@tatara/cli 0.3.0 → 0.5.0

package/dist/bin.mjs

@@ -286,7 +286,7 @@ export type PermissionKey =
 		const seeds = await find(root, dirs.map((d) => `${d}/db/seed.ts`));
 		await writeIfChanged(join(out, "seeds.ts"), listModule(seeds, {
 			prefix: "seed",
-			typeImport: "import type { SeedDefinition } from \"#core/db/seed\";",
+			typeImport: "import type { SeedDefinition } from \"@tatara/db\";",
 			typeName: "SeedDefinition",
 			exportName: "seeds"
 		}), written);
@@ -837,7 +837,7 @@ const admin = {
 		{
 			file: "src/core/http/app.ts",
 			slot: "imports",
-			content: "import { requireRole } from \"#core/auth/middleware\";"
+			content: "import { requireRole } from \"@tatara/auth\";"
 		},
 		{
 			file: "src/core/http/app.ts",
@@ -1057,8 +1057,8 @@ const i18n = {
 		},
 		{
 			file: "src/core/http/app.ts",
-			slot: "error-message",
-			content: "if (err.translatable) message = t(c.get(\"language\"), `errors.${err.code}`, message);"
+			slot: "error-options",
+			content: ["message: (err, c) =>", "	err.translatable ? t(c.get(\"language\"), `errors.${err.code}`, err.message) : err.message,"].join("\n")
 		},
 		{
 			file: "AGENTS.md",
@@ -1077,6 +1077,7 @@ const auth = {
 	id: "auth",
 	kind: "auth",
 	label: "Auth (shared)",
+	dependencies: ["@tatara/auth"],
 	slots: [
 		{
 			file: "src/core/http/app.ts",
@@ -1107,7 +1108,7 @@ const auth = {
 
 - \`c.var.principal\` is set for every request with valid credentials: \`{ userId, orgId, roles, kind }\`.
 - Protect routes with \`middleware: [requireAuth()]\` or \`requireRole("admin")\` from
-  \`#core/auth/middleware\`, and declare \`security: [{ bearerAuth: [] }]\` so the route is
+  \`@tatara/auth\`, and declare \`security: [{ bearerAuth: [] }]\` so the route is
   documented as protected. Read the caller with \`currentPrincipal(c)\`.
 - In tests, \`asUser()\` from \`#tests/helpers/auth\` returns headers for a fresh authenticated user.
 `
@@ -1121,7 +1122,7 @@ const BETTER_AUTH_AGENTS = `### better-auth
 - Sessions work as cookies (browsers) and as \`Authorization: Bearer <session token>\` (mobile, APIs).
 - Outside production, every email and SMS is kept in an in-memory outbox:
   \`GET /api/dev/outbox?to=<address>\` returns the latest messages, including sign-in codes.
-- To send real SMS, implement \`SmsSender\` in \`src/core/auth/sms.ts\`.
+- To send real SMS, implement \`SmsSender\` (from \`@tatara/auth\`) in \`src/core/auth/sms.ts\`.
 `;
 const drizzlePg = ["drizzle", "postgres"];
 const drizzleMy = ["drizzle", "mysql"];
@@ -1161,12 +1162,12 @@ const betterAuth = {
 		{
 			file: "src/core/http/app.ts",
 			slot: "imports",
-			content: "import { outboxEnabled, readOutbox } from \"#core/auth/delivery\";"
+			content: "import { outbox } from \"#core/auth/delivery\";"
 		},
 		{
 			file: "src/core/http/app.ts",
 			slot: "imports",
-			content: "import { mergeAuthOpenApi } from \"#core/auth/openapi\";"
+			content: "import { mergeAuthOpenApi } from \"@tatara/auth\";"
 		},
 		{
 			file: "src/core/http/app.ts",
@@ -1175,8 +1176,12 @@ const betterAuth = {
 		},
 		{
 			file: "src/core/http/app.ts",
-			slot: "openapi",
-			content: "if (name === \"api\") await mergeAuthOpenApi(document, `${API_PREFIX}/auth`);"
+			slot: "openapi-options",
+			content: [
+				"async extend(document) {",
+				"	if (name === \"api\") await mergeAuthOpenApi(document, auth, `${API_PREFIX}/auth`);",
+				"},"
+			].join("\n")
 		},
 		{
 			file: "src/core/http/app.ts",
@@ -1185,8 +1190,8 @@ const betterAuth = {
 			content: [
 				"if (name === \"api\") {",
 				"	app.on([\"GET\", \"POST\"], `${API_PREFIX}/auth/*`, (c) => auth.handler(c.req.raw));",
-				"	if (outboxEnabled()) {",
-				"		app.get(`${API_PREFIX}/dev/outbox`, (c) => c.json({ messages: readOutbox(c.req.query(\"to\")) }));",
+				"	if (outbox.enabled) {",
+				"		app.get(`${API_PREFIX}/dev/outbox`, (c) => c.json({ messages: outbox.read(c.req.query(\"to\")) }));",
 				"	}",
 				"}"
 			].join("\n")
@@ -1464,64 +1469,11 @@ const authOrgs = {
 		...adminFields
 	]
 };
-const KEYCLOAK_AGENTS = `### Keycloak
-
-- The API also accepts Keycloak access tokens (\`Authorization: Bearer <token>\`). The
-  \`keycloakTokens()\` better-auth plugin (\`src/core/auth/keycloak-plugin.ts\`) verifies signature,
-  issuer, audience \`__APP_NAME__-api\` and expiry; login happens in the frontend via OIDC (PKCE)
-  against the \`__APP_NAME__-web\` client.
-- The token's subject is the user id. The user (and a \`keycloak\` account) is created in
-  better-auth's tables on first use; a token whose email already belongs to another account is
-  rejected. Service-account tokens become \`kind: "service"\` principals with no user row.
-- Roles come from the token (realm roles, \`roles\`, and client roles for the API); a role named like
-  a built-in authz role grants it. The organization comes from the \`organization\` claim.
-- Local dev realm: \`keycloak/realm.json\` (users alice/alice with admin, bob/bob).
-  \`__PM_EXEC__ tatara run keycloak:token --user alice\` prints a token for curl.
-- Tests sign tokens with a local key: \`keycloakToken()\` from \`#tests/helpers/auth\`.
-`;
-const KEYCLOAK_TEST_HELPER = [
-	"const { publicKey, privateKey } = await generateKeyPair(\"RS256\");",
-	"setKeySource(async (header) => {",
-	"	if (header.kid !== \"test\") throw new Error(\"unknown key\");",
-	"	return publicKey;",
-	"});",
-	"",
-	"export interface KeycloakTokenOptions {",
-	"	sub?: string;",
-	"	email?: string;",
-	"	emailVerified?: boolean;",
-	"	roles?: string[];",
-	"	organization?: string[] | Record<string, unknown>;",
-	"	username?: string;",
-	"	issuer?: string;",
-	"	audience?: string;",
-	"	expiresIn?: string | number;",
-	"}",
-	"",
-	"/** Signs an access token the API accepts, as if Keycloak issued it. */",
-	"export async function keycloakToken(options: KeycloakTokenOptions = {}): Promise<string> {",
-	"	const sub = options.sub ?? newId();",
-	"	return new SignJWT({",
-	"		email: options.email ?? `user-${sub}@example.com`,",
-	"		email_verified: options.emailVerified ?? true,",
-	"		preferred_username: options.username ?? `user-${sub.slice(0, 8)}`,",
-	"		roles: options.roles ?? [\"user\"],",
-	"		...(options.organization ? { organization: options.organization } : {}),",
-	"	})",
-	"		.setProtectedHeader({ alg: \"RS256\", kid: \"test\" })",
-	"		.setSubject(sub)",
-	"		.setIssuer(options.issuer ?? issuer)",
-	"		.setAudience(options.audience ?? env.KEYCLOAK_AUDIENCE)",
-	"		.setIssuedAt()",
-	"		.setExpirationTime(options.expiresIn ?? \"5m\")",
-	"		.sign(privateKey);",
-	"}"
-].join("\n");
 const authKeycloak = {
 	id: "auth-keycloak",
 	kind: "auth-method",
 	label: "Keycloak tokens",
-	dependencies: ["jose"],
+	dependencies: ["@tatara/keycloak", "jose"],
 	env: [
 		{
 			key: "KEYCLOAK_PORT",
@@ -1570,53 +1522,56 @@ const authKeycloak = {
 		{
 			file: "src/core/auth/auth.ts",
 			slot: "imports",
-			content: "import { keycloakTokens } from \"#core/auth/keycloak-plugin\";"
+			content: "import { keycloakTokens } from \"@tatara/keycloak\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { keycloak } from \"#core/auth/keycloak\";"
+		},
+		{
+			file: "src/core/auth/auth.ts",
+			slot: "imports",
+			content: "import { logger } from \"#core/logging/logger\";"
 		},
 		{
 			file: "src/core/auth/auth.ts",
 			slot: "plugins",
 			unless: ["auth-orgs"],
-			content: "keycloakTokens(),",
+			content: "keycloakTokens({ verifier: keycloak, logger }),",
 			order: 800
 		},
 		{
 			file: "src/core/auth/auth.ts",
 			slot: "plugins",
 			when: ["auth-orgs"],
-			content: "keycloakTokens({ organizations: true }),",
+			content: "keycloakTokens({ verifier: keycloak, logger, organizations: true }),",
 			order: 800
 		},
 		{
 			file: "src/core/auth/principal.ts",
-			slot: "no-session",
-			content: [
-				"if (!session) {",
-				"	const header = c.req.header(\"authorization\");",
-				"	const token = header?.startsWith(\"Bearer \") ? header.slice(7) : undefined;",
-				"	const principal = token ? await auth.api.verifyKeycloakToken({ body: { token } }) : null;",
-				"	if (principal) c.set(\"principal\", principal);",
-				"}"
-			].join("\n")
+			slot: "resolvers",
+			content: "(c) => keycloakPrincipal(auth, c.req.header(\"authorization\")),"
 		},
 		{
-			file: "tests/helpers/auth.ts",
+			file: "src/core/auth/principal.ts",
 			slot: "imports",
-			content: "import { generateKeyPair, SignJWT } from \"jose\";"
+			content: "import { keycloakPrincipal } from \"@tatara/keycloak\";"
 		},
 		{
 			file: "tests/helpers/auth.ts",
 			slot: "imports",
-			content: "import { issuer, setKeySource } from \"#core/auth/keycloak\";"
+			content: "import { useTestKeys } from \"@tatara/keycloak/testing\";"
 		},
 		{
 			file: "tests/helpers/auth.ts",
 			slot: "imports",
-			content: "import { env } from \"#core/config/env\";"
+			content: "import { keycloak } from \"#core/auth/keycloak\";"
 		},
 		{
 			file: "tests/helpers/auth.ts",
 			slot: "helpers",
-			content: KEYCLOAK_TEST_HELPER
+			content: ["/** Signs an access token the API accepts, as if Keycloak issued it. */", "export const keycloakToken = await useTestKeys(keycloak);"].join("\n")
 		},
 		{
 			file: "tests/helpers/auth.ts",
@@ -1624,7 +1579,7 @@ const authKeycloak = {
 			unless: ["auth-orgs"],
 			content: [
 				"if (options.roles) {",
-				"	const sub = newId();",
+				"	const sub = crypto.randomUUID();",
 				"	const token = await keycloakToken({ sub, roles: options.roles, email: options.email });",
 				"	return { userId: sub, headers: { authorization: `Bearer ${token}` } };",
 				"}"
@@ -1633,7 +1588,21 @@ const authKeycloak = {
 		{
 			file: "AGENTS.md",
 			slot: "sections",
-			content: KEYCLOAK_AGENTS
+			content: `### Keycloak
+
+- The API also accepts Keycloak access tokens (\`Authorization: Bearer <token>\`). The
+  \`keycloakTokens()\` better-auth plugin (\`@tatara/keycloak\`) verifies signature,
+  issuer, audience \`__APP_NAME__-api\` and expiry; login happens in the frontend via OIDC (PKCE)
+  against the \`__APP_NAME__-web\` client.
+- The token's subject is the user id. The user (and a \`keycloak\` account) is created in
+  better-auth's tables on first use; a token whose email already belongs to another account is
+  rejected. Service-account tokens become \`kind: "service"\` principals with no user row.
+- Roles come from the token (realm roles, \`roles\`, and client roles for the API); a role named like
+  a built-in authz role grants it. The organization comes from the \`organization\` claim.
+- Local dev realm: \`keycloak/realm.json\` (users alice/alice with admin, bob/bob).
+  \`__PM_EXEC__ tatara run keycloak:token --user alice\` prints a token for curl.
+- Tests sign tokens with a local key: \`keycloakToken()\` from \`#tests/helpers/auth\`.
+`
 		}
 	]
 };
@@ -1655,6 +1624,7 @@ const base = {
 		"pino"
 	],
 	devDependencies: [
+		"@tatara/testing",
 		"@tatara/cli",
 		"typescript",
 		"@types/node",
@@ -1852,6 +1822,7 @@ const db$1 = {
 	id: "db",
 	kind: "database",
 	label: "Database (shared)",
+	dependencies: ["@tatara/db"],
 	scripts: {
 		"db:generate": "tatara db generate",
 		"db:migrate": "tatara db migrate",
@@ -1874,7 +1845,7 @@ const db$1 = {
 			file: "tests/setup.ts",
 			slot: "setup",
 			content: [
-				"import { workerDatabaseUrl } from \"#tests/helpers/database-url\";",
+				"import { workerDatabaseUrl } from \"@tatara/testing\";",
 				"",
 				"// One database per worker, created by tests/global-setup.ts.",
 				"process.env.DATABASE_URL = workerDatabaseUrl(process.env.DATABASE_URL ?? \"\", process.env.VITEST_POOL_ID ?? \"1\");"
@@ -2485,7 +2456,7 @@ function guardSlots(project, n) {
 		for (const [route, action] of Object.entries(ACTIONS)) add(`guard-${route}`, `middleware: [requirePermission("${n.kebab}:${action}")] as const,\nsecurity: [{ bearerAuth: ["${n.kebab}:${action}"] }],`);
 		add("auth-errors", "...errorResponses(401, 403),");
 	} else if (project.has("auth")) {
-		add("imports", "import { requireAuth } from \"#core/auth/middleware\";");
+		add("imports", "import { requireAuth } from \"@tatara/auth\";");
 		for (const route of Object.keys(ACTIONS)) add(`guard-${route}`, "middleware: [requireAuth()] as const,\nsecurity: [{ bearerAuth: [] }],");
 		add("auth-errors", "...errorResponses(401),");
 	}
@@ -3215,10 +3186,151 @@ function createBaseline(project, deps) {
 	} };
 }
 //#endregion
+//#region src/upgrade/codemods/auth-package.ts
+const AUTH = "@tatara/auth";
+const KEYCLOAK = "@tatara/keycloak";
+const APP$1 = "src/core/http/app.ts";
+const HELPERS = "tests/helpers/auth.ts";
+function groups(keycloak) {
+	const all = [
+		{
+			name: "OpenAPI merge and dev outbox",
+			regenerate: [APP$1, "src/core/auth/delivery.ts"],
+			remove: ["src/core/auth/openapi.ts"],
+			exports: [{ specifier: "#core/auth/openapi" }, {
+				specifier: "#core/auth/delivery",
+				names: [
+					"outboxEnabled",
+					"readOutbox",
+					"OutboxMessage"
+				]
+			}]
+		},
+		{
+			name: "SMS sender",
+			regenerate: ["src/core/auth/sms.ts"],
+			remove: [],
+			exports: [{
+				specifier: "#core/auth/sms",
+				names: ["SmsSender"]
+			}]
+		},
+		{
+			name: "principal middleware",
+			regenerate: ["src/core/auth/principal.ts"],
+			remove: [],
+			exports: []
+		}
+	];
+	if (!keycloak) {
+		all.push({
+			name: "test helpers",
+			regenerate: [HELPERS],
+			remove: [],
+			exports: []
+		});
+		return all;
+	}
+	all.push({
+		name: "Keycloak",
+		regenerate: [
+			"src/core/auth/auth.ts",
+			"src/core/auth/keycloak.ts",
+			"src/core/auth/commands/keycloak-token.ts",
+			"src/core/auth/tests/keycloak-tokens.test.ts",
+			HELPERS
+		],
+		remove: ["src/core/auth/keycloak-plugin.ts"],
+		exports: [
+			{ specifier: "#core/auth/keycloak-plugin" },
+			{
+				specifier: "#core/auth/keycloak",
+				names: [
+					"issuer",
+					"setKeySource",
+					"verifyAccessToken",
+					"rolesOf",
+					"organizationOf",
+					"KeycloakClaims"
+				]
+			},
+			{
+				specifier: "#tests/helpers/auth",
+				names: ["KeycloakTokenOptions"]
+			}
+		]
+	});
+	return all;
+}
+async function read$2(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+const escapeRegExp$1 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** True when `text` imports `entry` (or one of its gone names). */
+function usesExport(text, entry) {
+	const from = new RegExp(`import\\s+(?:type\\s+)?([^;]*?)\\s+from\\s+["']${escapeRegExp$1(entry.specifier)}["']`, "g");
+	const gone = entry.names;
+	for (const match of text.matchAll(from)) {
+		if (!gone) return true;
+		const braces = (match[1] ?? "").match(/\{([^}]*)\}/);
+		if (!braces) return true;
+		if ((braces[1] ?? "").split(",").map((part) => part.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim()).some((name) => name && gone.includes(name))) return true;
+	}
+	return false;
+}
+/** Why the group can't move, or [] when it can. */
+async function blockersOf(ctx, group, sources) {
+	const blockers = [];
+	for (const path of [...group.regenerate, ...group.remove]) {
+		const text = await read$2(ctx, path);
+		if (text === void 0) continue;
+		if (!await ctx.baseline.isUnchanged(path, text)) blockers.push(`${path} is customised`);
+	}
+	const own = /* @__PURE__ */ new Set([...group.regenerate, ...group.remove]);
+	for (const path of sources) {
+		if (own.has(path)) continue;
+		const text = await ctx.read(path);
+		if (group.exports.some((entry) => usesExport(text, entry))) blockers.push(`${path} imports what moves`);
+	}
+	return blockers;
+}
+const authPackage = {
+	version: "0.5.0",
+	id: "auth-package",
+	description: "Use @tatara/auth (guards, principal, OpenAPI merge, outbox) and @tatara/keycloak",
+	async run(ctx) {
+		const { config } = ctx.project;
+		if (config.auth === "none") return;
+		const keycloak = config.authMethods.includes("keycloak");
+		await ctx.addDependency(AUTH, versionOf(AUTH));
+		if (keycloak) await ctx.addDependency(KEYCLOAK, versionOf(KEYCLOAK));
+		const sources = await glob(["src/**/*.ts", "tests/**/*.ts"], {
+			cwd: ctx.project.root,
+			ignore: ["src/generated/**"]
+		});
+		const ready = [];
+		for (const group of groups(keycloak)) {
+			const blockers = await blockersOf(ctx, group, sources);
+			if (blockers.length === 0) ready.push(group);
+			else ctx.report.notes.push(`${group.name} was not moved onto ${group.name === "Keycloak" ? KEYCLOAK : AUTH}: ${blockers.join("; ")}. Compare these files with a newly generated app and move them by hand.`);
+		}
+		for (const group of ready) {
+			for (const path of group.regenerate) {
+				if (await read$2(ctx, path) === void 0) continue;
+				const next = await ctx.renderCurrent(path);
+				if (next !== void 0) await ctx.write(path, next);
+			}
+			for (const path of group.remove) await ctx.removeIfUnchanged(path);
+		}
+		if (await ctx.removeIfUnchanged("src/core/auth/middleware.ts") === "kept") ctx.report.notes.push("src/core/auth/middleware.ts is customised; its imports still point at it.");
+		else await ctx.rewriteImports("#core/auth/middleware", AUTH);
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/core-package.ts
 const CORE = "@tatara/core";
 /** Files @tatara/core replaces, with the import specifier apps used for each. */
-const MOVED$1 = {
+const MOVED$2 = {
 	"src/core/commands/define.ts": "#core/commands/define",
 	"src/core/commands/runner.ts": "#core/commands/runner",
 	"src/core/process/lifecycle.ts": "#core/process/lifecycle",
@@ -3253,8 +3365,8 @@ async function rewriteEnv(ctx) {
 }
 /** Only call sites of functions that now come from @tatara/core take the logger argument. */
 async function passLogger(ctx, gone) {
-	const runnerGone = gone.includes(MOVED$1["src/core/commands/runner.ts"]);
-	const lifecycleGone = gone.includes(MOVED$1["src/core/process/lifecycle.ts"]);
+	const runnerGone = gone.includes(MOVED$2["src/core/commands/runner.ts"]);
+	const lifecycleGone = gone.includes(MOVED$2["src/core/process/lifecycle.ts"]);
 	const cli = await exists(ctx, CLI_ENTRY);
 	if (cli) {
 		let next = cli;
@@ -3307,7 +3419,7 @@ const corePackage = {
 	async run(ctx) {
 		await ctx.addDependency(CORE, versionOf(CORE));
 		const gone = [];
-		for (const [path, specifier] of Object.entries(MOVED$1)) if (await ctx.removeIfUnchanged(path) === "kept") ctx.report.notes.push(`${path} is customised; its imports still point at it. Move the change into the app or eject.`);
+		for (const [path, specifier] of Object.entries(MOVED$2)) if (await ctx.removeIfUnchanged(path) === "kept") ctx.report.notes.push(`${path} is customised; its imports still point at it. Move the change into the app or eject.`);
 		else gone.push(specifier);
 		for (const specifier of gone) await ctx.rewriteImports(specifier, CORE);
 		await rewriteEnv(ctx);
@@ -3317,6 +3429,68 @@ const corePackage = {
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/db-testing.ts
+/** Copies replaced by a package export of the same name. */
+const MOVED$1 = [
+	{
+		path: "src/core/db/id.ts",
+		specifier: "#core/db/id",
+		to: "@tatara/db",
+		needsDb: true
+	},
+	{
+		path: "src/core/db/seed.ts",
+		specifier: "#core/db/seed",
+		to: "@tatara/db",
+		needsDb: true
+	},
+	{
+		path: "tests/helpers/database-url.ts",
+		specifier: "#tests/helpers/database-url",
+		to: "@tatara/testing",
+		needsDb: false
+	}
+];
+/** App files that stay, but become what this CLI generates (driver re-exports, thin helpers). */
+const REGENERATED = [
+	"src/core/db/admin.ts",
+	"src/core/db/migrate.ts",
+	"tests/helpers/api.ts",
+	"tests/global-setup.ts"
+];
+async function read$1(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+const dbTesting = {
+	version: "0.4.0",
+	id: "db-testing",
+	description: "Use @tatara/db (ids, seeds, driver helpers, migrations) and @tatara/testing",
+	async run(ctx) {
+		const hasDb = ctx.project.config.database !== "none";
+		if (hasDb) await ctx.addDependency("@tatara/db", versionOf("@tatara/db"));
+		await ctx.addDependency("@tatara/testing", versionOf("@tatara/testing"), { dev: true });
+		const regenerate = [];
+		for (const path of REGENERATED) {
+			const text = await read$1(ctx, path);
+			if (text === void 0) continue;
+			if (await ctx.baseline.isUnchanged(path, text)) regenerate.push(path);
+			else ctx.report.notes.push(`${path} is customised and was kept; compare it with a newly generated app.`);
+		}
+		const moved = MOVED$1.filter((m) => hasDb || !m.needsDb);
+		for (const path of regenerate) {
+			const next = await ctx.renderCurrent(path);
+			if (next !== void 0) await ctx.write(path, next);
+		}
+		for (const entry of moved) {
+			if (await ctx.removeIfUnchanged(entry.path) === "kept") {
+				ctx.report.notes.push(`${entry.path} is customised; its imports still point at it.`);
+				continue;
+			}
+			await ctx.rewriteImports(entry.specifier, entry.to);
+		}
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/http-package.ts
 const HTTP = "@tatara/http";
 /** Wiring files the app keeps; replaced by what this CLI generates when the app never changed them. */
@@ -3382,48 +3556,53 @@ async function outsideImporters(ctx) {
 //#endregion
 //#region src/upgrade/codemods.ts
 /** Every codemod tatara ships, oldest first. Each step that moves code into a package adds one. */
-const CODEMODS = [corePackage, {
-	version: "0.3.0",
-	id: "http-package",
-	description: "Use @tatara/http for app setup, errors, the envelope, OpenAPI docs and the server",
-	async run(ctx) {
-		await ctx.addDependency(HTTP, versionOf(HTTP));
-		const blockers = [];
-		const replace = [];
-		for (const path of [
-			APP,
-			ROUTES,
-			...SERVERS
-		]) {
-			const text = await read(ctx, path);
-			if (text === void 0) continue;
-			if (await ctx.baseline.isUnchanged(path, text)) replace.push(path);
-			else blockers.push(`${path} is customised`);
-		}
-		const present = [];
-		for (const entry of MOVED) {
-			const text = await read(ctx, entry.path);
-			if (text === void 0) continue;
-			present.push(entry);
-			if (!await ctx.baseline.isUnchanged(entry.path, text)) blockers.push(`${entry.path} is customised`);
-		}
-		for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
-		if (blockers.length > 0) {
-			ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
-			return;
-		}
-		for (const path of replace) {
-			const next = await ctx.renderCurrent(path);
-			if (next !== void 0) await ctx.write(path, next);
+const CODEMODS = [
+	corePackage,
+	{
+		version: "0.3.0",
+		id: "http-package",
+		description: "Use @tatara/http for app setup, errors, the envelope, OpenAPI docs and the server",
+		async run(ctx) {
+			await ctx.addDependency(HTTP, versionOf(HTTP));
+			const blockers = [];
+			const replace = [];
+			for (const path of [
+				APP,
+				ROUTES,
+				...SERVERS
+			]) {
+				const text = await read(ctx, path);
+				if (text === void 0) continue;
+				if (await ctx.baseline.isUnchanged(path, text)) replace.push(path);
+				else blockers.push(`${path} is customised`);
+			}
+			const present = [];
+			for (const entry of MOVED) {
+				const text = await read(ctx, entry.path);
+				if (text === void 0) continue;
+				present.push(entry);
+				if (!await ctx.baseline.isUnchanged(entry.path, text)) blockers.push(`${entry.path} is customised`);
+			}
+			for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
+			if (blockers.length > 0) {
+				ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
+				return;
+			}
+			for (const path of replace) {
+				const next = await ctx.renderCurrent(path);
+				if (next !== void 0) await ctx.write(path, next);
+			}
+			for (const entry of present) await ctx.removeIfUnchanged(entry.path);
+			for (const specifier of [
+				"#core/http/errors",
+				"#core/http/response",
+				"#core/http/middleware/validation"
+			]) await ctx.rewriteImports(specifier, HTTP);
 		}
-		for (const entry of present) await ctx.removeIfUnchanged(entry.path);
-		for (const specifier of [
-			"#core/http/errors",
-			"#core/http/response",
-			"#core/http/middleware/validation"
-		]) await ctx.rewriteImports(specifier, HTTP);
-	}
-}];
+	},
+	dbTesting,
+	authPackage
+];
 //#endregion
 //#region src/upgrade/context.ts
 const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/admin/files/src/modules/example/routes/admin-greeting.routes.ts

@@ -1,5 +1,5 @@
 import { createRoute } from "@hono/zod-openapi";
-import { currentPrincipal } from "#core/auth/middleware";
+import { currentPrincipal } from "@tatara/auth";
 import { errorResponses, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 import { greetingSchema } from "#modules/example/validators/greeting.validators";

package/templates/features/auth/files/src/core/auth/routes/me.routes.ts

@@ -1,5 +1,5 @@
 import { createRoute, z } from "@hono/zod-openapi";
-import { currentPrincipal, requireAuth } from "#core/auth/middleware";
+import { currentPrincipal, requireAuth } from "@tatara/auth";
 import { errorResponses, jsonContent, success, successSchema } from "@tatara/http";
 import { createRouter, defineRoutes } from "#core/http/routes";
 

package/templates/features/auth-keycloak/files/src/core/auth/commands/keycloak-token.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { issuer } from "#core/auth/keycloak";
+import { keycloak } from "#core/auth/keycloak";
 import { defineCommand } from "@tatara/core";
 import { env } from "#core/config/env";
 
@@ -13,7 +13,7 @@ export default defineCommand({
 	}),
 	async run({ user, password, client }) {
 		if (env.NODE_ENV === "production") throw new Error("keycloak:token is for development only");
-		const res = await fetch(`${issuer}/protocol/openid-connect/token`, {
+		const res = await fetch(`${keycloak.issuer}/protocol/openid-connect/token`, {
 			method: "POST",
 			headers: { "content-type": "application/x-www-form-urlencoded" },
 			body: new URLSearchParams({