@tatara/cli 0.2.0 → 0.4.0

package/dist/bin.mjs

@@ -286,7 +286,7 @@ export type PermissionKey =
 		const seeds = await find(root, dirs.map((d) => `${d}/db/seed.ts`));
 		await writeIfChanged(join(out, "seeds.ts"), listModule(seeds, {
 			prefix: "seed",
-			typeImport: "import type { SeedDefinition } from \"#core/db/seed\";",
+			typeImport: "import type { SeedDefinition } from \"@tatara/db\";",
 			typeName: "SeedDefinition",
 			exportName: "seeds"
 		}), written);
@@ -1051,14 +1051,14 @@ const i18n = {
 			content: "app.use(detectLanguage);"
 		},
 		{
-			file: "src/core/http/middleware/error-handler.ts",
+			file: "src/core/http/app.ts",
 			slot: "imports",
 			content: "import { t } from \"#core/i18n/index\";"
 		},
 		{
-			file: "src/core/http/middleware/error-handler.ts",
-			slot: "error-message",
-			content: "if (err.translatable) message = t(c.get(\"language\"), `errors.${err.code}`, message);"
+			file: "src/core/http/app.ts",
+			slot: "error-options",
+			content: ["message: (err, c) =>", "	err.translatable ? t(c.get(\"language\"), `errors.${err.code}`, err.message) : err.message,"].join("\n")
 		},
 		{
 			file: "AGENTS.md",
@@ -1170,8 +1170,17 @@ const betterAuth = {
 		},
 		{
 			file: "src/core/http/app.ts",
-			slot: "openapi",
-			content: "if (name === \"api\") await mergeAuthOpenApi(document, `${API_PREFIX}/auth`);"
+			slot: "expose-headers",
+			content: "\"set-auth-token\","
+		},
+		{
+			file: "src/core/http/app.ts",
+			slot: "openapi-options",
+			content: [
+				"async extend(document) {",
+				"	if (name === \"api\") await mergeAuthOpenApi(document, `${API_PREFIX}/auth`);",
+				"},"
+			].join("\n")
 		},
 		{
 			file: "src/core/http/app.ts",
@@ -1640,6 +1649,7 @@ const base = {
 	label: "Hono API",
 	dependencies: [
 		"@tatara/core",
+		"@tatara/http",
 		"hono",
 		"@hono/node-server",
 		"@hono/zod-openapi",
@@ -1649,6 +1659,7 @@ const base = {
 		"pino"
 	],
 	devDependencies: [
+		"@tatara/testing",
 		"@tatara/cli",
 		"typescript",
 		"@types/node",
@@ -1846,6 +1857,7 @@ const db$1 = {
 	id: "db",
 	kind: "database",
 	label: "Database (shared)",
+	dependencies: ["@tatara/db"],
 	scripts: {
 		"db:generate": "tatara db generate",
 		"db:migrate": "tatara db migrate",
@@ -1868,7 +1880,7 @@ const db$1 = {
 			file: "tests/setup.ts",
 			slot: "setup",
 			content: [
-				"import { workerDatabaseUrl } from \"#tests/helpers/database-url\";",
+				"import { workerDatabaseUrl } from \"@tatara/testing\";",
 				"",
 				"// One database per worker, created by tests/global-setup.ts.",
 				"process.env.DATABASE_URL = workerDatabaseUrl(process.env.DATABASE_URL ?? \"\", process.env.VITEST_POOL_ID ?? \"1\");"
@@ -3212,7 +3224,7 @@ function createBaseline(project, deps) {
 //#region src/upgrade/codemods/core-package.ts
 const CORE = "@tatara/core";
 /** Files @tatara/core replaces, with the import specifier apps used for each. */
-const MOVED = {
+const MOVED$2 = {
 	"src/core/commands/define.ts": "#core/commands/define",
 	"src/core/commands/runner.ts": "#core/commands/runner",
 	"src/core/process/lifecycle.ts": "#core/process/lifecycle",
@@ -3247,8 +3259,8 @@ async function rewriteEnv(ctx) {
 }
 /** Only call sites of functions that now come from @tatara/core take the logger argument. */
 async function passLogger(ctx, gone) {
-	const runnerGone = gone.includes(MOVED["src/core/commands/runner.ts"]);
-	const lifecycleGone = gone.includes(MOVED["src/core/process/lifecycle.ts"]);
+	const runnerGone = gone.includes(MOVED$2["src/core/commands/runner.ts"]);
+	const lifecycleGone = gone.includes(MOVED$2["src/core/process/lifecycle.ts"]);
 	const cli = await exists(ctx, CLI_ENTRY);
 	if (cli) {
 		let next = cli;
@@ -3294,17 +3306,14 @@ export const logger = pino(
 export type Logger = typeof logger;
 `);
 }
-//#endregion
-//#region src/upgrade/codemods.ts
-/** Every codemod tatara ships, oldest first. Each step that moves code into a package adds one. */
-const CODEMODS = [{
+const corePackage = {
 	version: "0.2.0",
 	id: "core-package",
 	description: "Use @tatara/core for commands, flags, lifecycle, readiness, logger options and localDefault",
 	async run(ctx) {
 		await ctx.addDependency(CORE, versionOf(CORE));
 		const gone = [];
-		for (const [path, specifier] of Object.entries(MOVED)) if (await ctx.removeIfUnchanged(path) === "kept") ctx.report.notes.push(`${path} is customised; its imports still point at it. Move the change into the app or eject.`);
+		for (const [path, specifier] of Object.entries(MOVED$2)) if (await ctx.removeIfUnchanged(path) === "kept") ctx.report.notes.push(`${path} is customised; its imports still point at it. Move the change into the app or eject.`);
 		else gone.push(specifier);
 		for (const specifier of gone) await ctx.rewriteImports(specifier, CORE);
 		await rewriteEnv(ctx);
@@ -3312,7 +3321,181 @@ const CODEMODS = [{
 		await allowFreshReleases(ctx);
 		await useLoggerOptions(ctx);
 	}
-}];
+};
+//#endregion
+//#region src/upgrade/codemods/db-testing.ts
+/** Copies replaced by a package export of the same name. */
+const MOVED$1 = [
+	{
+		path: "src/core/db/id.ts",
+		specifier: "#core/db/id",
+		to: "@tatara/db",
+		needsDb: true
+	},
+	{
+		path: "src/core/db/seed.ts",
+		specifier: "#core/db/seed",
+		to: "@tatara/db",
+		needsDb: true
+	},
+	{
+		path: "tests/helpers/database-url.ts",
+		specifier: "#tests/helpers/database-url",
+		to: "@tatara/testing",
+		needsDb: false
+	}
+];
+/** App files that stay, but become what this CLI generates (driver re-exports, thin helpers). */
+const REGENERATED = [
+	"src/core/db/admin.ts",
+	"src/core/db/migrate.ts",
+	"tests/helpers/api.ts",
+	"tests/global-setup.ts"
+];
+async function read$1(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+const dbTesting = {
+	version: "0.4.0",
+	id: "db-testing",
+	description: "Use @tatara/db (ids, seeds, driver helpers, migrations) and @tatara/testing",
+	async run(ctx) {
+		const hasDb = ctx.project.config.database !== "none";
+		if (hasDb) await ctx.addDependency("@tatara/db", versionOf("@tatara/db"));
+		await ctx.addDependency("@tatara/testing", versionOf("@tatara/testing"), { dev: true });
+		const regenerate = [];
+		for (const path of REGENERATED) {
+			const text = await read$1(ctx, path);
+			if (text === void 0) continue;
+			if (await ctx.baseline.isUnchanged(path, text)) regenerate.push(path);
+			else ctx.report.notes.push(`${path} is customised and was kept; compare it with a newly generated app.`);
+		}
+		const moved = MOVED$1.filter((m) => hasDb || !m.needsDb);
+		for (const path of regenerate) {
+			const next = await ctx.renderCurrent(path);
+			if (next !== void 0) await ctx.write(path, next);
+		}
+		for (const entry of moved) {
+			if (await ctx.removeIfUnchanged(entry.path) === "kept") {
+				ctx.report.notes.push(`${entry.path} is customised; its imports still point at it.`);
+				continue;
+			}
+			await ctx.rewriteImports(entry.specifier, entry.to);
+		}
+	}
+};
+//#endregion
+//#region src/upgrade/codemods/http-package.ts
+const HTTP = "@tatara/http";
+/** Wiring files the app keeps; replaced by what this CLI generates when the app never changed them. */
+const APP = "src/core/http/app.ts";
+const ROUTES = "src/core/http/routes.ts";
+const SERVERS = ["src/apps/api/server.ts", "src/apps/admin/server.ts"];
+/** Files @tatara/http replaces: import specifier, and the wiring files that import them. */
+const MOVED = [
+	{
+		path: "src/core/http/errors.ts",
+		specifier: "#core/http/errors",
+		usedBy: []
+	},
+	{
+		path: "src/core/http/response.ts",
+		specifier: "#core/http/response",
+		usedBy: []
+	},
+	{
+		path: "src/core/http/middleware/validation.ts",
+		specifier: "#core/http/middleware/validation",
+		usedBy: [APP, ROUTES]
+	},
+	{
+		path: "src/core/http/middleware/error-handler.ts",
+		specifier: "#core/http/middleware/error-handler",
+		usedBy: [APP]
+	},
+	{
+		path: "src/core/http/middleware/request-context.ts",
+		specifier: "#core/http/middleware/request-context",
+		usedBy: [APP]
+	},
+	{
+		path: "src/core/http/server.ts",
+		specifier: "#core/http/server",
+		usedBy: SERVERS
+	}
+];
+async function read(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+/** Files outside the group that import one of the moved files (they would break). */
+async function outsideImporters(ctx) {
+	const group = /* @__PURE__ */ new Set([
+		APP,
+		ROUTES,
+		...SERVERS,
+		...MOVED.map((m) => m.path)
+	]);
+	const specifiers = MOVED.filter((m) => m.usedBy.length > 0).map((m) => m.specifier);
+	const pattern = new RegExp(`["'](${specifiers.map((s) => s.replace(/[/.]/g, "\\$&")).join("|")})["']`);
+	const out = [];
+	for (const path of await glob(["src/**/*.ts", "tests/**/*.ts"], {
+		cwd: ctx.project.root,
+		ignore: ["src/generated/**"]
+	})) {
+		if (group.has(path)) continue;
+		if (pattern.test(await ctx.read(path))) out.push(path);
+	}
+	return out;
+}
+//#endregion
+//#region src/upgrade/codemods.ts
+/** Every codemod tatara ships, oldest first. Each step that moves code into a package adds one. */
+const CODEMODS = [
+	corePackage,
+	{
+		version: "0.3.0",
+		id: "http-package",
+		description: "Use @tatara/http for app setup, errors, the envelope, OpenAPI docs and the server",
+		async run(ctx) {
+			await ctx.addDependency(HTTP, versionOf(HTTP));
+			const blockers = [];
+			const replace = [];
+			for (const path of [
+				APP,
+				ROUTES,
+				...SERVERS
+			]) {
+				const text = await read(ctx, path);
+				if (text === void 0) continue;
+				if (await ctx.baseline.isUnchanged(path, text)) replace.push(path);
+				else blockers.push(`${path} is customised`);
+			}
+			const present = [];
+			for (const entry of MOVED) {
+				const text = await read(ctx, entry.path);
+				if (text === void 0) continue;
+				present.push(entry);
+				if (!await ctx.baseline.isUnchanged(entry.path, text)) blockers.push(`${entry.path} is customised`);
+			}
+			for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
+			if (blockers.length > 0) {
+				ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
+				return;
+			}
+			for (const path of replace) {
+				const next = await ctx.renderCurrent(path);
+				if (next !== void 0) await ctx.write(path, next);
+			}
+			for (const entry of present) await ctx.removeIfUnchanged(entry.path);
+			for (const specifier of [
+				"#core/http/errors",
+				"#core/http/response",
+				"#core/http/middleware/validation"
+			]) await ctx.rewriteImports(specifier, HTTP);
+		}
+	},
+	dbTesting
+];
 //#endregion
 //#region src/upgrade/context.ts
 const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -3320,13 +3503,19 @@ function createContext(project, baseline, opts = {}) {
 	const report = {
 		ran: [],
 		written: [],
+		regenerated: [],
 		removed: [],
 		kept: [],
 		notes: []
 	};
 	const abs = (path) => join(project.root, path);
+	let rendered;
 	const write = async (path, text) => {
-		if (!report.written.includes(path)) report.written.push(path);
+		if (!report.written.includes(path)) {
+			report.written.push(path);
+			const before = existsSync(abs(path)) ? await readFile(abs(path), "utf8") : void 0;
+			if (before === void 0 || await baseline.isUnchanged(path, before)) report.regenerated.push(path);
+		}
 		if (opts.dryRun) return;
 		await mkdir(dirname(abs(path)), { recursive: true });
 		await writeFile(abs(path), text);
@@ -3368,6 +3557,19 @@ function createContext(project, baseline, opts = {}) {
 			}
 			return changed;
 		},
+		async renderCurrent(path) {
+			const { name, orm, database, auth, authMethods, addons, packageManager } = project.config;
+			rendered ??= renderApp({
+				name,
+				orm,
+				database,
+				auth,
+				authMethods,
+				addons,
+				packageManager
+			});
+			return (await rendered).get(path);
+		},
 		async addDependency(name, range, { dev = false } = {}) {
 			const pkg = JSON.parse(await readFile(abs("package.json"), "utf8"));
 			const key = dev ? "devDependencies" : "dependencies";
@@ -3401,7 +3603,7 @@ async function nextRecord(project, report) {
 	const record = { ...project.config.generated?.files ?? {} };
 	for (const path of report.removed) delete record[path];
 	const current = await hashTrackedFiles(project.root);
-	for (const path of report.written) {
+	for (const path of report.regenerated) {
 		const hash = current[path];
 		if (hash) record[path] = hash;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/admin/files/src/apps/admin/server.ts

@@ -1,5 +1,6 @@
+import { startServer } from "@tatara/http";
 import { app } from "#apps/admin/app";
 import { env } from "#core/config/env";
-import { startServer } from "#core/http/server";
+import { logger } from "#core/logging/logger";
 
-startServer(app, env.ADMIN_PORT, "admin");
+startServer(app, { port: env.ADMIN_PORT, name: "admin", logger });

package/templates/features/admin/files/src/modules/example/routes/admin-greeting.routes.ts

@@ -1,6 +1,6 @@
 import { createRoute } from "@hono/zod-openapi";
 import { currentPrincipal } from "#core/auth/middleware";
-import { errorResponses, jsonContent, success, successSchema } from "#core/http/response";
+import { errorResponses, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 import { greetingSchema } from "#modules/example/validators/greeting.validators";
 

package/templates/features/auth/files/src/core/auth/middleware.ts

@@ -1,7 +1,7 @@
 import { createMiddleware } from "hono/factory";
 import type { Context } from "hono";
 import type { AppEnv, Principal } from "#core/http/context";
-import { ForbiddenError, UnauthorizedError } from "#core/http/errors";
+import { ForbiddenError, UnauthorizedError } from "@tatara/http";
 
 /** 401 unless the request carries a valid session or token. */
 export function requireAuth() {

package/templates/features/auth/files/src/core/auth/routes/me.routes.ts

@@ -1,6 +1,6 @@
 import { createRoute, z } from "@hono/zod-openapi";
 import { currentPrincipal, requireAuth } from "#core/auth/middleware";
-import { errorResponses, jsonContent, success, successSchema } from "#core/http/response";
+import { errorResponses, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 
 const principalSchema = z

package/templates/features/auth-keycloak/files/src/core/auth/tests/keycloak-tokens.test.ts

@@ -3,7 +3,7 @@ import { beforeEach, describe, expect, it } from "vitest";
 import { auth } from "#core/auth/auth";
 import { issuer } from "#core/auth/keycloak";
 import { env } from "#core/config/env";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 import { api } from "#tests/helpers/api";
 import { createTestUser, keycloakToken } from "#tests/helpers/auth";
 import { resetDatabase } from "#tests/helpers/db";

package/templates/features/auth-keycloak/files+auth-orgs/src/core/auth/tests/keycloak-organizations.test.ts

@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it } from "vitest";
 import { auth } from "#core/auth/auth";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 import { api } from "#tests/helpers/api";
 import { keycloakToken } from "#tests/helpers/auth";
 import { resetDatabase } from "#tests/helpers/db";

package/templates/features/authz/files/src/core/authz/db/seed.ts

@@ -1,5 +1,5 @@
 import { syncSystemRoles } from "#core/authz/services/sync";
-import { defineSeed } from "#core/db/seed";
+import { defineSeed } from "@tatara/db";
 
 export default defineSeed({
 	name: "authz:system-roles",

package/templates/features/authz/files/src/core/authz/middleware.ts

@@ -2,7 +2,7 @@ import { createMiddleware } from "hono/factory";
 import type { Scope } from "#core/authz/constants";
 import { checkPermission } from "#core/authz/resolver";
 import type { AppEnv } from "#core/http/context";
-import { ForbiddenError, UnauthorizedError } from "#core/http/errors";
+import { ForbiddenError, UnauthorizedError } from "@tatara/http";
 import type { PermissionKey } from "#generated/permissions";
 
 /**

package/templates/features/authz/files/src/core/authz/routes/authorization.routes.ts

@@ -19,7 +19,7 @@ import {
 	userParams,
 	userRoleParams,
 } from "#core/authz/validators";
-import { errorResponses, jsonBody, jsonContent, success, successSchema } from "#core/http/response";
+import { errorResponses, jsonBody, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 import { catalog } from "#generated/permissions";
 

package/templates/features/authz/files/src/core/authz/services/grants.ts

@@ -1,7 +1,7 @@
 import { assertGrantValid, InvalidGrantError, META_RESOURCES } from "#core/authz/catalog";
 import type { Scope } from "#core/authz/constants";
 import type { PermissionGrant } from "#core/authz/types";
-import { BusinessRuleError } from "#core/http/errors";
+import { BusinessRuleError } from "@tatara/http";
 import { catalog } from "#generated/permissions";
 
 /** Validates grants against the catalog; custom roles and overlays may not grant meta resources. */

package/templates/features/authz/files/src/core/authz/services/members.ts

@@ -3,7 +3,7 @@ import { type OverlayEffect, type Scope, SYSTEM_ACTOR } from "#core/authz/consta
 import { store } from "#core/authz/db/store";
 import { audit } from "#core/authz/services/audit";
 import { validateGrants } from "#core/authz/services/grants";
-import { NotFoundError } from "#core/http/errors";
+import { NotFoundError } from "@tatara/http";
 
 export async function getMember(orgId: string, userId: string) {
 	const [roles, overlays] = await Promise.all([

package/templates/features/authz/files/src/core/authz/services/roles.ts

@@ -4,7 +4,7 @@ import { audit } from "#core/authz/services/audit";
 import { validateGrants } from "#core/authz/services/grants";
 import { SYSTEM_ROLE_KEYS } from "#core/authz/system-roles";
 import type { RoleRow } from "#core/authz/types";
-import { BusinessRuleError, ConflictError, NotFoundError } from "#core/http/errors";
+import { BusinessRuleError, ConflictError, NotFoundError } from "@tatara/http";
 
 export interface RoleInput {
 	key: string;

package/templates/features/authz/files+drizzle/src/core/authz/db/store.ts

@@ -10,7 +10,7 @@ import {
 } from "#core/authz/db/authz.schema";
 import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "#core/authz/types";
 import { db } from "#core/db/client";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 
 const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
 

package/templates/features/authz/files+prisma/src/core/authz/db/store.ts

@@ -2,7 +2,7 @@ import type { OverlayEffect, Scope } from "#core/authz/constants";
 import { SYSTEM_ORG_ID } from "#core/authz/constants";
 import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "#core/authz/types";
 import { db } from "#core/db/client";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 
 const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
 

package/templates/features/base/files/src/apps/api/server.ts

@@ -1,5 +1,6 @@
+import { startServer } from "@tatara/http";
 import { app } from "#apps/api/app";
 import { env } from "#core/config/env";
-import { startServer } from "#core/http/server";
+import { logger } from "#core/logging/logger";
 
-startServer(app, env.PORT, "api");
+startServer(app, { port: env.PORT, name: "api", logger });

package/templates/features/base/files/src/core/http/app.ts

@@ -1,57 +1,38 @@
-import { OpenAPIHono } from "@hono/zod-openapi";
-import { Scalar } from "@scalar/hono-api-reference";
-import { bodyLimit } from "hono/body-limit";
-import { cors } from "hono/cors";
-import { secureHeaders } from "hono/secure-headers";
+import { createApp, handleErrors, mountRoutes, serveOpenApi } from "@tatara/http";
 import { env } from "#core/config/env";
 import type { AppEnv } from "#core/http/context";
-import { runReadinessChecks } from "@tatara/core";
-import { errorHandler, notFoundHandler } from "#core/http/middleware/error-handler";
-import { requestContext } from "#core/http/middleware/request-context";
-import { validationHook } from "#core/http/middleware/validation";
 import type { AppName } from "#core/http/routes";
+import { logger } from "#core/logging/logger";
 import { routes } from "#generated/routes";
 // tatara:slot imports
 
 export const API_PREFIX = "/api";
 
+/** The app's HTTP wiring: plain Hono, with tatara's defaults from @tatara/http. */
 export function createHttpApp(name: AppName, options: { title: string }) {
-	const app = new OpenAPIHono<AppEnv>({ defaultHook: validationHook });
-
-	app.use(requestContext);
-	app.use(secureHeaders());
-	app.use(
-		cors({
-			origin: env.CORS_ORIGINS,
-			credentials: true,
-			allowHeaders: ["Content-Type", "Authorization", "X-Request-Id", "Accept-Language"],
-			exposeHeaders: ["X-Request-Id"],
-		}),
-	);
-	app.use(bodyLimit({ maxSize: env.BODY_LIMIT_BYTES }));
-	// tatara:slot middleware
-
-	app.get("/health", (c) => c.json({ status: "ok" }));
-	app.get("/ready", async (c) => {
-		const result = await runReadinessChecks();
-		return c.json(result, result.ready ? 200 : 503);
+	const app = createApp<AppEnv>({
+		logger,
+		cors: {
+			origins: env.CORS_ORIGINS,
+			exposeHeaders: [
+				"X-Request-Id",
+				// tatara:slot expose-headers
+			],
+		},
+		bodyLimitBytes: env.BODY_LIMIT_BYTES,
+		defaults: { principal: null, language: "en" },
 	});
+	// tatara:slot middleware
 
 	// tatara:slot routes
 
-	for (const definition of routes) {
-		if (definition.app === name) app.route(`${API_PREFIX}${definition.basePath}`, definition.router);
-	}
-
-	const openApiConfig = { openapi: "3.1.0", info: { title: options.title, version: "1.0.0" } } as const;
-	app.get("/openapi.json", async (c) => {
-		const document = app.getOpenAPI31Document(openApiConfig);
-		// tatara:slot openapi
-		return c.json(document);
+	mountRoutes(app, routes, { app: name, prefix: API_PREFIX });
+	serveOpenApi(app, {
+		title: options.title,
+		// tatara:slot openapi-options
+	});
+	handleErrors(app, {
+		// tatara:slot error-options
 	});
-	app.get("/docs", Scalar({ url: "/openapi.json", pageTitle: options.title }));
-
-	app.onError(errorHandler);
-	app.notFound(notFoundHandler);
 	return app;
 }

package/templates/features/base/files/src/core/http/routes.ts

@@ -1,6 +1,8 @@
-import { OpenAPIHono } from "@hono/zod-openapi";
+import {
+	createRouter as createTataraRouter,
+	type RouteDefinition as TataraRouteDefinition,
+} from "@tatara/http";
 import type { AppEnv } from "#core/http/context";
-import { validationHook } from "#core/http/middleware/validation";
 
 export const APP_NAMES = [
 	"api",
@@ -9,13 +11,7 @@ export const APP_NAMES = [
 
 export type AppName = (typeof APP_NAMES)[number];
 
-export interface RouteDefinition {
-	/** which HTTP app serves these routes */
-	app: AppName;
-	/** mounted under `/api` + basePath, e.g. "/notes" */
-	basePath: string;
-	router: OpenAPIHono<AppEnv>;
-}
+export type RouteDefinition = TataraRouteDefinition<AppName, AppEnv>;
 
 /** Default export of every `routes/*.routes.ts`; discovered by `tatara sync`. */
 export function defineRoutes(definition: RouteDefinition): RouteDefinition {
@@ -23,6 +19,6 @@ export function defineRoutes(definition: RouteDefinition): RouteDefinition {
 }
 
 /** A router for one routes file. Attach middleware per route or per path, never `use("*")`. */
-export function createRouter(): OpenAPIHono<AppEnv> {
-	return new OpenAPIHono<AppEnv>({ defaultHook: validationHook });
+export function createRouter() {
+	return createTataraRouter<AppEnv>();
 }

package/templates/features/base/files/src/modules/example/routes/greeting.routes.ts

@@ -1,5 +1,5 @@
 import { createRoute } from "@hono/zod-openapi";
-import { errorResponses, jsonContent, success, successSchema } from "#core/http/response";
+import { errorResponses, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 import { greet } from "#modules/example/services/greeting.service";
 import {