});
+		child.on("exit", (code) => resolve(code ?? 1));
+		child.on("error", () => resolve(1));
+	});
+}
+function runBin(project, bin, args) {
+	return new Promise((resolve) => {
+		const child = spawn(`${project.root}/node_modules/.bin/${bin}`, args, {
+			cwd: project.root,
+			stdio: "inherit"
+		});
+		child.on("exit", (code) => resolve(code ?? 1));
+		child.on("error", () => resolve(1));
+	});
+}
+//#endregion
+//#region src/project/config.ts
+var NotATataraProject = class extends Error {
+	constructor(from) {
+		super(`No tatara.json found in ${from} or its parents. Run this inside a tatara app.`);
+	}
+};
+/** Finds the app root (the nearest folder with tatara.json) starting from `from`. */
+function findProjectRoot(from = process.cwd()) {
+	let dir = resolve(from);
+	for (;;) {
+		if (existsSync(join(dir, "tatara.json"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) throw new NotATataraProject(from);
+		dir = parent;
+	}
+}
+function loadProject(from = process.cwd()) {
+	const root = findProjectRoot(from);
+	const config = JSON.parse(readFileSync(join(root, "tatara.json"), "utf8"));
+	const features = /* @__PURE__ */ new Set([
+		config.orm,
+		config.database,
+		config.auth,
+		...config.authMethods.map((m) => `auth-${m}`),
+		...config.addons,
+		...config.auth === "none" ? [] : ["auth"],
+		...config.database === "none" ? [] : ["db"]
+	]);
+	return {
+		root,
+		config,
+		has: (f) => features.has(f)
+	};
+}
+//#endregion
+//#region src/commands/route-mounts.ts
+const ROUTE_FILE = /\/routes\/[^/]+\.routes\.ts$/;
+const DEFINE_ROUTES = /defineRoutes\(\s*\{([^}]*)\}/;
+function lineOf$1(text, index) {
+	return text.slice(0, index).split("\n").length;
+}
+/** Route files that mount on an app + basePath already taken by an earlier file (sorted by path). */
+function routeMountCollisions(sources) {
+	const owners = /* @__PURE__ */ new Map();
+	const violations = [];
+	for (const file of [...sources.keys()].sort()) {
+		if (!ROUTE_FILE.test(file)) continue;
+		const text = sources.get(file) ?? "";
+		const call = DEFINE_ROUTES.exec(text);
+		const app = call && /\bapp:\s*["']([^"']+)["']/.exec(call[1] ?? "")?.[1];
+		const basePath = call && /\bbasePath:\s*["']([^"']+)["']/.exec(call[1] ?? "")?.[1];
+		if (!call || !app || !basePath) continue;
+		const key = `${app} "${basePath}"`;
+		const owner = owners.get(key);
+		if (owner) violations.push({
+			file,
+			line: lineOf$1(text, call.index),
+			rule: "duplicate-base-path",
+			message: `${key} is already mounted by ${owner}; routers on one base path shadow each other, so give this one its own basePath`
+		});
+		else owners.set(key, file);
+	}
+	return violations;
+}
+//#endregion
+//#region src/commands/check.ts
+const IMPORT = /(?:import|export)\s[^"']*?from\s*["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g;
+function lineOf(text, index) {
+	return text.slice(0, index).split("\n").length;
+}
+/** Layout rules from AGENTS.md. Returns every violation; empty means the layout is clean. */
+async function check(project = loadProject()) {
+	const { root } = project;
+	const files = await glob(["src/**/*.ts", "tests/**/*.ts"], {
+		cwd: root,
+		ignore: ["src/generated/**"]
+	});
+	const violations = [];
+	const sources = /* @__PURE__ */ new Map();
+	for (const file of files.sort()) {
+		const text = await readFile(join(root, file), "utf8");
+		sources.set(file, text);
+		const moduleName = /^src\/modules\/([^/]+)\//.exec(file)?.[1];
+		for (const match of text.matchAll(IMPORT)) {
+			const spec = match[1] ?? match[2] ?? "";
+			const line = lineOf(text, match.index);
+			if (spec.startsWith("../")) violations.push({
+				file,
+				line,
+				rule: "no-parent-imports",
+				message: `use a # import instead of "${spec}"`
+			});
+			if (file.startsWith("src/core/") && spec.startsWith("#modules/")) violations.push({
+				file,
+				line,
+				rule: "core-imports-modules",
+				message: `core must not import modules ("${spec}")`
+			});
+			const target = /^#modules\/([^/]+)\/([^/]+)/.exec(spec);
+			if (moduleName && target && target[1] !== moduleName && target[2] !== "services") violations.push({
+				file,
+				line,
+				rule: "cross-module-imports",
+				message: `use ${target[1]}'s services, not "${spec}"`
+			});
+		}
+		if (/\/routes\/[^/]+\.routes\.ts$/.test(file)) {
+			const wildcard = /\.use\(\s*["']\*["']/.exec(text);
+			if (wildcard) violations.push({
+				file,
+				line: lineOf(text, wildcard.index),
+				rule: "no-wildcard-middleware",
+				message: "module routers must not call use(\"*\"); attach middleware per route or path"
+			});
+		}
+		if (file.startsWith("src/") && file !== "src/core/config/env.ts" && !file.includes("/tests/") && /\bprocess\.env\b/.test(text)) {
+			const index = text.search(/\bprocess\.env\b/);
+			violations.push({
+				file,
+				line: lineOf(text, index),
+				rule: "env-access",
+				message: "read configuration from #core/config/env, not process.env"
+			});
+		}
+	}
+	violations.push(...routeMountCollisions(sources));
+	return violations.filter((v) => !ignored(v, sources.get(v.file) ?? ""));
+}
+/** `// tatara-check-ignore <rule>: <reason>` on the line above a violation silences it. */
+function ignored(v, text) {
+	const previous = text.split("\n")[v.line - 2] ?? "";
+	return new RegExp(`tatara-check-ignore\\s+${v.rule}:\\s*\\S`).test(previous);
+}
+//#endregion
+//#region src/commands/sync.ts
+var sync_exports = /* @__PURE__ */ __exportAll({
+	specifier: () => specifier,
+	sync: () => sync
+});
+const HEADER = "// Generated by `tatara sync` — do not edit.\n";
+/** src/modules/notes/routes/note.routes.ts → #modules/notes/routes/note.routes */
+function specifier(path) {
+	return `#${path.replace(/^src\//, "").replace(/\.ts$/, "")}`;
+}
+function identifier(path, prefix) {
+	return `${prefix}_${path.replace(/^src\//, "").replace(/\.ts$/, "").split("/").filter((p) => ![
+		"routes",
+		"commands",
+		"consumers",
+		"schedules",
+		"permissions",
+		"db"
+	].includes(p)).join("_")}`.replace(/[^A-Za-z0-9_]/g, "_").replace(/_+/g, "_");
+}
+async function find(root, patterns) {
+	return (await glob(patterns, {
+		cwd: root,
+		ignore: ["**/*.test.ts", "**/*.d.ts"]
+	})).sort((a, b) => {
+		const rank = (p) => p.startsWith("src/core/") ? 0 : 1;
+		return rank(a) - rank(b) || a.localeCompare(b);
+	});
+}
+function listModule(files, options) {
+	const imports = files.map((f) => `import ${identifier(f, options.prefix)} from "${specifier(f)}";`);
+	const names = files.map((f) => identifier(f, options.prefix));
+	return `${HEADER}${options.typeImport}
+${imports.join("\n")}${imports.length ? "\n" : ""}
+export const ${options.exportName}: ${options.typeName}[] = [${names.join(", ")}];
+`;
+}
+async function writeIfChanged(path, content, written) {
+	if ((existsSync(path) ? await readFile(path, "utf8") : void 0) !== content) {
+		await writeFile(path, content);
+		written.push(path);
+	}
+}
+async function sync(project = loadProject()) {
+	const { root } = project;
+	const out = join(root, "src/generated");
+	await mkdir(out, { recursive: true });
+	const written = [];
+	const dirs = ["src/core/*", "src/modules/*"];
+	const routes = await find(root, dirs.map((d) => `${d}/routes/*.routes.ts`));
+	await writeIfChanged(join(out, "routes.ts"), listModule(routes, {
+		prefix: "routes",
+		typeImport: "import type { RouteDefinition } from \"#core/http/routes\";",
+		typeName: "RouteDefinition",
+		exportName: "routes"
+	}), written);
+	const commands = await find(root, dirs.map((d) => `${d}/commands/*.ts`));
+	await writeIfChanged(join(out, "commands.ts"), listModule(commands, {
+		prefix: "command",
+		typeImport: "import type { CommandDefinition } from \"#core/commands/define\";",
+		typeName: "CommandDefinition",
+		exportName: "commands"
+	}), written);
+	if (project.has("jobs")) {
+		const consumers = await find(root, dirs.map((d) => `${d}/consumers/*.ts`));
+		await writeIfChanged(join(out, "consumers.ts"), listModule(consumers, {
+			prefix: "consumer",
+			typeImport: "import type { ConsumerDefinition } from \"#core/jobs/define\";",
+			typeName: "ConsumerDefinition",
+			exportName: "consumers"
+		}), written);
+		const schedules = await find(root, dirs.map((d) => `${d}/schedules/*.ts`));
+		await writeIfChanged(join(out, "schedules.ts"), listModule(schedules, {
+			prefix: "schedule",
+			typeImport: "import type { ScheduleDefinition } from \"#core/jobs/define\";",
+			typeName: "ScheduleDefinition",
+			exportName: "schedules"
+		}), written);
+	}
+	if (project.has("authz")) {
+		const permissions = await find(root, ["src/modules/*/permissions/*.permissions.ts"]);
+		const imports = permissions.map((f) => `import ${identifier(f, "permissions")} from "${specifier(f)}";`);
+		const names = permissions.map((f) => identifier(f, "permissions"));
+		await writeIfChanged(join(out, "permissions.ts"), `${HEADER}import { mergeCatalogs, type PermissionKeysOf } from "#core/authz/catalog";
+import corePermissions from "#core/authz/permissions";
+${imports.join("\n")}${imports.length ? "\n" : ""}
+export const catalog = mergeCatalogs(corePermissions${names.map((n) => `, ${n}`).join("")});
+
+export type PermissionKey =
+	| PermissionKeysOf<typeof corePermissions>${names.map((n) => `\n\t| PermissionKeysOf<typeof ${n}>`).join("")};
+`, written);
+	}
+	if (project.config.database !== "none") {
+		const seeds = await find(root, dirs.map((d) => `${d}/db/seed.ts`));
+		await writeIfChanged(join(out, "seeds.ts"), listModule(seeds, {
+			prefix: "seed",
+			typeImport: "import type { SeedDefinition } from \"#core/db/seed\";",
+			typeName: "SeedDefinition",
+			exportName: "seeds"
+		}), written);
+	}
+	if (project.config.orm === "drizzle") {
+		const schemas = await find(root, dirs.map((d) => `${d}/db/*.schema.ts`));
+		await writeIfChanged(join(out, "schema.ts"), `${HEADER}${schemas.map((f) => `export * from "${specifier(f)}";`).join("\n")}\nexport {};\n`, written);
+	}
+	if (project.config.orm === "prisma") {
+		const bin = join(root, "node_modules/.bin/prisma");
+		if (existsSync(bin)) {
+			const result = await x(bin, ["generate"], {
+				nodeOptions: { cwd: root },
+				throwOnError: false
+			});
+			if (result.exitCode !== 0) throw new Error(`prisma generate failed:\n${result.stdout}${result.stderr}`);
+			written.push(join(out, "prisma"));
+		}
+	}
+	return { written };
+}
+//#endregion
+//#region src/commands/db.ts
+var DbError = class extends Error {};
+function requireDb(project) {
+	if (project.config.orm === "none") throw new DbError("This app has no database.");
+}
+async function dbGenerate(project, name = "change") {
+	requireDb(project);
+	await sync(project);
+	if (project.config.orm === "drizzle") return runBin(project, "drizzle-kit", [
+		"generate",
+		"--name",
+		name
+	]);
+	return runBin(project, "prisma", [
+		"migrate",
+		"dev",
+		"--create-only",
+		"--name",
+		name
+	]);
+}
+async function dbMigrate(project) {
+	requireDb(project);
+	await sync(project);
+	return runAppCli(project, ["db:migrate"]);
+}
+async function dbSeed(project) {
+	requireDb(project);
+	await sync(project);
+	return runAppCli(project, ["db:seed"]);
+}
+async function dbReset(project) {
+	requireDb(project);
+	await sync(project);
+	const code = await runAppCli(project, ["db:reset"]);
+	return code === 0 ? runAppCli(project, ["db:seed"]) : code;
+}
+async function dbStudio(project) {
+	requireDb(project);
+	console.log(pc.dim("Opening the database studio…"));
+	if (project.config.orm === "drizzle") return runBin(project, "drizzle-kit", ["studio"]);
+	return runBin(project, "prisma", ["studio"]);
+}
+//#endregion
+//#region src/pm.ts
+function pmCommands(pm) {
+	switch (pm) {
+		case "pnpm": return {
+			install: ["pnpm", "install"],
+			run: "pnpm",
+			exec: "pnpm exec",
+			lockfile: "pnpm-lock.yaml"
+		};
+		case "npm": return {
+			install: ["npm", "install"],
+			run: "npm run",
+			exec: "npx",
+			lockfile: "package-lock.json"
+		};
+		case "bun": return {
+			install: ["bun", "install"],
+			run: "bun run",
+			exec: "bunx",
+			lockfile: "bun.lock"
+		};
+	}
+}
+//#endregion
+//#region src/commands/verify.ts
+const VERIFY_STEPS = [
+	"lint",
+	"typecheck",
+	"test",
+	"build"
+];
+function runInherit(cmd, args, cwd, env) {
+	return new Promise((resolve) => {
+		const child = spawn(cmd, args, {
+			cwd,
+			stdio: "inherit",
+			env: {
+				...process.env,
+				...env
+			}
+		});
+		child.on("exit", (code) => resolve(code ?? 1));
+		child.on("error", () => resolve(1));
+	});
+}
+/** Runs lint, typecheck, test and build in order; stops at the first failure. */
+async function verify(project = loadProject()) {
+	const [cmd, ...prefix] = pmCommands(project.config.packageManager).run.split(" ");
+	for (const step of VERIFY_STEPS) {
+		console.log(pc.bold(pc.cyan(`\n▶ ${step}`)));
+		if (await runInherit(cmd ?? "npm", [...prefix, step], project.root) !== 0) {
+			console.log(pc.red(`\n✖ verify failed at "${step}"`));
+			return false;
+		}
+	}
+	console.log(pc.green("\n✔ verify passed (lint, typecheck, test, build)"));
+	return true;
+}
+//#endregion
+//#region src/commands/dev.ts
+function devProcesses(project) {
+	const list = [{
+		name: "api",
+		file: "src/apps/api/server.ts",
+		color: pc.cyan
+	}];
+	if (project.has("admin")) list.push({
+		name: "admin",
+		file: "src/apps/admin/server.ts",
+		color: pc.magenta
+	});
+	if (project.has("jobs")) {
+		list.push({
+			name: "worker",
+			file: "src/apps/worker/index.ts",
+			color: pc.yellow
+		});
+		list.push({
+			name: "cron",
+			file: "src/apps/cron/index.ts",
+			color: pc.blue
+		});
+	}
+	return list;
+}
+function readEnv(project) {
+	const file = join(project.root, ".env");
+	return existsSync(file) ? parseEnv(readFileSync(file, "utf8")) : {};
+}
+async function compose(project, args) {
+	if (!existsSync(join(project.root, "compose.yaml"))) return 0;
+	return runInherit("docker", ["compose", ...args], project.root);
+}
+function prefixed(child, label) {
+	for (const stream of [child.stdout, child.stderr]) {
+		let buffer = "";
+		stream?.on("data", (chunk) => {
+			buffer += chunk.toString();
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) process.stdout.write(`${label} ${line}\n`);
+		});
+	}
+}
+const CONVENTION = /\/(routes|commands|consumers|schedules|permissions|db)\/[^/]+\.ts$/;
+/** Re-runs `tatara sync` when convention files appear or disappear, so --watch picks them up. */
+function watchConventions(project) {
+	const watchers = [];
+	let timer;
+	for (const dir of [
+		"src/modules",
+		"src/core",
+		"prisma/models"
+	]) {
+		const full = join(project.root, dir);
+		if (!existsSync(full)) continue;
+		const watcher = watch(full, { recursive: true }, (_event, file) => {
+			if (!file || !(CONVENTION.test(`/${file}`) || file.endsWith(".prisma"))) return;
+			clearTimeout(timer);
+			timer = setTimeout(() => {
+				sync(project).catch((error) => console.error(pc.red(String(error))));
+			}, 150);
+		});
+		watchers.push(watcher);
+	}
+	return watchers;
+}
+async function dev(project, flags = {}) {
+	if (flags.down) return compose(project, ["down"]);
+	if (flags.reset && await compose(project, ["down", "--volumes"]) !== 0) return 1;
+	if (existsSync(join(project.root, "compose.yaml"))) {
+		console.log(pc.bold("▶ starting local services"));
+		if (await compose(project, [
+			"up",
+			"--detach",
+			"--wait"
+		]) !== 0) {
+			console.error(pc.red("Local services did not become healthy. Is Docker running? Try `tatara doctor`."));
+			return 1;
+		}
+	}
+	await sync(project);
+	if (project.has("db")) {
+		console.log(pc.bold("▶ migrating and seeding"));
+		if (await runAppCli(project, ["db:migrate"]) !== 0) return 1;
+		if (await runAppCli(project, ["db:seed"]) !== 0) return 1;
+	}
+	if (flags.prepare) return 0;
+	const env = readEnv(project);
+	const port = env.PORT ?? "3000";
+	const children = devProcesses(project).map((p) => {
+		const child = spawn(process.execPath, [
+			...NODE_FLAGS,
+			"--watch",
+			p.file
+		], {
+			cwd: project.root,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				FORCE_COLOR: "1"
+			}
+		});
+		prefixed(child, p.color(`[${p.name}]`.padEnd(8)));
+		return child;
+	});
+	const watchers = watchConventions(project);
+	const urls = [`API         http://localhost:${port}/api`, `Reference   http://localhost:${port}/docs`];
+	if (project.has("admin")) urls.push(`Admin API   http://localhost:${env.ADMIN_PORT ?? "3001"}/docs`);
+	if (project.has("email")) urls.push(`Mailpit     http://localhost:${env.MAILPIT_UI_PORT ?? "8025"}`);
+	if (project.has("storage")) urls.push(`Storage UI  http://localhost:${env.STORAGE_CONSOLE_PORT ?? "9001"}`);
+	if (project.has("keycloak")) urls.push(`Keycloak    http://localhost:${env.KEYCLOAK_PORT ?? "8080"}/admin (admin/admin)`);
+	console.log(`\n${urls.map((u) => `  ${pc.green("➜")} ${u}`).join("\n")}\n`);
+	return new Promise((resolve) => {
+		const stop = () => {
+			for (const watcher of watchers) watcher.close();
+			let running = children.filter((c) => c.exitCode === null).length;
+			if (running === 0) resolve(0);
+			for (const child of children) {
+				child.once("exit", () => {
+					running -= 1;
+					if (running <= 0) resolve(0);
+				});
+				child.kill("SIGTERM");
+			}
+			setTimeout(() => resolve(0), 5e3).unref();
+		};
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
+	});
+}
+//#endregion
+//#region src/commands/doctor.ts
+const PACKAGES = {
+	drizzle: ["drizzle-orm", "drizzle-kit"],
+	prisma: ["@prisma/client", "prisma"],
+	"better-auth": ["better-auth"],
+	keycloak: ["jose"],
+	jobs: ["bullmq", "ioredis"]
+};
+async function doctor(project) {
+	const checks = [];
+	const add = (c) => checks.push(c);
+	add({
+		name: "node",
+		ok: Number(process.versions.node.split(".")[0]) >= 24,
+		detail: `v${process.versions.node}`,
+		fix: "Install Node 24 or newer"
+	});
+	const pm = project.config.packageManager;
+	const pmVersion = await x(pm, ["--version"], { throwOnError: false });
+	add({
+		name: pm,
+		ok: pmVersion.exitCode === 0,
+		detail: pmVersion.exitCode === 0 ? pmVersion.stdout.trim() : "not found",
+		fix: pm === "pnpm" ? "corepack enable" : `Install ${pm}`
+	});
+	if (existsSync(join(project.root, "compose.yaml"))) {
+		const docker = await x("docker", [
+			"info",
+			"--format",
+			"{{.ServerVersion}}"
+		], { throwOnError: false });
+		add({
+			name: "docker",
+			ok: docker.exitCode === 0,
+			detail: docker.exitCode === 0 ? docker.stdout.trim() : "daemon not reachable",
+			fix: "Start Docker"
+		});
+		if (docker.exitCode === 0) {
+			const lines = (await x("docker", [
+				"compose",
+				"ps",
+				"--format",
+				"{{.Service}} {{.Health}}"
+			], {
+				nodeOptions: { cwd: project.root },
+				throwOnError: false
+			})).stdout.trim().split("\n").filter(Boolean);
+			const unhealthy = lines.filter((l) => !/ (healthy|)$/.test(l));
+			add({
+				name: "services",
+				ok: lines.length > 0 && unhealthy.length === 0,
+				detail: lines.length === 0 ? "not running" : lines.join(", "),
+				fix: "Run `dev` to start them"
+			});
+		}
+	}
+	const envPath = join(project.root, ".env");
+	if (!existsSync(envPath)) add({
+		name: ".env",
+		ok: false,
+		detail: "missing",
+		fix: "cp .env.example .env"
+	});
+	else {
+		const env = parseEnv(readFileSync(envPath, "utf8"));
+		const example = parseEnv(readFileSync(join(project.root, ".env.example"), "utf8"));
+		const missing = Object.keys(example).filter((k) => !(k in env));
+		add({
+			name: ".env",
+			ok: missing.length === 0,
+			detail: missing.length === 0 ? "matches .env.example" : `missing ${missing.join(", ")}`,
+			fix: "Copy the missing keys from .env.example"
+		});
+	}
+	const pkg = JSON.parse(readFileSync(join(project.root, "package.json"), "utf8"));
+	const installed = {
+		...pkg.dependencies,
+		...pkg.devDependencies
+	};
+	const absent = Object.entries(PACKAGES).flatMap(([feature, pkgs]) => project.has(feature) ? pkgs : []).filter((p) => !(p in installed));
+	add({
+		name: "tatara.json",
+		ok: absent.length === 0,
+		detail: absent.length === 0 ? "matches package.json" : `package.json lacks ${absent.join(", ")}`,
+		fix: "Reinstall the missing packages"
+	});
+	const violations = await check(project);
+	add({
+		name: "layout",
+		ok: violations.length === 0,
+		detail: violations.length === 0 ? "clean" : `${violations.length} violation(s)`,
+		fix: "Run `tatara check` for details"
+	});
+	return checks;
+}
+function printDoctor(checks) {
+	for (const c of checks) {
+		const mark = c.ok ? pc.green("✔") : pc.red("✖");
+		console.log(`${mark} ${c.name.padEnd(12)} ${c.detail}${c.ok || !c.fix ? "" : pc.dim(`  → ${c.fix}`)}`);
+	}
+}
+//#endregion
+//#region src/paths.ts
+/** Package root: one level above both src/ (dev) and dist/ (published, bundled). */
+const PACKAGE_ROOT = resolve(import.meta.dirname, "..");
+const TEMPLATES_DIR = resolve(PACKAGE_ROOT, "templates");
+function cliVersion() {
+	return JSON.parse(readFileSync(resolve(PACKAGE_ROOT, "package.json"), "utf8")).version;
+}
+let versions;
+/** Exact versions used in generated apps (templates/versions.json). */
+function templateVersions() {
+	versions ??= JSON.parse(readFileSync(resolve(TEMPLATES_DIR, "versions.json"), "utf8"));
+	return versions;
+}
+function versionOf(pkg) {
+	if (pkg === "@tatara/cli") return process.env.TATARA_CLI_SPEC ?? `^${cliVersion()}`;
+	const version = templateVersions()[pkg];
+	if (!version) throw new Error(`templates/versions.json has no version for "${pkg}"`);
+	return version;
+}
+const authz = {
+	id: "authz",
+	kind: "addon",
+	label: "Permission system",
+	slots: [
+		{
+			file: "tests/helpers/auth.ts",
+			slot: "imports",
+			content: "import { applyTestAccess, type TestAccess } from \"#tests/helpers/authz\";"
+		},
+		{
+			file: "tests/helpers/auth.ts",
+			slot: "options",
+			content: "permissions?: TestAccess[\"permissions\"];\nsystemRoles?: TestAccess[\"systemRoles\"];"
+		},
+		{
+			file: "tests/helpers/auth.ts",
+			slot: "options",
+			when: ["better-auth"],
+			content: "orgId?: string;"
+		},
+		{
+			file: "tests/helpers/auth.ts",
+			slot: "as-user",
+			content: "await applyTestAccess(user.userId, options);"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Permissions (authz)
+
+- Permissions are \`resource:action\` (optionally scoped \`own | team | org\`, where a wider scope
+  satisfies a narrower one). Each module declares its resources and the grants built-in roles get
+  in \`permissions/<name>.permissions.ts\` (\`definePermissions\`); \`tatara sync\` merges them into a
+  typed catalog.
+- Guard routes with \`middleware: [requirePermission("project:read")]\` from \`#core/authz/middleware\`
+  and declare \`security: [{ bearerAuth: ["project:read"] }]\`. For scoped actions, call
+  \`resolveScope(principal, "doc:read")\` in the service and filter rows by the returned scope.
+- Effective permissions = role grants (assigned roles + built-in roles whose key matches an
+  identity-provider role) + grant overlays − deny overlays. Deny always wins.
+- Custom roles and grant overlays can never grant \`role\`, \`member\` or \`audit_log\`.
+- Built-in roles live in \`src/core/authz/system-roles.ts\`. Run \`__PM_EXEC__ tatara run authz:sync-permissions\`
+  on every deploy (it is idempotent); \`db:seed\` runs it locally.
+- In tests: \`asUser({ permissions: ["project:read"] })\` or \`asUser({ systemRoles: ["admin"] })\`.
+`
+		}
+	]
+};
+const jobs = {
+	id: "jobs",
+	kind: "addon",
+	label: "Jobs + cron (BullMQ)",
+	dependencies: [
+		"bullmq",
+		"ioredis",
+		"croner"
+	],
+	allowBuilds: ["msgpackr-extract"],
+	scripts: {
+		"start:worker": "node dist/apps/worker/index.mjs",
+		"start:cron": "node dist/apps/cron/index.mjs"
+	},
+	env: [
+		{
+			key: "REDIS_PORT",
+			schema: "",
+			example: "6379",
+			composeOnly: true,
+			comment: "Host port for local Redis"
+		},
+		{
+			key: "REDIS_URL",
+			schema: "z.url()",
+			example: "redis://localhost:6379/0"
+		},
+		{
+			key: "JOBS_PREFIX",
+			schema: "z.string().default(\"bull\")",
+			example: "bull",
+			comment: "Redis key prefix for queues"
+		},
+		{
+			key: "WORKER_CONCURRENCY",
+			schema: "z.coerce.number().int().positive().default(5)",
+			example: "5"
+		}
+	],
+	compose: { redis: {
+		image: "redis:8-alpine",
+		ports: ["${REDIS_PORT:-6379}:6379"],
+		healthcheck: {
+			test: [
+				"CMD",
+				"redis-cli",
+				"ping"
+			],
+			interval: "2s",
+			timeout: "3s",
+			retries: 30
+		}
+	} },
+	slots: [
+		{
+			file: "tsdown.config.ts",
+			slot: "entries",
+			content: "\"apps/worker/index\": \"src/apps/worker/index.ts\",\n\"apps/cron/index\": \"src/apps/cron/index.ts\","
+		},
+		{
+			file: "tests/setup.ts",
+			slot: "setup",
+			content: [
+				"",
+				"// One Redis database per worker.",
+				"if (process.env.REDIS_URL) {",
+				"	const redisUrl = new URL(process.env.REDIS_URL);",
+				"	redisUrl.pathname = `/${process.env.VITEST_POOL_ID ?? \"1\"}`;",
+				"	process.env.REDIS_URL = redisUrl.toString();",
+				"}"
+			].join("\n")
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Jobs and schedules
+
+- Background work: \`enqueue(topic, payload)\` from \`#core/jobs/queue\`; a module handles it in
+  \`consumers/<name>.ts\` (\`defineConsumer({ topic, schema, handle })\`). Payloads are validated by the
+  consumer's zod schema. Handlers must be idempotent: jobs retry.
+- Recurring work: \`schedules/<name>.ts\` (\`defineSchedule({ name, cron, run })\`). A Redis lock makes
+  each tick run once across every cron process.
+- Processes: \`apps/worker\` runs consumers, \`apps/cron\` runs schedules. \`dev\` starts both.
+`
+		}
+	]
+};
+const admin = {
+	id: "admin",
+	kind: "addon",
+	label: "Admin API app",
+	scripts: { "start:admin": "node dist/apps/admin/server.mjs" },
+	env: [{
+		key: "ADMIN_PORT",
+		schema: "z.coerce.number().int().default(3001)",
+		example: "3001"
+	}],
+	slots: [
+		{
+			file: "src/core/http/routes.ts",
+			slot: "app-names",
+			content: "\"admin\","
+		},
+		{
+			file: "tsdown.config.ts",
+			slot: "entries",
+			content: "\"apps/admin/server\": \"src/apps/admin/server.ts\","
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { requireRole } from \"#core/auth/middleware\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "routes",
+			order: 5,
+			content: "if (name === \"admin\") app.use(`${API_PREFIX}/*`, requireRole(\"admin\"));"
+		},
+		{
+			file: "tests/helpers/api.ts",
+			slot: "imports",
+			content: "import { app as adminApp } from \"#apps/admin/app\";"
+		},
+		{
+			file: "tests/helpers/api.ts",
+			slot: "exports",
+			content: "\n/** Calls the admin app in-process. */\nexport const adminApi = client(adminApp);"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Admin app
+
+- \`apps/admin\` is a second HTTP app on \`ADMIN_PORT\`. Routes with \`defineRoutes({ app: "admin", … })\`
+  are served only there, and every \`/api\` route on it requires the \`admin\` role.
+- Test it with \`adminApi\` from \`#tests/helpers/api\`.
+`
+		}
+	]
+};
+const storage = {
+	id: "storage",
+	kind: "addon",
+	label: "File storage",
+	dependencies: ["@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner"],
+	env: [
+		{
+			key: "STORAGE_DRIVER",
+			schema: "localDefault(z.enum([\"local\", \"s3\"]), \"local\")",
+			example: "s3",
+			test: "local"
+		},
+		{
+			key: "STORAGE_LOCAL_DIR",
+			schema: "z.string().default(\".storage\")",
+			example: ".storage"
+		},
+		{
+			key: "S3_ENDPOINT",
+			schema: "z.url().optional()",
+			example: "http://localhost:9000",
+			comment: "Empty for AWS S3"
+		},
+		{
+			key: "S3_REGION",
+			schema: "z.string().default(\"us-east-1\")",
+			example: "us-east-1"
+		},
+		{
+			key: "S3_BUCKET",
+			schema: "z.string().default(\"__APP_NAME__\")",
+			example: "__APP_NAME__"
+		},
+		{
+			key: "S3_ACCESS_KEY_ID",
+			schema: "z.string().optional()",
+			example: "tatara"
+		},
+		{
+			key: "S3_SECRET_ACCESS_KEY",
+			schema: "z.string().optional()",
+			example: "tatara-secret"
+		},
+		{
+			key: "S3_FORCE_PATH_STYLE",
+			schema: "z.stringbool().default(true)",
+			example: "true"
+		},
+		{
+			key: "STORAGE_PORT",
+			schema: "",
+			example: "9000",
+			composeOnly: true
+		},
+		{
+			key: "STORAGE_CONSOLE_PORT",
+			schema: "",
+			example: "9001",
+			composeOnly: true
+		}
+	],
+	compose: { storage: {
+		image: "rustfs/rustfs:1.0.1",
+		environment: {
+			RUSTFS_ACCESS_KEY: "tatara",
+			RUSTFS_SECRET_KEY: "tatara-secret",
+			RUSTFS_CONSOLE_ENABLE: "true"
+		},
+		ports: ["${STORAGE_PORT:-9000}:9000", "${STORAGE_CONSOLE_PORT:-9001}:9001"],
+		volumes: ["storage-data:/data"],
+		healthcheck: {
+			test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:9000/health || exit 1"],
+			interval: "2s",
+			timeout: "3s",
+			retries: 30
+		}
+	} },
+	composeVolumes: ["storage-data"],
+	slots: [
+		{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 50,
+			content: "RUN mkdir -p .storage && chown node:node .storage"
+		},
+		{
+			file: ".gitignore",
+			slot: "ignore",
+			content: ".storage/"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Storage
+
+- Use \`storage\` from \`#core/storage/index\` (\`put\`, \`get\`, \`delete\`, \`url\`). \`STORAGE_DRIVER=s3\` works with
+  any S3-compatible store (RustFS locally, AWS S3, R2); \`local\` writes to \`STORAGE_LOCAL_DIR\` (tests).
+- \`tatara run storage:check\` creates the bucket and does a round-trip.
+`
+		}
+	]
+};
+const email = {
+	id: "email",
+	kind: "addon",
+	label: "Email",
+	dependencies: ["nodemailer"],
+	devDependencies: ["@types/nodemailer"],
+	env: [
+		{
+			key: "EMAIL_DRIVER",
+			schema: "localDefault(z.enum([\"smtp\", \"console\"]), \"console\")",
+			example: "smtp",
+			test: "console"
+		},
+		{
+			key: "SMTP_URL",
+			schema: "localDefault(z.string(), \"smtp://localhost:1025\")",
+			example: "smtp://localhost:1025"
+		},
+		{
+			key: "EMAIL_FROM",
+			schema: "z.string().default(\"__APP_NAME__ <no-reply@example.com>\")",
+			example: "__APP_NAME__ <no-reply@example.com>"
+		},
+		{
+			key: "MAILPIT_SMTP_PORT",
+			schema: "",
+			example: "1025",
+			composeOnly: true
+		},
+		{
+			key: "MAILPIT_UI_PORT",
+			schema: "",
+			example: "8025",
+			composeOnly: true
+		}
+	],
+	compose: { mailpit: {
+		image: "axllent/mailpit:v1.31",
+		ports: ["${MAILPIT_SMTP_PORT:-1025}:1025", "${MAILPIT_UI_PORT:-8025}:8025"],
+		healthcheck: {
+			test: [
+				"CMD",
+				"/mailpit",
+				"readyz"
+			],
+			interval: "2s",
+			timeout: "3s",
+			retries: 30
+		}
+	} },
+	slots: [{
+		file: "AGENTS.md",
+		slot: "sections",
+		content: `## Email
+
+- \`sendEmail({ to, subject, text, html? })\` from \`#core/email/send\`. Locally it goes to Mailpit
+  (UI on \`MAILPIT_UI_PORT\`); tests use the console driver.
+`
+	}]
+};
+const i18n = {
+	id: "i18n",
+	kind: "addon",
+	label: "i18n",
+	env: [{
+		key: "DEFAULT_LANGUAGE",
+		schema: "z.enum([\"en\", \"ar\"]).default(\"en\")",
+		example: "en"
+	}],
+	slots: [
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { detectLanguage } from \"#core/i18n/index\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "middleware",
+			order: 10,
+			content: "app.use(detectLanguage);"
+		},
+		{
+			file: "src/core/http/middleware/error-handler.ts",
+			slot: "imports",
+			content: "import { t } from \"#core/i18n/index\";"
+		},
+		{
+			file: "src/core/http/middleware/error-handler.ts",
+			slot: "error-message",
+			content: "if (err.translatable) message = t(c.get(\"language\"), `errors.${err.code}`, message);"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## i18n
+
+- Language comes from \`?lang\`, the \`lang\` cookie, then \`Accept-Language\` (\`c.var.language\`).
+- Strings live in \`src/locales/<lang>.json\`; use \`t(language, "errors.NOT_FOUND")\`. Error responses are
+  translated by code (\`errors.<CODE>\`), so add a key when you add an error code.
+`
+		}
+	]
+};
+/** Provider-neutral auth: the principal contract, guards and GET /api/me. */
+const auth = {
+	id: "auth",
+	kind: "auth",
+	label: "Auth (shared)",
+	slots: [
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { attachPrincipal } from \"#core/auth/principal\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "middleware",
+			order: 50,
+			content: "app.use(attachPrincipal);"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "routes",
+			order: 0,
+			content: [
+				"app.openAPIRegistry.registerComponent(\"securitySchemes\", \"bearerAuth\", {",
+				"	type: \"http\",",
+				"	scheme: \"bearer\",",
+				"});"
+			].join("\n")
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Auth
+
+- \`c.var.principal\` is set for every request with valid credentials: \`{ userId, orgId, roles, kind }\`.
+- Protect routes with \`middleware: [requireAuth()]\` or \`requireRole("admin")\` from
+  \`#core/auth/middleware\`, and declare \`security: [{ bearerAuth: [] }]\` so the route is
+  documented as protected. Read the caller with \`currentPrincipal(c)\`.
+- In tests, \`asUser()\` from \`#tests/helpers/auth\` returns headers for a fresh authenticated user.
+`
+		}
+	]
+};
+const BETTER_AUTH_AGENTS = `### better-auth
+
+- Endpoints are served at \`/api/auth/*\` and listed in \`/openapi.json\` and \`/docs\` under the Auth tag
+  (schemas prefixed \`Auth\`). better-auth's own reference is also at \`/api/auth/reference\`.
+- Sessions work as cookies (browsers) and as \`Authorization: Bearer <session token>\` (mobile, APIs).
+- Outside production, every email and SMS is kept in an in-memory outbox:
+  \`GET /api/dev/outbox?to=<address>\` returns the latest messages, including sign-in codes.
+- To send real SMS, implement \`SmsSender\` in \`src/core/auth/sms.ts\`.
+`;
+const drizzlePg = ["drizzle", "postgres"];
+const drizzleMy = ["drizzle", "mysql"];
+const betterAuth = {
+	id: "better-auth",
+	kind: "auth",
+	label: "better-auth",
+	dependencies: ["better-auth"],
+	env: [
+		{
+			key: "BETTER_AUTH_SECRET",
+			schema: "z.string().min(32)",
+			example: "replace-with-a-long-random-secret-at-least-32-chars",
+			secret: true
+		},
+		{
+			key: "DEV_OUTBOX",
+			schema: "z.stringbool().default(false)",
+			example: "false",
+			dev: "true",
+			test: "true",
+			comment: "Keep emails/SMS (with sign-in codes) readable at /api/dev/outbox. Development only."
+		},
+		{
+			key: "SEED_ADMIN_EMAIL",
+			schema: "z.email().default(\"admin@example.com\")",
+			example: "admin@example.com",
+			comment: "Development admin created by `db:seed` (never in production)"
+		}
+	],
+	slots: [
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { auth } from \"#core/auth/auth\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { outboxEnabled, readOutbox } from \"#core/auth/delivery\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "imports",
+			content: "import { mergeAuthOpenApi } from \"#core/auth/openapi\";"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "openapi",
+			content: "if (name === \"api\") await mergeAuthOpenApi(document, `${API_PREFIX}/auth`);"
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "routes",
+			order: 1,
+			content: [
+				"if (name === \"api\") {",
+				"	app.on([\"GET\", \"POST\"], `${API_PREFIX}/auth/*`, (c) => auth.handler(c.req.raw));",
+				"	if (outboxEnabled()) {",
+				"		app.get(`${API_PREFIX}/dev/outbox`, (c) => c.json({ messages: readOutbox(c.req.query(\"to\")) }));",
+				"	}",
+				"}"
+			].join("\n")
+		},
+		{
+			file: "src/core/auth/delivery.ts",
+			slot: "email-delivery",
+			unless: ["email"],
+			content: "logger.info({ to: message.to, subject: message.subject }, \"email not sent: no email provider configured\");"
+		},
+		{
+			file: "src/core/auth/delivery.ts",
+			slot: "imports",
+			unless: ["email"],
+			content: "import { logger } from \"#core/logging/logger\";"
+		},
+		{
+			file: "src/core/auth/delivery.ts",
+			slot: "imports",
+			when: ["email"],
+			content: "import { sendEmail } from \"#core/email/send\";"
+		},
+		{
+			file: "src/core/auth/delivery.ts",
+			slot: "email-delivery",
+			when: ["email"],
+			content: "await sendEmail({ to: message.to, subject: message.subject, text: message.text });"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: BETTER_AUTH_AGENTS
+		}
+	]
+};
+const authEmailOtp = {
+	id: "auth-email-otp",
+	kind: "auth-method",
+	label: "Email OTP",
+	slots: [
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { deliverEmail } from \"#core/auth/delivery\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { emailOTP } from \"better-auth/plugins\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "plugins",
+			content: [
+				"emailOTP({",
+				"	async sendVerificationOTP({ email, otp, type }) {",
+				"		await deliverEmail({",
+				"			to: email,",
+				"			subject: \"Your sign-in code\",",
+				"			text: `Your ${type} code is ${otp}. It expires in 5 minutes.`,",
+				"			code: otp,",
+				"		});",
+				"	},",
+				"}),"
+			].join("\n")
+		}
+	]
+};
+const phoneFields = [
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "user-fields",
+		when: drizzlePg,
+		content: "phoneNumber: text().unique(),\nphoneNumberVerified: boolean(),"
+	},
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "user-fields",
+		when: drizzleMy,
+		content: "phoneNumber: varchar({ length: 32 }).unique(),\nphoneNumberVerified: boolean(),"
+	},
+	{
+		file: "prisma/models/auth.prisma",
+		slot: "user-fields",
+		content: ["phoneNumber         String?  @unique @map(\"phone_number\") @db.VarChar(32)", "phoneNumberVerified Boolean? @map(\"phone_number_verified\")"].join("\n")
+	}
+];
+const authPhoneOtp = {
+	id: "auth-phone-otp",
+	kind: "auth-method",
+	label: "Phone OTP",
+	slots: [
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { deliverSms } from \"#core/auth/delivery\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { phoneNumber } from \"better-auth/plugins\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "plugins",
+			content: [
+				"phoneNumber({",
+				"	async sendOTP({ phoneNumber: to, code }) {",
+				"		await deliverSms({ to, text: `Your sign-in code is ${code}`, code });",
+				"	},",
+				"	signUpOnVerification: {",
+				"		getTempEmail: (phone) => `${phone.replace(/\\D/g, \"\")}@phone.invalid`,",
+				"		getTempName: (phone) => phone,",
+				"	},",
+				"}),"
+			].join("\n")
+		},
+		...phoneFields
+	]
+};
+const authPassword = {
+	id: "auth-password",
+	kind: "auth-method",
+	label: "Email + password",
+	env: [{
+		key: "SEED_ADMIN_PASSWORD",
+		schema: "z.string().min(10).optional()",
+		example: "",
+		secret: true,
+		comment: "Password for the development admin (generated by tatara new)"
+	}],
+	slots: [
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { deliverEmail } from \"#core/auth/delivery\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "options",
+			content: [
+				"emailAndPassword: {",
+				"	enabled: true,",
+				"	minPasswordLength: 10,",
+				"	async sendResetPassword({ user, url }) {",
+				"		await deliverEmail({ to: user.email, subject: \"Reset your password\", text: `Reset your password: ${url}` });",
+				"	},",
+				"},"
+			].join("\n")
+		},
+		{
+			file: "src/core/auth/db/seed.ts",
+			slot: "seed-after-user",
+			content: [
+				"if (env.SEED_ADMIN_PASSWORD) {",
+				"	await ctx.internalAdapter.linkAccount({",
+				"		userId: user.id,",
+				"		providerId: \"credential\",",
+				"		accountId: user.id,",
+				"		password: await ctx.password.hash(env.SEED_ADMIN_PASSWORD),",
+				"	});",
+				"}"
+			].join("\n")
+		}
+	]
+};
+const adminFields = [
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "user-fields",
+		when: drizzlePg,
+		content: "role: text(),\nbanned: boolean().default(false),\nbanReason: text(),\nbanExpires: timestamp({ withTimezone: true, mode: \"date\" }),"
+	},
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "user-fields",
+		when: drizzleMy,
+		content: "role: varchar({ length: 255 }),\nbanned: boolean().default(false),\nbanReason: text(),\nbanExpires: timestamp({ fsp: 3, mode: \"date\" }),"
+	},
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "session-fields",
+		when: drizzlePg,
+		content: "activeOrganizationId: text(),\nimpersonatedBy: text(),"
+	},
+	{
+		file: "src/core/auth/db/auth.schema.ts",
+		slot: "session-fields",
+		when: drizzleMy,
+		content: "activeOrganizationId: varchar({ length: 36 }),\nimpersonatedBy: varchar({ length: 36 }),"
+	},
+	{
+		file: "prisma/models/auth.prisma",
+		slot: "user-fields",
+		content: [
+			"role       String?   @db.VarChar(255)",
+			"banned     Boolean?  @default(false)",
+			"banReason  String?   @map(\"ban_reason\") @db.Text",
+			"banExpires DateTime? @map(\"ban_expires\")"
+		].join("\n")
+	},
+	{
+		file: "prisma/models/auth.prisma",
+		slot: "user-relations",
+		content: "members     Member[]\ninvitations Invitation[]"
+	},
+	{
+		file: "prisma/models/auth.prisma",
+		slot: "session-fields",
+		content: ["activeOrganizationId String? @map(\"active_organization_id\") @db.VarChar(36)", "impersonatedBy       String? @map(\"impersonated_by\") @db.VarChar(36)"].join("\n")
+	},
+	{
+		file: "src/core/auth/adapter.ts",
+		slot: "imports",
+		when: ["drizzle"],
+		content: "import * as orgSchema from \"#core/auth/db/organization.schema\";"
+	},
+	{
+		file: "src/core/auth/adapter.ts",
+		slot: "adapter-schema",
+		when: ["drizzle"],
+		content: "organization: orgSchema.organizations,\nmember: orgSchema.members,\ninvitation: orgSchema.invitations,"
+	}
+];
+const authOrgs = {
+	id: "auth-orgs",
+	kind: "auth-method",
+	label: "Organizations + roles",
+	slots: [
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { admin, organization } from \"better-auth/plugins\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "plugins",
+			unless: ["authz"],
+			content: "organization(),\nadmin(),",
+			order: 900
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "plugins",
+			when: ["authz"],
+			content: [
+				"organization({",
+				"	organizationHooks: {",
+				"		// authz rows outlive better-auth's member row; without this, re-adding restores old roles",
+				"		afterRemoveMember: async ({ member }) => {",
+				"			await removeMemberAccess(member.organizationId, member.userId);",
+				"		},",
+				"	},",
+				"}),",
+				"admin(),"
+			].join("\n"),
+			order: 900
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			when: ["authz"],
+			content: "import { removeMemberAccess } from \"#core/authz/services/members\";"
+		},
+		{
+			file: "tests/helpers/auth.ts",
+			slot: "user-fields",
+			content: "...(options.roles ? { role: options.roles.join(\",\") } : {}),"
+		},
+		{
+			file: "src/core/auth/db/seed.ts",
+			slot: "seed-user-fields",
+			content: "role: \"admin\","
+		},
+		...adminFields
+	]
+};
+const keycloak = {
+	id: "keycloak",
+	kind: "auth",
+	label: "Keycloak",
+	dependencies: ["jose"],
+	env: [
+		{
+			key: "KEYCLOAK_PORT",
+			schema: "",
+			example: "8080",
+			composeOnly: true,
+			comment: "Host port for the local Keycloak container"
+		},
+		{
+			key: "KEYCLOAK_URL",
+			schema: "localDefault(z.url(), \"http://localhost:8080\")",
+			example: "http://localhost:8080"
+		},
+		{
+			key: "KEYCLOAK_REALM",
+			schema: "z.string().default(\"__APP_NAME__\")",
+			example: "__APP_NAME__"
+		},
+		{
+			key: "KEYCLOAK_AUDIENCE",
+			schema: "z.string().default(\"__APP_NAME__-api\")",
+			example: "__APP_NAME__-api",
+			comment: "Tokens must carry this audience"
+		}
+	],
+	compose: { keycloak: {
+		image: "quay.io/keycloak/keycloak:26.8.1",
+		command: ["start-dev", "--import-realm"],
+		environment: {
+			KC_BOOTSTRAP_ADMIN_USERNAME: "admin",
+			KC_BOOTSTRAP_ADMIN_PASSWORD: "admin",
+			KC_HEALTH_ENABLED: "true",
+			KC_HOSTNAME: "http://localhost:${KEYCLOAK_PORT:-8080}"
+		},
+		ports: ["${KEYCLOAK_PORT:-8080}:8080"],
+		volumes: ["./keycloak:/opt/keycloak/data/import:ro"],
+		healthcheck: {
+			test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '200 OK' <&3"],
+			interval: "5s",
+			timeout: "5s",
+			retries: 60,
+			start_period: "10s"
+		}
+	} },
+	slots: [
+		{
+			file: "src/core/auth/users.ts",
+			slot: "upsert",
+			when: ["drizzle", "postgres"],
+			content: "await db\n	.insert(users)\n	.values(values)\n	.onConflictDoUpdate({ target: users.id, set: { email: values.email, name: values.name, updatedAt: new Date() } });"
+		},
+		{
+			file: "src/core/auth/users.ts",
+			slot: "upsert",
+			when: ["drizzle", "mysql"],
+			content: "await db\n	.insert(users)\n	.values(values)\n	.onDuplicateKeyUpdate({ set: { email: values.email, name: values.name } });"
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `### Keycloak
+
+- The API is a resource server: it verifies Keycloak access tokens (signature, issuer,
+  audience \`__APP_NAME__-api\`, expiry). Login happens in the frontend via OIDC (PKCE) against
+  the \`__APP_NAME__-web\` client.
+- Roles come from the token's \`roles\` claim (realm roles) and client roles for the API.
+- Local dev realm: \`keycloak/realm.json\` (users alice/alice with admin, bob/bob).
+  \`__PM_EXEC__ tatara run keycloak:token --user alice\` prints a token for curl.
+- Tests sign tokens with a local key; see \`#tests/helpers/auth\`.
+`
+		}
+	]
+};
+//#endregion
+//#region src/features/base.ts
+const base = {
+	id: "base",
+	kind: "base",
+	label: "Hono API",
+	dependencies: [
+		"hono",
+		"@hono/node-server",
+		"@hono/zod-openapi",
+		"@scalar/hono-api-reference",
+		"zod",
+		"@t3-oss/env-core",
+		"pino"
+	],
+	devDependencies: [
+		"@tatara/cli",
+		"typescript",
+		"@types/node",
+		"vitest",
+		"tsdown",
+		"@biomejs/biome",
+		"pino-pretty"
+	],
+	scripts: {
+		dev: "tatara dev",
+		"dev:down": "tatara dev --down",
+		"dev:reset": "tatara dev --reset",
+		build: "tatara sync && tsdown",
+		start: "node dist/apps/api/server.mjs",
+		lint: "biome check . && tatara check",
+		format: "biome check --write .",
+		typecheck: "tatara sync && tsc",
+		test: "tatara sync && vitest run",
+		"test:watch": "tatara sync && vitest",
+		verify: "tatara verify"
+	},
+	env: [
+		{
+			key: "NODE_ENV",
+			schema: "z.enum([\"development\", \"test\", \"production\"])",
+			example: "development",
+			test: "test"
+		},
+		{
+			key: "PORT",
+			schema: "z.coerce.number().int().default(3000)",
+			example: "3000"
+		},
+		{
+			key: "LOG_LEVEL",
+			schema: "z.enum([\"fatal\", \"error\", \"warn\", \"info\", \"debug\", \"trace\", \"silent\"]).default(\"info\")",
+			example: "info",
+			test: "silent"
+		},
+		{
+			key: "APP_URL",
+			schema: "localDefault(z.url(), \"http://localhost:3000\")",
+			example: "http://localhost:3000",
+			comment: "Public URL of the API"
+		},
+		{
+			key: "CORS_ORIGINS",
+			schema: "localDefault(z.string(), \"http://localhost:5173\").transform((v) => v.split(\",\").map((o) => o.trim()).filter(Boolean))",
+			example: "http://localhost:5173",
+			comment: "Comma-separated browser origins allowed to call the API"
+		},
+		{
+			key: "BODY_LIMIT_BYTES",
+			schema: "z.coerce.number().int().positive().default(1_048_576)",
+			example: "1048576"
+		}
+	],
+	entrypoints: [{
+		name: "api",
+		file: "server.ts",
+		description: "HTTP API"
+	}, {
+		name: "cli",
+		file: "index.ts",
+		description: "App commands"
+	}]
+};
+const pnpm = {
+	id: "pm-pnpm",
+	kind: "base",
+	label: "pnpm",
+	slots: [
+		{
+			file: "Dockerfile",
+			slot: "docker-base",
+			content: "RUN corepack enable"
+		},
+		{
+			file: "Dockerfile",
+			slot: "docker-build",
+			content: [
+				"COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./",
+				"RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store --mount=type=cache,id=pnpm-cache,target=/root/.cache/pnpm pnpm install --frozen-lockfile",
+				"COPY . .",
+				"RUN pnpm run build"
+			].join("\n")
+		},
+		{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 0,
+			content: [
+				"COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./",
+				"# cache mounts keep the package store out of the image",
+				"RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store --mount=type=cache,id=pnpm-cache,target=/root/.cache/pnpm pnpm install --frozen-lockfile --prod",
+				"COPY --from=build /app/dist ./dist"
+			].join("\n")
+		},
+		{
+			file: ".github/workflows/ci.yml",
+			slot: "ci-setup",
+			content: [
+				"- uses: pnpm/action-setup@v4",
+				"- uses: actions/setup-node@v5",
+				"  with:",
+				"    node-version: 24",
+				"    cache: pnpm",
+				"- run: pnpm install --frozen-lockfile"
+			].join("\n")
+		}
+	]
+};
+const npm = {
+	id: "pm-npm",
+	kind: "base",
+	label: "npm",
+	slots: [
+		{
+			file: "Dockerfile",
+			slot: "docker-build",
+			content: [
+				"COPY package.json package-lock.json ./",
+				"RUN --mount=type=cache,target=/root/.npm npm ci",
+				"COPY . .",
+				"RUN npm run build"
+			].join("\n")
+		},
+		{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 0,
+			content: [
+				"COPY package.json package-lock.json ./",
+				"RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev",
+				"COPY --from=build /app/dist ./dist"
+			].join("\n")
+		},
+		{
+			file: ".github/workflows/ci.yml",
+			slot: "ci-setup",
+			content: [
+				"- uses: actions/setup-node@v5",
+				"  with:",
+				"    node-version: 24",
+				"    cache: npm",
+				"- run: npm ci"
+			].join("\n")
+		}
+	]
+};
+const bun = {
+	id: "pm-bun",
+	kind: "base",
+	label: "bun",
+	slots: [
+		{
+			file: "Dockerfile",
+			slot: "docker-base",
+			content: "RUN npm install --global bun"
+		},
+		{
+			file: "Dockerfile",
+			slot: "docker-build",
+			content: [
+				"COPY package.json bun.lock ./",
+				"RUN --mount=type=cache,target=/root/.bun/install/cache bun install --frozen-lockfile",
+				"COPY . .",
+				"RUN bun run build"
+			].join("\n")
+		},
+		{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 0,
+			content: [
+				"COPY package.json bun.lock ./",
+				"RUN --mount=type=cache,target=/root/.bun/install/cache bun install --frozen-lockfile --production",
+				"COPY --from=build /app/dist ./dist"
+			].join("\n")
+		},
+		{
+			file: ".github/workflows/ci.yml",
+			slot: "ci-setup",
+			content: [
+				"- uses: oven-sh/setup-bun@v2",
+				"- uses: actions/setup-node@v5",
+				"  with:",
+				"    node-version: 24",
+				"- run: bun install --frozen-lockfile"
+			].join("\n")
+		}
+	]
+};
+const db$1 = {
+	id: "db",
+	kind: "database",
+	label: "Database (shared)",
+	scripts: {
+		"db:generate": "tatara db generate",
+		"db:migrate": "tatara db migrate",
+		"db:seed": "tatara db seed",
+		"db:reset": "tatara db reset",
+		"db:studio": "tatara db studio"
+	},
+	env: [{
+		key: "DATABASE_POOL_MAX",
+		schema: "z.coerce.number().int().positive().default(10)",
+		example: "10"
+	}],
+	slots: [
+		{
+			file: "vitest.config.ts",
+			slot: "vitest",
+			content: "globalSetup: [\"tests/global-setup.ts\"],\nmaxWorkers: 4,\nfileParallelism: true,"
+		},
+		{
+			file: "tests/setup.ts",
+			slot: "setup",
+			content: [
+				"import { workerDatabaseUrl } from \"#tests/helpers/database-url\";",
+				"",
+				"// One database per worker, created by tests/global-setup.ts.",
+				"process.env.DATABASE_URL = workerDatabaseUrl(process.env.DATABASE_URL ?? \"\", process.env.VITEST_POOL_ID ?? \"1\");"
+			].join("\n")
+		},
+		{
+			file: "AGENTS.md",
+			slot: "sections",
+			content: `## Database
+
+- Tables live in \`src/<core|modules>/<area>/db/<name>.schema.ts\` (Drizzle) or
+  \`prisma/models/<name>.prisma\` (Prisma), one file per table. \`tatara make schema\` creates one.
+- Services take an \`Executor\` (\`db\` or a transaction) as their first argument when they
+  write, so callers can run several services in one transaction.
+- Change the schema, then generate a migration: \`__PM_EXEC__ tatara db generate --name <change>\`.
+  Never edit an applied migration; add a new one.
+- Seeds (\`db/seed.ts\`, \`defineSeed\`) must be idempotent: they run on every \`dev\`.
+- Integration tests run against a real database (one per worker). Call \`resetDatabase()\`
+  from \`#tests/helpers/db\` in \`beforeEach\`.
+`
+		}
+	]
+};
+//#endregion
+//#region src/features/index.ts
+const FEATURES = Object.fromEntries([
+	base,
+	pnpm,
+	npm,
+	bun,
+	db$1,
+	{
+		id: "postgres",
+		kind: "database",
+		label: "PostgreSQL",
+		dependencies: ["pg"],
+		devDependencies: ["@types/pg"],
+		env: [{
+			key: "DB_PORT",
+			schema: "",
+			example: "5432",
+			composeOnly: true,
+			comment: "Host port for the local database container (keep DATABASE_URL in sync)"
+		}, {
+			key: "DATABASE_URL",
+			schema: "z.url()",
+			example: "postgres://postgres:postgres@localhost:5432/__APP_DB__",
+			test: "postgres://postgres:postgres@localhost:5432/__APP_DB___test"
+		}],
+		compose: { postgres: {
+			image: "postgres:18-alpine",
+			environment: {
+				POSTGRES_USER: "postgres",
+				POSTGRES_PASSWORD: "postgres",
+				POSTGRES_DB: "__APP_DB__"
+			},
+			ports: ["${DB_PORT:-5432}:5432"],
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", "pg_isready -U postgres"],
+				interval: "2s",
+				timeout: "3s",
+				retries: 30
+			}
+		} },
+		composeVolumes: ["postgres-data"]
+	},
+	{
+		id: "mysql",
+		kind: "database",
+		label: "MySQL",
+		variants: [{
+			when: ["drizzle"],
+			dependencies: ["mysql2"]
+		}, {
+			when: ["prisma"],
+			dependencies: ["mariadb"]
+		}],
+		env: [{
+			key: "DB_PORT",
+			schema: "",
+			example: "3306",
+			composeOnly: true,
+			comment: "Host port for the local database container (keep DATABASE_URL in sync)"
+		}, {
+			key: "DATABASE_URL",
+			schema: "z.url()",
+			example: "mysql://root:root@localhost:3306/__APP_DB__",
+			test: "mysql://root:root@localhost:3306/__APP_DB___test"
+		}],
+		compose: { mysql: {
+			image: "mysql:9.7",
+			environment: {
+				MYSQL_ROOT_PASSWORD: "root",
+				MYSQL_DATABASE: "__APP_DB__"
+			},
+			ports: ["${DB_PORT:-3306}:3306"],
+			volumes: ["mysql-data:/var/lib/mysql"],
+			healthcheck: {
+				test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -proot --silent"],
+				interval: "2s",
+				timeout: "3s",
+				retries: 60
+			}
+		} },
+		composeVolumes: ["mysql-data"]
+	},
+	{
+		id: "drizzle",
+		kind: "orm",
+		label: "Drizzle",
+		dependencies: ["drizzle-orm"],
+		devDependencies: ["drizzle-kit"],
+		allowBuilds: ["esbuild"],
+		slots: [{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 10,
+			content: "COPY --from=build /app/drizzle ./drizzle"
+		}]
+	},
+	{
+		id: "prisma",
+		kind: "orm",
+		label: "Prisma",
+		dependencies: ["@prisma/client", "prisma"],
+		allowBuilds: [
+			"prisma",
+			"@prisma/engines",
+			"esbuild"
+		],
+		variants: [{
+			when: ["postgres"],
+			dependencies: ["@prisma/adapter-pg"]
+		}, {
+			when: ["mysql"],
+			dependencies: ["@prisma/adapter-mariadb"]
+		}],
+		slots: [{
+			file: "Dockerfile",
+			slot: "docker-runtime",
+			order: 10,
+			content: "COPY --from=build /app/prisma ./prisma\nCOPY --from=build /app/prisma.config.ts ./"
+		}]
+	},
+	betterAuth,
+	authEmailOtp,
+	authPhoneOtp,
+	authPassword,
+	authOrgs,
+	keycloak,
+	auth,
+	authz,
+	jobs,
+	admin,
+	storage,
+	email,
+	i18n
+].map((f) => [f.id, f]));
+//#endregion
+//#region src/engine/resolve.ts
+var OptionsError = class extends Error {};
+/** Normalizes and validates options; throws OptionsError with a user-facing message. */
+function validateOptions(input) {
+	const options = {
+		...input,
+		authMethods: [...new Set(input.authMethods)],
+		addons: [...new Set(input.addons)]
+	};
+	if (!/^[a-z][a-z0-9-]*$/.test(options.name)) throw new OptionsError(`App name "${options.name}" must be lowercase letters, digits and dashes, starting with a letter.`);
+	if (options.orm === "none" !== (options.database === "none")) throw new OptionsError("Choose both an ORM and a database, or neither.");
+	const hasDb = options.database !== "none";
+	if (options.auth !== "none" && !hasDb) throw new OptionsError(`Auth (${options.auth}) needs a database.`);
+	if (options.auth === "better-auth") {
+		if (options.authMethods.filter((m) => m !== "orgs").length === 0) throw new OptionsError("better-auth needs at least one sign-in method: email-otp, phone-otp or password.");
+	} else if (options.authMethods.length > 0) throw new OptionsError("Auth methods only apply to better-auth.");
+	for (const addon of options.addons) {
+		if ((addon === "authz" || addon === "admin") && options.auth === "none") throw new OptionsError(`The ${addon} add-on needs an auth provider.`);
+		if (addon === "authz" && !hasDb) throw new OptionsError("The authz add-on needs a database.");
+		if (addon === "admin" && options.auth === "better-auth" && !options.authMethods.includes("orgs")) throw new OptionsError("The admin add-on with better-auth needs the \"orgs\" method (it provides user roles).");
+	}
+	return options;
+}
+/** Feature ids selected by the options, in application order. */
+function selectedFeatureIds(options) {
+	const ids = ["base", `pm-${options.packageManager}`];
+	if (options.database !== "none") ids.push("db", options.database);
+	if (options.orm !== "none") ids.push(options.orm);
+	if (options.auth !== "none") ids.push(options.auth);
+	if (options.auth === "better-auth") for (const m of options.authMethods) ids.push(`auth-${m}`);
+	if (options.auth !== "none") ids.push("auth");
+	for (const addon of options.addons) ids.push(addon);
+	return ids;
+}
+function resolveFeatures(options) {
+	return selectedFeatureIds(options).map((id) => {
+		const feature = FEATURES[id];
+		if (!feature) throw new Error(`Unknown feature "${id}"`);
+		return feature;
+	});
+}
+function isApplicable(rule, selected) {
+	if (rule.when && !rule.when.every((id) => selected.has(id))) return false;
+	if (rule.unless?.some((id) => selected.has(id))) return false;
+	return true;
+}
+//#endregion
+//#region src/engine/slots.ts
+const MARKER = /^(\s*)(?:\/\/|#|<!--)\s*tatara:slot\s+([\w-]+)\s*(?:-->)?\s*$/;
+/** Replaces every `tatara:slot <name>` marker line with its contributions (or nothing). */
+function fillSlots(text, fills) {
+	const bySlot = /* @__PURE__ */ new Map();
+	for (const fill of fills) {
+		const list = bySlot.get(fill.slot) ?? [];
+		list.push(fill);
+		bySlot.set(fill.slot, list);
+	}
+	const out = [];
+	for (const line of text.split("\n")) {
+		const match = MARKER.exec(line);
+		if (!match) {
+			out.push(line);
+			continue;
+		}
+		const indent = match[1] ?? "";
+		const contributions = (bySlot.get(match[2] ?? "") ?? []).sort((a, b) => a.order - b.order);
+		const seen = /* @__PURE__ */ new Set();
+		for (const c of contributions) {
+			if (seen.has(c.content)) continue;
+			seen.add(c.content);
+			for (const contentLine of c.content.replace(/\n$/, "").split("\n")) out.push(contentLine.length > 0 ? indent + contentLine : "");
+		}
+	}
+	return out.join("\n");
+}
+//#endregion
+//#region src/engine/generate.ts
+const RENAMES = {
+	_github: ".github",
+	gitignore: ".gitignore",
+	dockerignore: ".dockerignore",
+	"biome.template.json": "biome.json"
+};
+async function walk$1(dir) {
+	const out = [];
+	for (const entry of await readdir(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...await walk$1(full));
+		else out.push(full);
+	}
+	return out;
+}
+function mapPath(rel) {
+	return rel.split(sep).map((segment) => RENAMES[segment] ?? segment).join("/");
+}
+/** `files` plus every `files+a+b` folder whose features are all selected. */
+async function featureFileDirs(feature, selected) {
+	const root = join(TEMPLATES_DIR, "features", feature.templateDir ?? feature.id);
+	if (!existsSync(root)) return [];
+	return (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory() && (e.name === "files" || e.name.startsWith("files+"))).map((e) => e.name).filter((name) => name === "files" || name.split("+").slice(1).every((id) => selected.has(id))).sort((a, b) => a.split("+").length - b.split("+").length || a.localeCompare(b)).map((d) => join(root, d));
+}
+async function collectTemplateFiles(features, selected) {
+	const files = /* @__PURE__ */ new Map();
+	for (const feature of features) for (const dir of await featureFileDirs(feature, selected)) for (const file of await walk$1(dir)) files.set(mapPath(relative(dir, file)), await readFile(file, "utf8"));
+	return files;
+}
+function applySlots(files, features, selected) {
+	const byFile = /* @__PURE__ */ new Map();
+	let order = 0;
+	for (const feature of features) for (const slot of feature.slots ?? []) {
+		if (!isApplicable(slot, selected)) continue;
+		if (!files.has(slot.file)) continue;
+		const list = byFile.get(slot.file) ?? [];
+		list.push({
+			slot: slot.slot,
+			content: slot.content,
+			order: slot.order ?? 100 + order++
+		});
+		byFile.set(slot.file, list);
+	}
+	for (const [path, text] of files) files.set(path, fillSlots(text, byFile.get(path) ?? []));
+}
+function tokens(options) {
+	const pm = pmCommands(options.packageManager);
+	return {
+		__APP_NAME__: options.name,
+		__APP_DB__: options.name.replaceAll("-", "_"),
+		__PM_RUN__: pm.run,
+		__PM_EXEC__: options.packageManager === "pnpm" ? "pnpm" : pm.exec,
+		__BIOME_VERSION__: versionOf("@biomejs/biome")
+	};
+}
+function applyTokens(text, values) {
+	let out = text;
+	for (const [token, value] of Object.entries(values)) out = out.replaceAll(token, value);
+	return out;
+}
+function envValue(v, kind) {
+	if (kind === "example") return v.example;
+	if (v.secret && kind === "dev") return randomBytes(32).toString("base64url");
+	if (kind === "test") return v.test ?? (v.secret ? "test-secret-test-secret-test-secret-00" : v.dev ?? v.example);
+	return v.dev ?? v.example;
+}
+function envFile(vars, kind) {
+	const lines = [];
+	for (const v of vars) {
+		if (v.comment) lines.push(`# ${v.comment}`);
+		lines.push(`${v.key}=${envValue(v, kind)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+function envModule(vars) {
+	return `import { createEnv } from "@t3-oss/env-core";
+import { z } from "zod";
+
+const production = process.env.NODE_ENV === "production";
+
+/** A default for local development; production must set the value explicitly. */
+function localDefault<T extends z.ZodType>(schema: T, value: z.input<T>): T {
+	return production ? schema : (schema.default(value as never) as unknown as T);
+}
+
+/** The only place that reads process.env. Add new variables here and to .env.example. */
+export const env = createEnv({
+	server: {
+${vars.map((v) => `\t\t${v.key}: ${v.schema},`).join("\n")}
+	},
+	runtimeEnv: process.env,
+	emptyStringAsUndefined: true,
+});
+`;
+}
+function dedupeEnv(features, tokenValues) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const f of features) for (const v of f.env ?? []) {
+		const resolved = {
+			...v,
+			example: applyTokens(v.example, tokenValues),
+			...v.dev === void 0 ? {} : { dev: applyTokens(v.dev, tokenValues) },
+			...v.test === void 0 ? {} : { test: applyTokens(v.test, tokenValues) }
+		};
+		seen.set(v.key, resolved);
+	}
+	return [...seen.values()];
+}
+function sortObject(input) {
+	return Object.fromEntries(Object.entries(input).sort(([a], [b]) => a.localeCompare(b)));
+}
+function packageJson(options, features, pmVersion) {
+	const dependencies = {};
+	const devDependencies = {};
+	let scripts = {};
+	for (const f of features) {
+		for (const d of f.dependencies ?? []) dependencies[d] = versionOf(d);
+		for (const d of f.devDependencies ?? []) devDependencies[d] = versionOf(d);
+		scripts = {
+			...scripts,
+			...f.scripts
+		};
+	}
+	for (const d of Object.keys(dependencies)) delete devDependencies[d];
+	const pkg = {
+		name: options.name,
+		version: "0.1.0",
+		private: true,
+		type: "module",
+		engines: { node: ">=24" },
+		...options.packageManager === "pnpm" && pmVersion ? { packageManager: `pnpm@${pmVersion}` } : {},
+		imports: {
+			"#apps/*": "./src/apps/*.ts",
+			"#core/*": "./src/core/*.ts",
+			"#modules/*": "./src/modules/*.ts",
+			"#generated/*": "./src/generated/*.ts",
+			"#tests/*": "./tests/*.ts",
+			"#locales/*": "./src/locales/*.json"
+		},
+		scripts,
+		dependencies: sortObject(dependencies),
+		devDependencies: sortObject(devDependencies)
+	};
+	return `${JSON.stringify(pkg, null, "	")}\n`;
+}
+function composeFile(options, features, tokenValues) {
+	const services = {};
+	const volumes = {};
+	for (const f of features) {
+		Object.assign(services, f.compose ?? {});
+		for (const v of f.composeVolumes ?? []) volumes[v] = null;
+	}
+	if (Object.keys(services).length === 0) return void 0;
+	const doc = {
+		name: `\${COMPOSE_PROJECT_NAME:-${options.name}}`,
+		services,
+		...Object.keys(volumes).length > 0 ? { volumes } : {}
+	};
+	return applyTokens(stringify(doc, { lineWidth: 0 }).replaceAll(": null", ":"), tokenValues);
+}
+function pnpmWorkspace(features) {
+	const builds = [...new Set(features.flatMap((f) => f.allowBuilds ?? []))].sort();
+	const lines = ["# Packages allowed to run install scripts."];
+	if (builds.length === 0) return `${lines.join("\n")}\nallowBuilds: {}\n`;
+	lines.push("allowBuilds:", ...builds.map((b) => `  "${b}": true`));
+	return `${lines.join("\n")}\n`;
+}
+/** Folds applicable variants into each feature so later steps see one flat definition. */
+function effectiveFeatures(options) {
+	const features = resolveFeatures(options);
+	const selected = new Set(features.map((f) => f.id));
+	return features.map((f) => {
+		const variants = (f.variants ?? []).filter((v) => isApplicable(v, selected));
+		if (variants.length === 0) return f;
+		return {
+			...f,
+			dependencies: [...f.dependencies ?? [], ...variants.flatMap((v) => v.dependencies ?? [])],
+			devDependencies: [...f.devDependencies ?? [], ...variants.flatMap((v) => v.devDependencies ?? [])],
+			scripts: Object.assign({}, f.scripts, ...variants.map((v) => v.scripts ?? {})),
+			allowBuilds: [...f.allowBuilds ?? [], ...variants.flatMap((v) => v.allowBuilds ?? [])],
+			env: [...f.env ?? [], ...variants.flatMap((v) => v.env ?? [])]
+		};
+	});
+}
+/** Renders the whole app in memory: template files, slots, tokens and generated config. */
+async function renderApp(options, generate = {}) {
+	const features = effectiveFeatures(options);
+	const selected = new Set(features.map((f) => f.id));
+	const tokenValues = tokens(options);
+	const files = await collectTemplateFiles(features, selected);
+	const env = dedupeEnv(features, tokenValues);
+	files.set("src/core/config/env.ts", envModule(env.filter((v) => !v.composeOnly)));
+	files.set(".env.example", envFile(env, "example"));
+	files.set(".env.test", envFile(env, "test"));
+	const compose = composeFile(options, features, tokenValues);
+	applySlots(files, compose ? [...features, {
+		id: "_compose",
+		kind: "base",
+		label: "compose",
+		slots: [{
+			file: ".github/workflows/ci.yml",
+			slot: "ci-services",
+			content: "- run: docker compose up -d --wait"
+		}]
+	}] : features, selected);
+	for (const [path, text] of files) files.set(path, applyTokens(text, tokenValues));
+	files.set("package.json", packageJson(options, features, generate.pmVersion));
+	if (compose) files.set("compose.yaml", compose);
+	if (options.packageManager === "pnpm") files.set("pnpm-workspace.yaml", pnpmWorkspace(features));
+	const config = {
+		$schema: "https://raw.githubusercontent.com/mohammed-bageri/tatara/main/schema/tatara.json",
+		version: cliVersion(),
+		name: options.name,
+		orm: options.orm,
+		database: options.database,
+		auth: options.auth,
+		authMethods: options.authMethods,
+		addons: options.addons,
+		packageManager: options.packageManager
+	};
+	files.set("tatara.json", `${JSON.stringify(config, null, "	")}\n`);
+	return files;
+}
+async function writeFiles(targetDir, files, extra = {}) {
+	for (const [path, content] of files) {
+		const full = join(targetDir, path);
+		await mkdir(dirname(full), { recursive: true });
+		await writeFile(full, content);
+	}
+	if (extra.env !== void 0) await writeFile(join(targetDir, ".env"), extra.env);
+}
+function devEnvFromExample(options) {
+	return envFile(dedupeEnv(effectiveFeatures(options), tokens(options)), "dev");
+}
+//#endregion
+//#region src/engine/names.ts
+function words(input) {
+	return input.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[^A-Za-z0-9]+/g, " ").trim().toLowerCase().split(/\s+/).filter(Boolean);
+}
+const IRREGULAR = {
+	person: "people",
+	child: "children",
+	man: "men",
+	woman: "women",
+	mouse: "mice",
+	goose: "geese",
+	tooth: "teeth",
+	foot: "feet"
+};
+const UNCOUNTABLE = /* @__PURE__ */ new Set([
+	"data",
+	"information",
+	"equipment",
+	"news",
+	"series",
+	"species",
+	"media"
+]);
+function pluralize(word) {
+	if (UNCOUNTABLE.has(word)) return word;
+	const irregular = IRREGULAR[word];
+	if (irregular) return irregular;
+	if (/(s|x|z|ch|sh)$/.test(word)) return `${word}es`;
+	if (/[^aeiou]y$/.test(word)) return `${word.slice(0, -1)}ies`;
+	if (/(?:[^f])fe$/.test(word)) return `${word.slice(0, -2)}ves`;
+	if (/[^f]f$/.test(word)) return `${word.slice(0, -1)}ves`;
+	return `${word}s`;
+}
+const cap = (w) => w.charAt(0).toUpperCase() + w.slice(1);
+function fromWords(parts) {
+	return {
+		kebab: parts.join("-"),
+		pascal: parts.map(cap).join(""),
+		camel: parts.map((w, i) => i === 0 ? w : cap(w)).join(""),
+		snake: parts.join("_")
+	};
+}
+function names(input) {
+	const parts = words(input);
+	if (parts.length === 0) throw new Error(`"${input}" is not a valid name`);
+	if (!/^[a-z]/.test(parts[0] ?? "")) throw new Error(`"${input}" must start with a letter`);
+	const singular = fromWords(parts);
+	const plural = fromWords([...parts.slice(0, -1), pluralize(parts.at(-1) ?? "")]);
+	return {
+		...singular,
+		pluralKebab: plural.kebab,
+		pluralPascal: plural.pascal,
+		pluralCamel: plural.camel,
+		pluralSnake: plural.snake,
+		title: cap(parts.join(" "))
+	};
+}
+/** Replaces `__name__`-style tokens (see Names keys) in a string. */
+function applyNames(text, prefix, n) {
+	return text.replaceAll(`__${prefix}PluralKebab__`, n.pluralKebab).replaceAll(`__${prefix}PluralPascal__`, n.pluralPascal).replaceAll(`__${prefix}PluralCamel__`, n.pluralCamel).replaceAll(`__${prefix}PluralSnake__`, n.pluralSnake).replaceAll(`__${prefix}Kebab__`, n.kebab).replaceAll(`__${prefix}Pascal__`, n.pascal).replaceAll(`__${prefix}Camel__`, n.camel).replaceAll(`__${prefix}Snake__`, n.snake).replaceAll(`__${prefix}Title__`, n.title);
+}
+//#endregion
+//#region src/generators/index.ts
+const GENERATORS = [
+	"module",
+	"resource",
+	"route",
+	"service",
+	"schema",
+	"command",
+	"consumer",
+	"schedule",
+	"permission"
+];
+var GeneratorError = class extends Error {};
+const REQUIRES = {
+	resource: {
+		feature: "db",
+		hint: "it needs a database"
+	},
+	schema: {
+		feature: "db",
+		hint: "it needs a database"
+	},
+	consumer: {
+		feature: "jobs",
+		hint: "it needs the jobs add-on"
+	},
+	schedule: {
+		feature: "jobs",
+		hint: "it needs the jobs add-on"
+	},
+	permission: {
+		feature: "authz",
+		hint: "it needs the authz add-on"
+	}
+};
+const ACTIONS = {
+	list: "read",
+	read: "read",
+	create: "create",
+	update: "update",
+	delete: "delete"
+};
+function guardSlots(project, n) {
+	const fills = [];
+	const add = (slot, content) => fills.push({
+		slot,
+		content,
+		order: fills.length
+	});
+	if (project.has("authz")) {
+		add("imports", "import { requirePermission } from \"#core/authz/middleware\";");
+		for (const [route, action] of Object.entries(ACTIONS)) add(`guard-${route}`, `middleware: [requirePermission("${n.kebab}:${action}")] as const,\nsecurity: [{ bearerAuth: ["${n.kebab}:${action}"] }],`);
+		add("auth-errors", "...errorResponses(401, 403),");
+	} else if (project.has("auth")) {
+		add("imports", "import { requireAuth } from \"#core/auth/middleware\";");
+		for (const route of Object.keys(ACTIONS)) add(`guard-${route}`, "middleware: [requireAuth()] as const,\nsecurity: [{ bearerAuth: [] }],");
+		add("auth-errors", "...errorResponses(401),");
+	}
+	return fills;
+}
+function testSlots(project, n) {
+	if (!project.has("auth")) return [];
+	const fills = [{
+		slot: "test-imports",
+		content: "import { asUser } from \"#tests/helpers/auth\";",
+		order: 0
+	}, {
+		slot: "test-cases",
+		order: 1,
+		content: [
+			"it(\"requires authentication\", async () => {",
+			"	const res = await api.get(path);",
+			"	expect(res.status).toBe(401);",
+			"});"
+		].join("\n")
+	}];
+	if (project.has("authz")) {
+		const permissions = [
+			"read",
+			"create",
+			"update",
+			"delete"
+		].map((a) => `"${n.kebab}:${a}"`);
+		fills.push({
+			slot: "test-auth",
+			order: 2,
+			content: `Object.assign(headers, await asUser({ permissions: [${permissions.join(", ")}] }));`
+		}, {
+			slot: "test-cases",
+			order: 3,
+			content: [
+				"",
+				"it(\"requires permission\", async () => {",
+				"	const res = await api.get(path, { headers: await asUser({ permissions: [] }) });",
+				"	expect(res.status).toBe(403);",
+				"});"
+			].join("\n")
+		});
+	} else fills.push({
+		slot: "test-auth",
+		order: 2,
+		content: "Object.assign(headers, await asUser());"
+	});
+	return fills;
+}
+async function walk(dir) {
+	const out = [];
+	for (const entry of await readdir(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) out.push(...await walk(full));
+		else out.push(full);
+	}
+	return out;
+}
+function selectedSet(project) {
+	const c = project.config;
+	const set = /* @__PURE__ */ new Set([
+		c.orm,
+		c.database,
+		c.auth,
+		...c.addons,
+		...c.authMethods.map((m) => `auth-${m}`)
+	]);
+	if (c.database !== "none") set.add("db");
+	if (c.auth !== "none") set.add("auth");
+	return set;
+}
+async function generate(project, request) {
+	const requirement = REQUIRES[request.kind];
+	if (requirement && !project.has(requirement.feature)) throw new GeneratorError(`Cannot make a ${request.kind}: ${requirement.hint}.`);
+	let n;
+	let m;
+	try {
+		n = names(request.name);
+		m = names(request.kind === "module" ? request.name : request.module ?? "");
+	} catch (error) {
+		if (request.kind !== "module" && !request.module) throw new GeneratorError(`Pass --module <module> (the module the ${request.kind} belongs to).`);
+		throw new GeneratorError(error.message);
+	}
+	const root = join(TEMPLATES_DIR, "generators", request.kind);
+	const selected = selectedSet(project);
+	const dirs = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory() && (e.name === "files" || e.name.startsWith("files+"))).map((e) => e.name).filter((d) => d === "files" || d.split("+").slice(1).every((id) => selected.has(id))).sort();
+	const fills = [...guardSlots(project, n), ...testSlots(project, n)];
+	const pm = pmCommands(project.config.packageManager);
+	const rendered = /* @__PURE__ */ new Map();
+	for (const dir of dirs) {
+		const base = join(root, dir);
+		for (const file of await walk(base)) {
+			const rel = applyNames(applyNames(relative(base, file), "name", n), "module", m);
+			let text = applyNames(applyNames(await readFile(file, "utf8"), "name", n), "module", m);
+			text = text.replaceAll("__APP_NAME__", project.config.name).replaceAll("__PM_RUN__", pm.run);
+			rendered.set(rel, fillSlots(text, fills));
+		}
+	}
+	const existing = [...rendered.keys()].filter((rel) => existsSync(join(project.root, rel)));
+	if (existing.length > 0) throw new GeneratorError(`Refusing to overwrite existing file(s):\n  ${existing.join("\n  ")}`);
+	const routeSources = /* @__PURE__ */ new Map();
+	for (const rel of await glob("src/**/routes/*.routes.ts", { cwd: project.root })) routeSources.set(rel, await readFile(join(project.root, rel), "utf8"));
+	const before = routeMountCollisions(routeSources).length;
+	for (const [rel, text] of rendered) routeSources.set(rel, text);
+	const after = routeMountCollisions(routeSources);
+	const collision = after.length > before ? after.at(-1) : void 0;
+	if (collision) throw new GeneratorError(`${collision.file}: ${collision.message}. Pick another --name, or create it and change basePath.`);
+	const files = [...rendered.keys()].sort();
+	if (request.dryRun) return {
+		kind: request.kind,
+		files,
+		dryRun: true
+	};
+	for (const [rel, text] of rendered) {
+		const full = join(project.root, rel);
+		await mkdir(dirname(full), { recursive: true });
+		await writeFile(full, text);
+	}
+	if (!request.skipPostProcess) await postProcess(project, files);
+	return {
+		kind: request.kind,
+		files,
+		dryRun: false
+	};
+}
+/** Regenerates discovery output and formats the new files. */
+async function postProcess(project, files) {
+	const { sync } = await Promise.resolve().then(() => sync_exports);
+	await sync(project);
+	const biome = join(project.root, "node_modules/.bin/biome");
+	const ts = files.filter((f) => f.endsWith(".ts"));
+	if (existsSync(biome) && ts.length > 0) await x(biome, [
+		"check",
+		"--write",
+		...ts
+	], {
+		nodeOptions: { cwd: project.root },
+		throwOnError: false
+	});
+}
+//#endregion
+//#region src/commands/post-create.ts
+async function bin(project, name, args) {
+	const result = await x(join(project.root, "node_modules/.bin", name), args, {
+		nodeOptions: { cwd: project.root },
+		throwOnError: false
+	});
+	if (result.exitCode !== 0) throw new Error(`${name} ${args.join(" ")} failed:\n${result.stdout}\n${result.stderr}`);
+	return result.stdout;
+}
+/** Writes the first migration offline, from the schema the chosen features produced. */
+async function initialMigration(project) {
+	if (project.config.orm === "drizzle") await bin(project, "drizzle-kit", [
+		"generate",
+		"--name",
+		"init"
+	]);
+	else if (project.config.orm === "prisma") {
+		const dir = join(project.root, "prisma/migrations/00000000000000_init");
+		await mkdir(dir, { recursive: true });
+		await bin(project, "prisma", [
+			"migrate",
+			"diff",
+			"--from-empty",
+			"--to-schema",
+			"prisma",
+			"--script",
+			"--output",
+			join(dir, "migration.sql")
+		]);
+		const lock = join(project.root, "prisma/migrations/migration_lock.toml");
+		if (!existsSync(lock)) await writeFile(lock, `# Do not edit: managed by Prisma Migrate\nprovider = "${project.config.database === "mysql" ? "mysql" : "postgresql"}"\n`);
+	}
+}
+/** Steps `tatara new` runs after writing files ("files") and after installing ("installed"). */
+async function afterCreate(project, stage) {
+	if (stage === "files" && project.has("db")) await generate(project, {
+		kind: "resource",
+		name: "project",
+		module: "projects",
+		skipPostProcess: true
+	});
+	if (stage === "installed") await initialMigration(project);
+}
+//#endregion
+//#region src/commands/new.ts
+const ORMS = [
+	"drizzle",
+	"prisma",
+	"none"
+];
+const DATABASES = [
+	"postgres",
+	"mysql",
+	"none"
+];
+const AUTHS = [
+	"better-auth",
+	"keycloak",
+	"none"
+];
+const METHODS = [
+	"email-otp",
+	"phone-otp",
+	"password",
+	"orgs"
+];
+const ADDONS = [
+	"authz",
+	"jobs",
+	"admin",
+	"storage",
+	"email",
+	"i18n"
+];
+const PMS = [
+	"pnpm",
+	"npm",
+	"bun"
+];
+function oneOf(value, allowed, flag) {
+	if (!allowed.includes(value)) throw new OptionsError(`--${flag} must be one of: ${allowed.join(", ")} (got "${value}")`);
+	return value;
+}
+function listOf(value, allowed, flag) {
+	if (!value || value === "none") return [];
+	return value.split(",").map((v) => v.trim()).filter(Boolean).map((v) => oneOf(v, allowed, flag));
+}
+function detectPackageManager() {
+	const agent = process.env.npm_config_user_agent ?? "";
+	if (agent.startsWith("pnpm")) return "pnpm";
+	if (agent.startsWith("bun")) return "bun";
+	if (agent.startsWith("npm")) return "npm";
+	return "pnpm";
+}
+function answer(value) {
+	if (p.isCancel(value)) {
+		p.cancel("Cancelled.");
+		process.exit(1);
+	}
+	return value;
+}
+async function prompt(name, flags) {
+	const orm = flags.orm ? oneOf(flags.orm, ORMS, "orm") : answer(await p.select({
+		message: "ORM",
+		options: [
+			{
+				value: "drizzle",
+				label: "Drizzle"
+			},
+			{
+				value: "prisma",
+				label: "Prisma"
+			},
+			{
+				value: "none",
+				label: "No database"
+			}
+		]
+	}));
+	let database = "none";
+	if (orm !== "none") database = flags.db ? oneOf(flags.db, DATABASES, "db") : answer(await p.select({
+		message: "Database",
+		options: [{
+			value: "postgres",
+			label: "PostgreSQL"
+		}, {
+			value: "mysql",
+			label: "MySQL"
+		}]
+	}));
+	let auth = "none";
+	if (database !== "none") auth = flags.auth ? oneOf(flags.auth, AUTHS, "auth") : answer(await p.select({
+		message: "Auth",
+		options: [
+			{
+				value: "better-auth",
+				label: "better-auth",
+				hint: "sign-in handled by the API"
+			},
+			{
+				value: "keycloak",
+				label: "Keycloak",
+				hint: "API verifies Keycloak tokens"
+			},
+			{
+				value: "none",
+				label: "None"
+			}
+		]
+	}));
+	let authMethods = [];
+	if (auth === "better-auth") authMethods = flags.authMethods ? listOf(flags.authMethods, METHODS, "auth-methods") : answer(await p.multiselect({
+		message: "Sign-in methods",
+		initialValues: ["email-otp"],
+		options: [
+			{
+				value: "email-otp",
+				label: "Email OTP"
+			},
+			{
+				value: "phone-otp",
+				label: "Phone OTP"
+			},
+			{
+				value: "password",
+				label: "Email + password"
+			},
+			{
+				value: "orgs",
+				label: "Organizations + roles",
+				hint: "organization and admin plugins"
+			}
+		],
+		required: true
+	}));
+	const labels = {
+		authz: "Permission system",
+		jobs: "Jobs + cron (BullMQ)",
+		admin: "Admin API app",
+		storage: "File storage",
+		email: "Email",
+		i18n: "i18n"
+	};
+	const addons = flags.addons !== void 0 ? listOf(flags.addons, ADDONS, "addons") : answer(await p.multiselect({
+		message: "Add-ons",
+		required: false,
+		options: ADDONS.filter((a) => !((a === "authz" || a === "admin") && auth === "none")).map((value) => ({
+			value,
+			label: labels[value]
+		}))
+	}));
+	const packageManager = flags.pm ? oneOf(flags.pm, PMS, "pm") : answer(await p.select({
+		message: "Package manager",
+		initialValue: detectPackageManager(),
+		options: PMS.map((value) => ({
+			value,
+			label: value
+		}))
+	}));
+	return {
+		name,
+		orm,
+		database,
+		auth,
+		authMethods,
+		addons,
+		packageManager
+	};
+}
+function fromFlags(name, flags) {
+	const orm = oneOf(flags.orm ?? "drizzle", ORMS, "orm");
+	const database = oneOf(flags.db ?? (orm === "none" ? "none" : "postgres"), DATABASES, "db");
+	const auth = oneOf(flags.auth ?? (database === "none" ? "none" : "better-auth"), AUTHS, "auth");
+	return {
+		name,
+		orm,
+		database,
+		auth,
+		authMethods: listOf(flags.authMethods ?? (auth === "better-auth" ? "email-otp" : void 0), METHODS, "auth-methods"),
+		addons: listOf(flags.addons, ADDONS, "addons"),
+		packageManager: oneOf(flags.pm ?? detectPackageManager(), PMS, "pm")
+	};
+}
+async function pmVersion(pm) {
+	const result = await x(pm, ["--version"], { throwOnError: false });
+	return result.exitCode === 0 ? result.stdout.trim() : void 0;
+}
+async function run(cmd, args, cwd, label) {
+	const spinner = Boolean(process.stdout.isTTY) ? p.spinner() : void 0;
+	if (spinner) spinner.start(label);
+	else console.log(`• ${label}`);
+	const result = await x(cmd, args, {
+		nodeOptions: { cwd },
+		throwOnError: false
+	});
+	if (result.exitCode !== 0) {
+		spinner?.stop(pc.red(`${label} failed`));
+		throw new Error(`${cmd} ${args.join(" ")} failed:\n${result.stdout}\n${result.stderr}`);
+	}
+	spinner?.stop(label);
+}
+async function newApp(dir, flags) {
+	const interactive = !flags.yes && process.stdout.isTTY;
+	if (interactive) p.intro(pc.bold("tatara"));
+	let target = dir;
+	if (!target) {
+		if (!interactive) throw new OptionsError("Pass the app directory, e.g. `tatara new my-app`.");
+		target = answer(await p.text({
+			message: "App directory",
+			placeholder: "my-app",
+			defaultValue: "my-app"
+		}));
+	}
+	const root = resolve(target);
+	if (existsSync(root) && readdirSync(root).length > 0) throw new OptionsError(`${root} already exists and is not empty.`);
+	const name = root.split(/[\\/]/).at(-1) ?? "app";
+	const options = validateOptions(interactive ? await prompt(name, flags) : fromFlags(name, flags));
+	const pm = pmCommands(options.packageManager);
+	await writeFiles(root, await renderApp(options, { pmVersion: await pmVersion(options.packageManager) }), { env: devEnvFromExample(options) });
+	const project = loadProject(root);
+	await afterCreate(project, "files");
+	if (flags.install !== false) {
+		const [cmd, ...args] = pm.install;
+		await run(cmd ?? "npm", args, root, `Installing dependencies with ${options.packageManager}`);
+		await sync(project);
+		await afterCreate(project, "installed");
+		const [exec, ...execArgs] = pm.exec.split(" ");
+		const format = await x(exec ?? "npx", [
+			...execArgs,
+			"biome",
+			"check",
+			"--write",
+			"."
+		], {
+			nodeOptions: { cwd: root },
+			throwOnError: false
+		});
+		if (format.exitCode !== 0) console.warn(pc.yellow(`Formatting reported problems (please report this as a tatara bug):\n${format.stdout}`));
+	}
+	if (flags.git !== false) {
+		if ((await x("git", [
+			"init",
+			"-q",
+			"-b",
+			"main"
+		], {
+			nodeOptions: { cwd: root },
+			throwOnError: false
+		})).exitCode === 0) {
+			await x("git", ["add", "-A"], {
+				nodeOptions: { cwd: root },
+				throwOnError: false
+			});
+			await x("git", [
+				"commit",
+				"-q",
+				"-m",
+				"Initial commit from tatara"
+			], {
+				nodeOptions: { cwd: root },
+				throwOnError: false
+			});
+		}
+	}
+	const next = [
+		`cd ${target}`,
+		...flags.install === false ? [pm.install.join(" ")] : [],
+		`${pm.run} dev`
+	];
+	if (interactive) p.outro(`Done. Next:\n\n  ${next.join("\n  ")}`);
+	else console.log(`Created ${root}\nNext:\n  ${next.join("\n  ")}`);
+	return root;
+}
+//#endregion
+//#region src/commands/routes.ts
+/** Reads every app's OpenAPI document in-process and lists its routes. */
+async function listRoutes(project) {
+	await sync(project);
+	const apps = [["api", "#apps/api/app"], ...project.has("admin") ? [["admin", "#apps/admin/app"]] : []];
+	const code = `
+const out = [];
+for (const [name, spec] of ${JSON.stringify(apps)}) {
+	const { app } = await import(spec);
+	const doc = app.getOpenAPI31Document({ openapi: "3.1.0", info: { title: name, version: "1" } });
+	for (const [path, item] of Object.entries(doc.paths ?? {})) {
+		for (const [method, op] of Object.entries(item)) {
+			const security = op.security ?? [];
+			const roles = security.flatMap((s) => Object.values(s).flat());
+			const access = security.length === 0 ? "public" : roles.length ? roles.join(", ") : "authenticated";
+			out.push({ app: name, method: method.toUpperCase(), path, summary: op.summary ?? "", access });
+		}
+	}
+}
+process.stdout.write(JSON.stringify(out));
+process.exit(0);
+`;
+	return new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, [
+			...NODE_FLAGS,
+			"--input-type=module",
+			"-e",
+			code
+		], {
+			cwd: project.root,
+			env: {
+				...process.env,
+				LOG_LEVEL: "silent"
+			}
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (d) => {
+			stdout += d.toString();
+		});
+		child.stderr.on("data", (d) => {
+			stderr += d.toString();
+		});
+		child.on("exit", (code) => {
+			if (code !== 0) return reject(/* @__PURE__ */ new Error(`Could not load the apps:\n${stderr}`));
+			resolve(JSON.parse(stdout));
+		});
+	});
+}
+function printRoutes(routes) {
+	const rows = routes.map((r) => [
+		r.app,
+		r.method,
+		r.path,
+		r.access,
+		r.summary
+	]);
+	const widths = [
+		0,
+		1,
+		2,
+		3
+	].map((i) => Math.max(...rows.map((r) => (r[i] ?? "").length), 4));
+	for (const r of rows) {
+		const [app = "", method = "", path = "", access = "", summary = ""] = r;
+		console.log(`${pc.dim(app.padEnd(widths[0] ?? 0))}  ${pc.bold(method.padEnd(widths[1] ?? 0))}  ${path.padEnd(widths[2] ?? 0)}  ${(access === "public" ? pc.yellow : pc.green)(access.padEnd(widths[3] ?? 0))}  ${pc.dim(summary)}`);
+	}
+}
+//#endregion
+//#region src/commands/tinker.ts
+/** A REPL with env, logger, db and every module's services loaded. */
+async function tinker(project) {
+	await sync(project);
+	const imports = (await glob(["src/modules/*/services/*.ts"], {
+		cwd: project.root,
+		ignore: ["**/*.test.ts"]
+	})).map((file) => {
+		const [, moduleName = "", base = ""] = /src\/modules\/([^/]+)\/services\/([^/]+)\.ts$/.exec(file) ?? [];
+		const key = names(`${moduleName} ${base.replace(/\.service$/, "")}`).camel;
+		return `ctx[${JSON.stringify(key)}] = await import(${JSON.stringify(`#${file.slice(4, -3)}`)});`;
+	});
+	const code = `
+import repl from "node:repl";
+const ctx = {};
+ctx.env = (await import("#core/config/env")).env;
+ctx.logger = (await import("#core/logging/logger")).logger;
+${project.has("db") ? "Object.assign(ctx, await import(\"#core/db/client\"));" : ""}
+${imports.join("\n")}
+console.log("Loaded:", Object.keys(ctx).join(", "));
+const server = repl.start({ prompt: "${project.config.name}> " });
+Object.assign(server.context, ctx);
+server.on("exit", () => process.exit(0));
+`;
+	return new Promise((resolve) => {
+		spawn(process.execPath, [
+			...NODE_FLAGS,
+			"--input-type=module",
+			"-e",
+			code
+		], {
+			cwd: project.root,
+			stdio: "inherit"
+		}).on("exit", (c) => resolve(c ?? 0));
+	});
+}
+//#endregion
+//#region src/bin.ts
+const program = new Command("tatara").description("Create and grow opinionated Hono backends").version(cliVersion());
+program.command("new").description("Create a new app").argument("[dir]", "directory to create").option("--orm <orm>", "drizzle | prisma | none").option("--db <database>", "postgres | mysql | none").option("--auth <provider>", "better-auth | keycloak | none").option("--auth-methods <list>", "email-otp,phone-otp,password,orgs (better-auth)").option("--addons <list>", "authz,jobs,admin,storage,email,i18n").option("--pm <pm>", "pnpm | npm | bun").option("-y, --yes", "skip prompts and use flags/defaults").option("--no-install", "do not install dependencies").option("--no-git", "do not initialise git").action(async (dir, flags) => {
+	await newApp(dir, flags);
+});
+program.command("sync").description("Regenerate src/generated from discovered module files").option("--quiet", "no output").action(async (flags) => {
+	const { written } = await sync();
+	if (!flags.quiet && written.length > 0) console.log(pc.dim(`tatara sync: ${written.length} file(s) updated`));
+});
+program.command("check").description("Check layout rules (part of lint)").option("--json", "machine-readable output").action(async (flags) => {
+	const violations = await check();
+	if (flags.json) console.log(JSON.stringify({ violations }, null, 2));
+	else if (violations.length === 0) console.log(pc.green("tatara check: layout OK"));
+	else {
+		for (const v of violations) console.log(`${pc.red("✖")} ${v.file}:${v.line} ${pc.dim(`[${v.rule}]`)} ${v.message}`);
+		console.log(pc.red(`\n${violations.length} layout violation(s)`));
+	}
+	if (violations.length > 0) process.exitCode = 1;
+});
+program.command("verify").description("Lint, layout, typecheck, test and build").action(async () => {
+	if (!await verify()) process.exitCode = 1;
+});
+program.command("make").description(`Generate code: ${GENERATORS.join(", ")}`).argument("<kind>", GENERATORS.join(" | ")).argument("<name>", "name, e.g. billing-account").option("-m, --module <module>", "module the code belongs to").option("--dry-run", "show the files without writing them").option("--json", "machine-readable output").action(async (kind, name, flags) => {
+	if (!GENERATORS.includes(kind)) throw new GeneratorError(`Unknown generator "${kind}". Use one of: ${GENERATORS.join(", ")}`);
+	const result = await generate(loadProject(), {
+		kind,
+		name,
+		...flags.module ? { module: flags.module } : {},
+		...flags.dryRun ? { dryRun: true } : {}
+	});
+	if (flags.json) {
+		console.log(JSON.stringify(result, null, 2));
+		return;
+	}
+	const verb = result.dryRun ? "would create" : "created";
+	for (const file of result.files) console.log(`${pc.green(verb)} ${file}`);
+});
+const db = program.command("db").description("Database tasks for the app's ORM");
+db.command("generate").description("Create a migration from schema changes").option("-n, --name <name>", "migration name", "change").action(async (flags) => {
+	process.exitCode = await dbGenerate(loadProject(), flags.name);
+});
+db.command("migrate").description("Apply pending migrations").action(async () => {
+	process.exitCode = await dbMigrate(loadProject());
+});
+db.command("seed").description("Run seeds").action(async () => {
+	process.exitCode = await dbSeed(loadProject());
+});
+db.command("reset").description("Drop all tables, migrate and seed (not in production)").action(async () => {
+	process.exitCode = await dbReset(loadProject());
+});
+db.command("studio").description("Open the ORM's database studio").action(async () => {
+	process.exitCode = await dbStudio(loadProject());
+});
+program.command("dev").description("Start local services, migrate, seed and run every process with reload").option("--down", "stop local services").option("--reset", "stop local services and delete their data, then start fresh").option("--prepare", "start services, migrate and seed, then exit").action(async (flags) => {
+	process.exit(await dev(loadProject(), flags));
+});
+program.command("run").description("Run an app command (see `tatara run --list`)").argument("[command]", "command name").argument("[args...]", "arguments passed to the command").option("--list", "list commands").allowUnknownOption().helpOption(false).action(async (command, args, flags) => {
+	const project = loadProject();
+	const { sync: runSync } = await Promise.resolve().then(() => sync_exports);
+	await runSync(project);
+	const argv = flags.list || !command ? ["--list"] : [command, ...args];
+	process.exitCode = await runAppCli(project, argv);
+});
+program.command("tinker").description("REPL with env, logger, db and module services loaded").action(async () => {
+	process.exitCode = await tinker(loadProject());
+});
+program.command("routes").description("List every route and what protects it").option("--json", "machine-readable output").action(async (flags) => {
+	const routes = await listRoutes(loadProject());
+	if (flags.json) console.log(JSON.stringify(routes, null, 2));
+	else printRoutes(routes);
+});
+program.command("doctor").description("Check the toolchain, services, env and layout").option("--json", "machine-readable output").action(async (flags) => {
+	const checks = await doctor(loadProject());
+	if (flags.json) console.log(JSON.stringify(checks, null, 2));
+	else printDoctor(checks);
+	if (checks.some((c) => !c.ok)) process.exitCode = 1;
+});
+program.parseAsync().catch((error) => {
+	if (error instanceof OptionsError || error instanceof NotATataraProject || error instanceof GeneratorError || error instanceof DbError) console.error(pc.red(error.message));
+	else console.error(error);
+	process.exit(1);
+});
+//#endregion
+export {};