@tatara/cli 0.5.0 → 0.7.0

package/templates/features/authz/files/src/core/authz/routes/authorization.routes.ts

@@ -1,281 +1,10 @@
-import { createRoute, z } from "@hono/zod-openapi";
-import { currentPrincipal, requireAuth } from "@tatara/auth";
-import { requirePermission } from "#core/authz/middleware";
-import { effectivePermissions, orgOf } from "#core/authz/resolver";
-import { listAudit } from "#core/authz/services/audit";
-import { addOverlay, assignRole, getMember, removeOverlay, revokeRole } from "#core/authz/services/members";
-import { createRole, deleteRole, listRoles, updateRole } from "#core/authz/services/roles";
-import type { OverlayRow } from "#core/authz/types";
-import {
-	auditEntrySchema,
-	createRoleSchema,
-	idParams,
-	memberSchema,
-	myPermissionsSchema,
-	overlayInputSchema,
-	roleSchema,
-	updateRoleSchema,
-	userOverlayParams,
-	userParams,
-	userRoleParams,
-} from "#core/authz/validators";
-import { errorResponses, jsonBody, jsonContent, success, successSchema } from "@tatara/http";
-import { createRouter, defineRoutes } from "#core/http/routes";
-import { catalog } from "#generated/permissions";
-
-const router = createRouter();
-const tags = ["Authorization"];
-const toOverlay = (o: OverlayRow) => ({
-	id: o.id,
-	resource: o.resource,
-	action: o.action,
-	scope: o.scope,
-	effect: o.effect,
-	reason: o.reason,
-	expiresAt: o.expiresAt ? o.expiresAt.toISOString() : null,
+import { authorizationRoutes } from "@tatara/authz";
+import { authz } from "#core/authz/index";
+import type { AppEnv } from "#core/http/context";
+import { defineRoutes } from "#core/http/routes";
+
+export default defineRoutes({
+	app: "api",
+	basePath: "/authorization",
+	router: authorizationRoutes<AppEnv>(authz),
 });
-
-router.openapi(
-	createRoute({
-		method: "get",
-		path: "/catalog",
-		tags,
-		summary: "Every permission the API knows",
-		middleware: [requireAuth()] as const,
-		security: [{ bearerAuth: [] }],
-		responses: {
-			200: jsonContent(
-				successSchema(z.object({ keys: z.array(z.string()), resources: z.record(z.string(), z.unknown()) })),
-				"Permission catalog",
-			),
-			...errorResponses(401),
-		},
-	}),
-	(c) => c.json(success({ keys: catalog.keys, resources: catalog.resources }), 200),
-);
-
-router.openapi(
-	createRoute({
-		method: "get",
-		path: "/me",
-		tags,
-		summary: "The caller's effective permissions in their org",
-		middleware: [requireAuth()] as const,
-		security: [{ bearerAuth: [] }],
-		responses: { 200: jsonContent(successSchema(myPermissionsSchema), "Effective permissions"), ...errorResponses(401) },
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const permissions = await effectivePermissions(principal);
-		return c.json(
-			success({
-				orgId: orgOf(principal),
-				roles: permissions.roles,
-				grants: permissions.grants,
-				denies: [...permissions.denies],
-			}),
-			200,
-		);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "get",
-		path: "/roles",
-		tags,
-		summary: "Built-in roles and the org's custom roles",
-		middleware: [requirePermission("role:read")] as const,
-		security: [{ bearerAuth: ["role:read"] }],
-		responses: { 200: jsonContent(successSchema(z.array(roleSchema)), "Roles"), ...errorResponses(401, 403) },
-	}),
-	async (c) => c.json(success(await listRoles(orgOf(currentPrincipal(c)))), 200),
-);
-
-router.openapi(
-	createRoute({
-		method: "post",
-		path: "/roles",
-		tags,
-		summary: "Create a custom role",
-		middleware: [requirePermission("role:create")] as const,
-		security: [{ bearerAuth: ["role:create"] }],
-		request: { body: jsonBody(createRoleSchema, "The role") },
-		responses: {
-			201: jsonContent(successSchema(roleSchema), "Created"),
-			...errorResponses(400, 409),
-			...errorResponses(401, 403),
-		},
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const role = await createRole(principal.userId, orgOf(principal), c.req.valid("json"));
-		return c.json(success(role), 201);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "patch",
-		path: "/roles/{id}",
-		tags,
-		summary: "Update a custom role",
-		middleware: [requirePermission("role:update")] as const,
-		security: [{ bearerAuth: ["role:update"] }],
-		request: { params: idParams, body: jsonBody(updateRoleSchema, "Fields to change") },
-		responses: {
-			200: jsonContent(successSchema(roleSchema), "Updated"),
-			...errorResponses(400, 404),
-			...errorResponses(401, 403),
-		},
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const role = await updateRole(principal.userId, orgOf(principal), c.req.valid("param").id, c.req.valid("json"));
-		return c.json(success(role), 200);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "delete",
-		path: "/roles/{id}",
-		tags,
-		summary: "Delete a custom role that no member holds",
-		middleware: [requirePermission("role:delete")] as const,
-		security: [{ bearerAuth: ["role:delete"] }],
-		request: { params: idParams },
-		responses: { 204: { description: "Deleted" }, ...errorResponses(400, 404, 409), ...errorResponses(401, 403) },
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		await deleteRole(principal.userId, orgOf(principal), c.req.valid("param").id);
-		return c.body(null, 204);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "get",
-		path: "/members/{userId}",
-		tags,
-		summary: "A member's roles and overlays",
-		middleware: [requirePermission("member:read")] as const,
-		security: [{ bearerAuth: ["member:read"] }],
-		request: { params: userParams },
-		responses: { 200: jsonContent(successSchema(memberSchema), "Member"), ...errorResponses(401, 403) },
-	}),
-	async (c) => {
-		const member = await getMember(orgOf(currentPrincipal(c)), c.req.valid("param").userId);
-		return c.json(success({ ...member, overlays: member.overlays.map(toOverlay) }), 200);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "post",
-		path: "/members/{userId}/roles",
-		tags,
-		summary: "Assign a role to a member",
-		middleware: [requirePermission("member:update")] as const,
-		security: [{ bearerAuth: ["member:update"] }],
-		request: { params: userParams, body: jsonBody(z.object({ roleId: z.string() }), "Role") },
-		responses: {
-			200: jsonContent(successSchema(z.object({ assigned: z.boolean() })), "Assigned"),
-			...errorResponses(404),
-			...errorResponses(401, 403),
-		},
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const assigned = await assignRole(
-			principal.userId,
-			orgOf(principal),
-			c.req.valid("param").userId,
-			c.req.valid("json").roleId,
-		);
-		return c.json(success({ assigned }), 200);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "delete",
-		path: "/members/{userId}/roles/{roleId}",
-		tags,
-		summary: "Revoke a role from a member",
-		middleware: [requirePermission("member:update")] as const,
-		security: [{ bearerAuth: ["member:update"] }],
-		request: { params: userRoleParams },
-		responses: { 204: { description: "Revoked" }, ...errorResponses(404), ...errorResponses(401, 403) },
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const { userId, roleId } = c.req.valid("param");
-		await revokeRole(principal.userId, orgOf(principal), userId, roleId);
-		return c.body(null, 204);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "post",
-		path: "/members/{userId}/overlays",
-		tags,
-		summary: "Grant or deny one permission to a member",
-		middleware: [requirePermission("member:update")] as const,
-		security: [{ bearerAuth: ["member:update"] }],
-		request: { params: userParams, body: jsonBody(overlayInputSchema, "Overlay") },
-		responses: {
-			201: jsonContent(successSchema(z.object({ id: z.string() })), "Created"),
-			...errorResponses(400),
-			...errorResponses(401, 403),
-		},
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const body = c.req.valid("json");
-		const id = await addOverlay(principal.userId, orgOf(principal), c.req.valid("param").userId, {
-			...body,
-			expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
-		});
-		return c.json(success({ id }), 201);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "delete",
-		path: "/members/{userId}/overlays/{overlayId}",
-		tags,
-		summary: "Remove an overlay",
-		middleware: [requirePermission("member:update")] as const,
-		security: [{ bearerAuth: ["member:update"] }],
-		request: { params: userOverlayParams },
-		responses: { 204: { description: "Removed" }, ...errorResponses(404), ...errorResponses(401, 403) },
-	}),
-	async (c) => {
-		const principal = currentPrincipal(c);
-		const { userId, overlayId } = c.req.valid("param");
-		await removeOverlay(principal.userId, orgOf(principal), userId, overlayId);
-		return c.body(null, 204);
-	},
-);
-
-router.openapi(
-	createRoute({
-		method: "get",
-		path: "/audit",
-		tags,
-		summary: "Recent authorization changes in the org",
-		middleware: [requirePermission("audit_log:read")] as const,
-		security: [{ bearerAuth: ["audit_log:read"] }],
-		responses: { 200: jsonContent(successSchema(z.array(auditEntrySchema)), "Audit log"), ...errorResponses(401, 403) },
-	}),
-	async (c) => {
-		const rows = await listAudit(orgOf(currentPrincipal(c)));
-		return c.json(success(rows.map((r) => ({ ...r, at: r.at.toISOString() }))), 200);
-	},
-);
-
-export default defineRoutes({ app: "api", basePath: "/authorization", router });

package/templates/features/authz/files/src/core/authz/system-roles.ts

@@ -5,5 +5,3 @@ export const SYSTEM_ROLES = [
 ] as const;
 
 export type SystemRoleKey = (typeof SYSTEM_ROLES)[number]["key"];
-
-export const SYSTEM_ROLE_KEYS: ReadonlySet<string> = new Set(SYSTEM_ROLES.map((r) => r.key));

package/templates/features/authz/files/src/core/authz/tests/authz.test.ts

@@ -1,6 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
-import { allows } from "#core/authz/resolver";
-import type { EffectivePermissions } from "#core/authz/types";
+import { allows, type EffectivePermissions } from "@tatara/authz";
 import { api } from "#tests/helpers/api";
 import { asUser, authenticate } from "#tests/helpers/auth";
 import { applyTestAccess } from "#tests/helpers/authz";

package/templates/features/authz/files/tests/helpers/authz.ts

@@ -1,7 +1,5 @@
-import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "#core/authz/constants";
-import { store } from "#core/authz/db/store";
-import { addOverlay, assignRole } from "#core/authz/services/members";
-import { syncSystemRoles } from "#core/authz/services/sync";
+import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "@tatara/authz";
+import { authz } from "#core/authz/index";
 import type { SystemRoleKey } from "#core/authz/system-roles";
 import type { PermissionKey } from "#generated/permissions";
 
@@ -17,14 +15,14 @@ export async function applyTestAccess(userId: string, access: TestAccess): Promi
 	const orgId = access.orgId ?? DEFAULT_ORG_ID;
 	for (const key of access.permissions ?? []) {
 		const [resource = "", action = ""] = key.split(":");
-		await addOverlay(null, orgId, userId, { resource, action, effect: "grant" });
+		await authz.addOverlay(null, orgId, userId, { resource, action, effect: "grant" });
 	}
 	if (access.systemRoles?.length) {
-		await syncSystemRoles();
+		await authz.syncSystemRoles();
 		for (const roleKey of access.systemRoles) {
-			const role = await store.findRoleByKey(SYSTEM_ORG_ID, roleKey);
+			const role = await authz.store.findRoleByKey(SYSTEM_ORG_ID, roleKey);
 			if (!role) throw new Error(`Unknown built-in role ${roleKey}`);
-			await assignRole(null, orgId, userId, role.id);
+			await authz.assignRole(null, orgId, userId, role.id);
 		}
 	}
 }

package/templates/features/authz/files+drizzle/src/core/authz/db/store.ts

@@ -1,6 +1,6 @@
 import { and, count, desc, eq, gt, inArray, isNull, or } from "drizzle-orm";
-import type { OverlayEffect, Scope } from "#core/authz/constants";
-import { SYSTEM_ORG_ID } from "#core/authz/constants";
+import type { OverlayEffect, Scope } from "@tatara/authz";
+import { SYSTEM_ORG_ID } from "@tatara/authz";
 import {
 	authzAuditLog,
 	authzMemberRoles,
@@ -8,7 +8,7 @@ import {
 	authzRolePermissions,
 	authzRoles,
 } from "#core/authz/db/authz.schema";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "#core/authz/types";
+import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
 import { db } from "#core/db/client";
 import { newId } from "@tatara/db";
 

package/templates/features/authz/files+prisma/src/core/authz/db/store.ts

@@ -1,6 +1,6 @@
-import type { OverlayEffect, Scope } from "#core/authz/constants";
-import { SYSTEM_ORG_ID } from "#core/authz/constants";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "#core/authz/types";
+import type { OverlayEffect, Scope } from "@tatara/authz";
+import { SYSTEM_ORG_ID } from "@tatara/authz";
+import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
 import { db } from "#core/db/client";
 import { newId } from "@tatara/db";
 

package/templates/features/email/files/src/core/email/send.ts

@@ -1,22 +1,13 @@
-import { createTransport, type Transporter } from "nodemailer";
+import { createMailer } from "@tatara/email";
 import { env } from "#core/config/env";
 import { logger } from "#core/logging/logger";
 
-export interface EmailMessage {
-	to: string;
-	subject: string;
-	text: string;
-	html?: string;
-}
-
-let transport: Transporter | undefined;
+export type { EmailMessage } from "@tatara/email";
 
 /** Sends through SMTP (Mailpit locally) or logs it when EMAIL_DRIVER=console. */
-export async function sendEmail(message: EmailMessage): Promise<void> {
-	if (env.EMAIL_DRIVER === "console") {
-		logger.info({ to: message.to, subject: message.subject }, "email (console driver)");
-		return;
-	}
-	transport ??= createTransport(env.SMTP_URL);
-	await transport.sendMail({ from: env.EMAIL_FROM, ...message });
-}
+export const { send: sendEmail } = createMailer({
+	driver: env.EMAIL_DRIVER,
+	smtpUrl: env.SMTP_URL,
+	from: env.EMAIL_FROM,
+	logger,
+});

package/templates/features/i18n/files/src/core/i18n/index.ts

@@ -1,41 +1,11 @@
-import { createMiddleware } from "hono/factory";
+import { createI18n } from "@tatara/i18n";
 import { env } from "#core/config/env";
-import type { AppEnv } from "#core/http/context";
 import ar from "#locales/ar" with { type: "json" };
 import en from "#locales/en" with { type: "json" };
 
-type Dictionary = { [key: string]: string | Dictionary };
+const i18n = createI18n({ dictionaries: { en, ar }, defaultLanguage: env.DEFAULT_LANGUAGE });
 
-const dictionaries: Record<string, Dictionary> = { en, ar };
+export const SUPPORTED_LANGUAGES = i18n.languages;
 
-export const SUPPORTED_LANGUAGES = Object.keys(dictionaries);
-
-function lookup(dict: Dictionary | undefined, key: string): string | undefined {
-	let node: string | Dictionary | undefined = dict;
-	for (const part of key.split(".")) {
-		if (!node || typeof node === "string") return undefined;
-		node = node[part];
-	}
-	return typeof node === "string" ? node : undefined;
-}
-
-/** Translates `key` ("errors.NOT_FOUND"), falling back to the default language, then `fallback`. */
-export function t(language: string, key: string, fallback = key, vars: Record<string, string> = {}): string {
-	const text = lookup(dictionaries[language], key) ?? lookup(dictionaries[env.DEFAULT_LANGUAGE], key) ?? fallback;
-	return text.replace(/\{(\w+)\}/g, (_, name: string) => vars[name] ?? `{${name}}`);
-}
-
-/** ?lang, then the `lang` cookie, then Accept-Language; sets `c.var.language`. */
-export const detectLanguage = createMiddleware<AppEnv>(async (c, next) => {
-	const candidates = [
-		c.req.query("lang"),
-		/(?:^|;\s*)lang=([^;]+)/.exec(c.req.header("cookie") ?? "")?.[1],
-		...(c.req.header("accept-language") ?? "")
-			.split(",")
-			.map((part) => part.split(";")[0]?.trim().toLowerCase().split("-")[0]),
-	];
-	const language = candidates.find((l) => l && SUPPORTED_LANGUAGES.includes(l)) ?? env.DEFAULT_LANGUAGE;
-	c.set("language", language);
-	c.header("content-language", language);
-	await next();
-});
+/** `t(language, "errors.NOT_FOUND")`, and the middleware that sets `c.var.language`. */
+export const { t, detectLanguage } = i18n;

package/templates/features/jobs/files/src/apps/cron/index.ts

@@ -1,25 +1,8 @@
-import { Cron } from "croner";
-import { withLock } from "#core/jobs/lock";
+import { handleSignals } from "@tatara/core";
+import { startCron } from "@tatara/jobs";
+import { redis } from "#core/jobs/index";
 import { logger } from "#core/logging/logger";
-import { handleSignals, onShutdown } from "@tatara/core";
 import { schedules } from "#generated/schedules";
 
-const jobs = schedules.map((schedule) => {
-	const log = logger.child({ schedule: schedule.name });
-	return new Cron(schedule.cron, { timezone: "UTC", protect: true, name: schedule.name }, async (self) => {
-		const tick = self.currentRun()?.toISOString() ?? new Date().toISOString();
-		const ran = await withLock(`schedule:${schedule.name}:${tick}`, schedule.lockTtlMs ?? 60_000, () =>
-			schedule.run({ logger: log }),
-		).catch((error: unknown) => {
-			log.error({ err: error }, "schedule failed");
-			return true;
-		});
-		if (!ran) log.debug("skipped: another process holds this tick");
-	});
-});
-
-onShutdown("cron", () => {
-	for (const job of jobs) job.stop();
-});
+startCron({ schedules, redis, logger });
 handleSignals(logger);
-logger.info({ schedules: schedules.map((s) => `${s.name} (${s.cron})`) }, "cron started");

package/templates/features/jobs/files/src/apps/worker/index.ts

@@ -1,24 +1,16 @@
-import { Worker } from "bullmq";
+import { handleSignals } from "@tatara/core";
+import { startWorker } from "@tatara/jobs";
 import { env } from "#core/config/env";
-import { processJob } from "#core/jobs/process";
-import { QUEUE_NAME } from "#core/jobs/queue";
-import { redis } from "#core/jobs/redis";
+import { QUEUE_NAME, redis } from "#core/jobs/index";
 import { logger } from "#core/logging/logger";
-import { handleSignals, onShutdown } from "@tatara/core";
 import { consumers } from "#generated/consumers";
 
-const worker = new Worker(
-	QUEUE_NAME,
-	(job) =>
-		processJob(consumers, job.name, job.data, {
-			logger: logger.child({ jobId: job.id, topic: job.name }),
-			jobId: job.id ?? "",
-			attempt: job.attemptsMade + 1,
-		}),
-	{ connection: redis(), prefix: env.JOBS_PREFIX, concurrency: env.WORKER_CONCURRENCY },
-);
-
-worker.on("failed", (job, err) => logger.error({ err, jobId: job?.id, topic: job?.name }, "job failed"));
-onShutdown("worker", () => worker.close());
+startWorker({
+	queue: QUEUE_NAME,
+	prefix: env.JOBS_PREFIX,
+	redis: redis(),
+	concurrency: env.WORKER_CONCURRENCY,
+	consumers,
+	logger,
+});
 handleSignals(logger);
-logger.info({ topics: consumers.map((c) => c.topic) }, "worker started");

package/templates/features/jobs/files/src/core/jobs/commands/enqueue.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { defineCommand } from "@tatara/core";
-import { enqueue } from "#core/jobs/queue";
+import { enqueue } from "#core/jobs/index";
 
 export default defineCommand({
 	name: "jobs:enqueue",

package/templates/features/jobs/files/src/core/jobs/index.ts

@@ -0,0 +1,10 @@
+import { createQueue, lazyRedis } from "@tatara/jobs";
+import { env } from "#core/config/env";
+
+export const QUEUE_NAME = "__APP_NAME__-jobs";
+
+/** The shared Redis connection, opened on first use. */
+export const redis = lazyRedis(env.REDIS_URL);
+
+/** `enqueue(topic, data)`: the consumer with that topic validates the payload. */
+export const { enqueue } = createQueue({ name: QUEUE_NAME, prefix: env.JOBS_PREFIX, redis });

package/templates/features/jobs/files/src/modules/example/consumers/send-welcome.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineConsumer } from "#core/jobs/define";
+import { defineConsumer } from "@tatara/jobs";
 
 export default defineConsumer({
 	topic: "example.send-welcome",

package/templates/features/jobs/files/src/modules/example/schedules/heartbeat.ts

@@ -1,4 +1,4 @@
-import { defineSchedule } from "#core/jobs/define";
+import { defineSchedule } from "@tatara/jobs";
 
 export default defineSchedule({
 	name: "example.heartbeat",

package/templates/features/jobs/files/src/modules/example/tests/jobs.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { withLock } from "#core/jobs/lock";
-import { processJob } from "#core/jobs/process";
+import { processJob, withLock } from "@tatara/jobs";
+import { redis } from "#core/jobs/index";
 import { logger } from "#core/logging/logger";
 import { consumers } from "#generated/consumers";
 
@@ -20,8 +20,8 @@ describe("jobs", () => {
 	it("lets only one holder run a locked section", async () => {
 		const key = `test-${Date.now()}-${Math.random()}`;
 		let inner: boolean | undefined;
-		const outer = await withLock(key, 5000, async () => {
-			inner = await withLock(key, 5000, async () => {});
+		const outer = await withLock(redis(), key, 5000, async () => {
+			inner = await withLock(redis(), key, 5000, async () => {});
 		});
 		expect(outer).toBe(true);
 		expect(inner).toBe(false);

package/templates/features/storage/files/src/core/storage/commands/check.ts

@@ -1,13 +1,13 @@
 import { defineCommand } from "@tatara/core";
 import { env } from "#core/config/env";
-import { storage } from "#core/storage/index";
-import { ensureBucket } from "#core/storage/s3";
+import { ensureBucket } from "@tatara/storage/s3";
+import { s3, storage } from "#core/storage/index";
 
 export default defineCommand({
 	name: "storage:check",
 	description: "Create the bucket if needed, then write, read and delete a probe object",
 	async run(_args, { logger }) {
-		if (env.STORAGE_DRIVER === "s3" && (await ensureBucket())) logger.info({ bucket: env.S3_BUCKET }, "bucket created");
+		if (env.STORAGE_DRIVER === "s3" && (await ensureBucket(s3, env.S3_BUCKET))) logger.info({ bucket: env.S3_BUCKET }, "bucket created");
 		const key = `tatara-check/${Date.now()}.txt`;
 		await storage.put(key, "ok", "text/plain");
 		const body = await storage.get(key);

package/templates/features/storage/files/src/core/storage/index.ts

@@ -1,8 +1,22 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { localStorage, type Storage } from "@tatara/storage";
+import { s3Storage } from "@tatara/storage/s3";
 import { env } from "#core/config/env";
-import { localStorage } from "#core/storage/local";
-import { s3Storage } from "#core/storage/s3";
-import type { Storage } from "#core/storage/storage";
 
-export type { Storage } from "#core/storage/storage";
+export type { Storage } from "@tatara/storage";
 
-export const storage: Storage = env.STORAGE_DRIVER === "s3" ? s3Storage() : localStorage();
+export const s3 = new S3Client({
+	region: env.S3_REGION,
+	...(env.S3_ENDPOINT ? { endpoint: env.S3_ENDPOINT } : {}),
+	forcePathStyle: env.S3_FORCE_PATH_STYLE,
+	...(env.S3_ACCESS_KEY_ID && env.S3_SECRET_ACCESS_KEY
+		? { credentials: { accessKeyId: env.S3_ACCESS_KEY_ID, secretAccessKey: env.S3_SECRET_ACCESS_KEY } }
+		: {}),
+});
+
+/** Object storage for modules; pick the driver with STORAGE_DRIVER. */
+export const storage: Storage =
+	env.STORAGE_DRIVER === "s3"
+		? // local development: the bucket is created on first write
+			s3Storage({ client: s3, bucket: env.S3_BUCKET, createBucket: env.NODE_ENV === "development" })
+		: localStorage(env.STORAGE_LOCAL_DIR);

package/templates/features/storage/files/src/core/storage/tests/storage.test.ts

@@ -2,7 +2,7 @@ import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { localStorage } from "#core/storage/local";
+import { localStorage } from "@tatara/storage";
 
 describe("local storage", () => {
 	it("round-trips an object", async () => {

package/templates/generators/consumer/files/src/modules/__moduleKebab__/consumers/__nameKebab__.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineConsumer } from "#core/jobs/define";
+import { defineConsumer } from "@tatara/jobs";
 
 export const __nameCamel__Payload = z.object({ id: z.string().min(1) });
 

package/templates/generators/consumer/files/src/modules/__moduleKebab__/tests/__nameKebab__.consumer.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { processJob } from "#core/jobs/process";
+import { processJob } from "@tatara/jobs";
 import { logger } from "#core/logging/logger";
 import { consumers } from "#generated/consumers";
 

package/templates/generators/permission/files/src/modules/__moduleKebab__/permissions/__nameKebab__.permissions.ts

@@ -1,4 +1,4 @@
-import { definePermissions } from "#core/authz/catalog";
+import { definePermissions } from "@tatara/authz";
 
 export default definePermissions({
 	resources: {

package/templates/generators/resource/files+authz/src/modules/__moduleKebab__/permissions/__nameKebab__.permissions.ts

@@ -1,4 +1,4 @@
-import { definePermissions } from "#core/authz/catalog";
+import { definePermissions } from "@tatara/authz";
 
 export default definePermissions({
 	resources: {