@tatara/cli 0.7.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/authz/files+drizzle/src/core/authz/index.ts

@@ -0,0 +1,15 @@
+import { createAuthz } from "@tatara/authz";
+import { drizzleAuthzStore } from "@tatara/authz/drizzle";
+import * as tables from "#core/authz/db/authz.schema";
+import { SYSTEM_ROLES } from "#core/authz/system-roles";
+import { db } from "#core/db/client";
+import { catalog, type PermissionKey } from "#generated/permissions";
+
+/** The app's authorization: its tables (authz.schema.ts), the catalog from `tatara sync`, built-in roles. */
+export const authz = createAuthz<PermissionKey>({
+	store: drizzleAuthzStore(db, tables),
+	catalog,
+	systemRoles: SYSTEM_ROLES,
+});
+
+export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/authz/files+prisma/src/core/authz/index.ts

@@ -0,0 +1,14 @@
+import { createAuthz } from "@tatara/authz";
+import { prismaAuthzStore } from "@tatara/authz/prisma";
+import { SYSTEM_ROLES } from "#core/authz/system-roles";
+import { db } from "#core/db/client";
+import { catalog, type PermissionKey } from "#generated/permissions";
+
+/** The app's authorization: its tables (prisma/models/authz.prisma), the catalog from `tatara sync`, built-in roles. */
+export const authz = createAuthz<PermissionKey>({
+	store: prismaAuthzStore(db),
+	catalog,
+	systemRoles: SYSTEM_ROLES,
+});
+
+export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/versions.json

@@ -31,15 +31,15 @@
   "@aws-sdk/s3-request-presigner": "3.1152.0",
   "nodemailer": "10.1.1",
   "@types/nodemailer": "8.0.2",
-  "@tatara/core": "0.1.0",
-  "@tatara/http": "0.1.0",
-  "@tatara/db": "0.1.0",
-  "@tatara/testing": "0.1.0",
-  "@tatara/auth": "0.1.0",
-  "@tatara/keycloak": "0.1.0",
-  "@tatara/authz": "0.1.0",
-  "@tatara/storage": "0.1.0",
-  "@tatara/email": "0.1.0",
+  "@tatara/core": "0.1.1",
+  "@tatara/http": "0.1.1",
+  "@tatara/db": "0.2.0",
+  "@tatara/testing": "0.1.1",
+  "@tatara/auth": "0.1.1",
+  "@tatara/keycloak": "0.1.1",
+  "@tatara/authz": "0.2.0",
+  "@tatara/storage": "0.2.0",
+  "@tatara/email": "0.2.0",
   "@tatara/i18n": "0.1.0",
-  "@tatara/jobs": "0.1.0"
+  "@tatara/jobs": "0.2.0"
 }

package/templates/features/authz/files/src/core/authz/commands/grant-role.ts

@@ -1,21 +0,0 @@
-import { z } from "zod";
-import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "@tatara/authz";
-import { authz } from "#core/authz/index";
-import { defineCommand } from "@tatara/core";
-
-export default defineCommand({
-	name: "authz:grant-role",
-	description: "Assign a role (built-in key or custom role key) to a user in an org",
-	args: z.object({
-		user: z.string().min(1),
-		role: z.string().min(1),
-		org: z.string().default(DEFAULT_ORG_ID),
-	}),
-	async run({ user, role, org }, { logger }) {
-		const found = (await authz.store.findRoleByKey(org, role)) ??
-			(await authz.store.findRoleByKey(SYSTEM_ORG_ID, role));
-		if (!found) throw new Error(`No role "${role}" (run authz:sync-permissions first for built-in roles)`);
-		const added = await authz.assignRole(null, org, user, found.id);
-		logger.info({ user, role, org, added }, added ? "role assigned" : "role already assigned");
-	},
-});

package/templates/features/authz/files/src/core/authz/commands/sync-permissions.ts

@@ -1,11 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { authz } from "#core/authz/index";
-
-export default defineCommand({
-	name: "authz:sync-permissions",
-	description: "Create/update built-in roles so their grants match the code (run on every deploy)",
-	async run(_args, { logger }) {
-		const result = await authz.syncSystemRoles();
-		logger.info(result, "built-in roles in sync");
-	},
-});

package/templates/features/authz/files/src/core/authz/db/seed.ts

@@ -1,10 +0,0 @@
-import { authz } from "#core/authz/index";
-import { defineSeed } from "@tatara/db";
-
-export default defineSeed({
-	name: "authz:system-roles",
-	order: -10,
-	async run({ logger }) {
-		logger.info(await authz.syncSystemRoles(), "built-in roles in sync");
-	},
-});

package/templates/features/authz/files/src/core/authz/index.ts

@@ -1,9 +0,0 @@
-import { createAuthz } from "@tatara/authz";
-import { store } from "#core/authz/db/store";
-import { SYSTEM_ROLES } from "#core/authz/system-roles";
-import { catalog, type PermissionKey } from "#generated/permissions";
-
-/** The app's authorization: its store, the permission catalog from `tatara sync`, built-in roles. */
-export const authz = createAuthz<PermissionKey>({ store, catalog, systemRoles: SYSTEM_ROLES });
-
-export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/authz/files+drizzle/src/core/authz/db/store.ts

@@ -1,275 +0,0 @@
-import { and, count, desc, eq, gt, inArray, isNull, or } from "drizzle-orm";
-import type { OverlayEffect, Scope } from "@tatara/authz";
-import { SYSTEM_ORG_ID } from "@tatara/authz";
-import {
-	authzAuditLog,
-	authzMemberRoles,
-	authzOverlays,
-	authzRolePermissions,
-	authzRoles,
-} from "#core/authz/db/authz.schema";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
-import { db } from "#core/db/client";
-import { newId } from "@tatara/db";
-
-const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
-
-type RoleRecord = typeof authzRoles.$inferSelect;
-type OverlayRecord = typeof authzOverlays.$inferSelect;
-
-function toOverlay(row: OverlayRecord): OverlayRow {
-	return { ...row, scope: toScope(row.scope), effect: row.effect as OverlayEffect };
-}
-
-async function hydrate(roles: RoleRecord[], orgId: string): Promise<RoleRow[]> {
-	if (roles.length === 0) return [];
-	const ids = roles.map((r) => r.id);
-	const [grants, members] = await Promise.all([
-		db.select().from(authzRolePermissions).where(inArray(authzRolePermissions.roleId, ids)),
-		db
-			.select({ roleId: authzMemberRoles.roleId, total: count() })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), inArray(authzMemberRoles.roleId, ids)))
-			.groupBy(authzMemberRoles.roleId),
-	]);
-	return roles.map((role) => ({
-		id: role.id,
-		orgId: role.orgId,
-		key: role.key,
-		name: role.name,
-		description: role.description,
-		isSystem: role.isSystem,
-		grants: grants
-			.filter((g) => g.roleId === role.id)
-			.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-		memberCount: members.find((m) => m.roleId === role.id)?.total ?? 0,
-	}));
-}
-
-const visibleTo = (orgId: string) => or(eq(authzRoles.orgId, SYSTEM_ORG_ID), eq(authzRoles.orgId, orgId));
-
-async function insertGrants(roleId: string, grants: PermissionGrant[]) {
-	if (grants.length === 0) return;
-	await db.insert(authzRolePermissions).values(
-		grants.map((g) => ({
-			id: newId(),
-			roleId,
-			resource: g.resource,
-			action: g.action,
-			scope: g.scope ?? "",
-		})),
-	);
-}
-
-export const store: AuthzStore = {
-	async roleGrants(orgId, userId, impliedRoleKeys) {
-		const assigned = await db
-			.select({ roleId: authzMemberRoles.roleId })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId)));
-		const implied = impliedRoleKeys.length
-			? await db
-					.select({ id: authzRoles.id })
-					.from(authzRoles)
-					.where(and(eq(authzRoles.orgId, SYSTEM_ORG_ID), inArray(authzRoles.key, impliedRoleKeys)))
-			: [];
-		const roleIds = [...new Set([...assigned.map((r) => r.roleId), ...implied.map((r) => r.id)])];
-		if (roleIds.length === 0) return { roles: [], grants: [] };
-		const [roles, grants] = await Promise.all([
-			db.select({ key: authzRoles.key }).from(authzRoles).where(inArray(authzRoles.id, roleIds)),
-			db.select().from(authzRolePermissions).where(inArray(authzRolePermissions.roleId, roleIds)),
-		]);
-		return {
-			roles: roles.map((r) => r.key),
-			grants: grants.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-		};
-	},
-
-	async activeOverlays(orgId, userId, now) {
-		const rows = await db
-			.select()
-			.from(authzOverlays)
-			.where(
-				and(
-					eq(authzOverlays.orgId, orgId),
-					eq(authzOverlays.userId, userId),
-					or(isNull(authzOverlays.expiresAt), gt(authzOverlays.expiresAt, now)),
-				),
-			);
-		return rows.map(toOverlay);
-	},
-
-	async listRoles(orgId) {
-		const roles = await db.select().from(authzRoles).where(visibleTo(orgId)).orderBy(authzRoles.key);
-		return hydrate(roles, orgId);
-	},
-
-	async findRole(orgId, roleId) {
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(and(eq(authzRoles.id, roleId), visibleTo(orgId)));
-		return (await hydrate(roles, orgId))[0] ?? null;
-	},
-
-	async findRoleByKey(orgId, key) {
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(and(eq(authzRoles.key, key), eq(authzRoles.orgId, orgId)));
-		return (await hydrate(roles, orgId))[0] ?? null;
-	},
-
-	async createRole(input) {
-		const id = newId();
-		await db.insert(authzRoles).values({
-			id,
-			orgId: input.orgId,
-			key: input.key,
-			name: input.name,
-			description: input.description,
-			isSystem: input.isSystem,
-		});
-		await insertGrants(id, input.grants);
-		return id;
-	},
-
-	async updateRole(roleId, input) {
-		const fields = {
-			...(input.name === undefined ? {} : { name: input.name }),
-			...(input.description === undefined ? {} : { description: input.description }),
-		};
-		await db
-			.update(authzRoles)
-			.set({ ...fields, updatedAt: new Date() })
-			.where(eq(authzRoles.id, roleId));
-		if (input.grants) {
-			await db.delete(authzRolePermissions).where(eq(authzRolePermissions.roleId, roleId));
-			await insertGrants(roleId, input.grants);
-		}
-	},
-
-	async deleteRole(roleId) {
-		await db.delete(authzRoles).where(eq(authzRoles.id, roleId));
-	},
-
-	async memberRoles(orgId, userId) {
-		const assigned = await db
-			.select({ roleId: authzMemberRoles.roleId })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId)));
-		if (assigned.length === 0) return [];
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(inArray(authzRoles.id, assigned.map((a) => a.roleId)));
-		return hydrate(roles, orgId);
-	},
-
-	async assignRole(orgId, userId, roleId, by) {
-		const existing = await db
-			.select({ id: authzMemberRoles.id })
-			.from(authzMemberRoles)
-			.where(
-				and(
-					eq(authzMemberRoles.orgId, orgId),
-					eq(authzMemberRoles.userId, userId),
-					eq(authzMemberRoles.roleId, roleId),
-				),
-			);
-		if (existing.length > 0) return false;
-		await db.insert(authzMemberRoles).values({ id: newId(), orgId, userId, roleId, assignedBy: by });
-		return true;
-	},
-
-	async revokeRole(orgId, userId, roleId) {
-		const where = and(
-			eq(authzMemberRoles.orgId, orgId),
-			eq(authzMemberRoles.userId, userId),
-			eq(authzMemberRoles.roleId, roleId),
-		);
-		const existing = await db.select({ id: authzMemberRoles.id }).from(authzMemberRoles).where(where);
-		if (existing.length === 0) return false;
-		await db.delete(authzMemberRoles).where(where);
-		return true;
-	},
-
-	async removeMember(orgId, userId) {
-		const roleWhere = and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId));
-		const overlayWhere = and(eq(authzOverlays.orgId, orgId), eq(authzOverlays.userId, userId));
-		// count first: MySQL has no RETURNING
-		return db.transaction(async (tx) => {
-			const [roles] = await tx.select({ n: count() }).from(authzMemberRoles).where(roleWhere);
-			const [overlays] = await tx.select({ n: count() }).from(authzOverlays).where(overlayWhere);
-			await tx.delete(authzMemberRoles).where(roleWhere);
-			await tx.delete(authzOverlays).where(overlayWhere);
-			return { roles: roles?.n ?? 0, overlays: overlays?.n ?? 0 };
-		});
-	},
-
-	async listOverlays(orgId, userId) {
-		const rows = await db
-			.select()
-			.from(authzOverlays)
-			.where(and(eq(authzOverlays.orgId, orgId), eq(authzOverlays.userId, userId)))
-			.orderBy(desc(authzOverlays.createdAt));
-		return rows.map(toOverlay);
-	},
-
-	async addOverlay(input) {
-		const id = newId();
-		const scope = input.scope ?? "";
-		await db
-			.delete(authzOverlays)
-			.where(
-				and(
-					eq(authzOverlays.orgId, input.orgId),
-					eq(authzOverlays.userId, input.userId),
-					eq(authzOverlays.resource, input.resource),
-					eq(authzOverlays.action, input.action),
-					eq(authzOverlays.scope, scope),
-					eq(authzOverlays.effect, input.effect),
-				),
-			);
-		await db.insert(authzOverlays).values({ ...input, id, scope });
-		return id;
-	},
-
-	async removeOverlay(orgId, userId, overlayId) {
-		const where = and(
-			eq(authzOverlays.orgId, orgId),
-			eq(authzOverlays.userId, userId),
-			eq(authzOverlays.id, overlayId),
-		);
-		const [row] = await db.select().from(authzOverlays).where(where);
-		if (!row) return null;
-		await db.delete(authzOverlays).where(where);
-		return toOverlay(row);
-	},
-
-	async writeAudit(input) {
-		await db.insert(authzAuditLog).values({
-			id: newId(),
-			orgId: input.orgId,
-			actorId: input.actorId,
-			targetUserId: input.targetUserId,
-			changeType: input.changeType,
-			before: input.before === undefined ? null : JSON.stringify(input.before),
-			after: input.after === undefined ? null : JSON.stringify(input.after),
-		});
-	},
-
-	async listAudit(orgId, limit) {
-		const rows = await db
-			.select()
-			.from(authzAuditLog)
-			.where(eq(authzAuditLog.orgId, orgId))
-			.orderBy(desc(authzAuditLog.id))
-			.limit(limit);
-		return rows.map((r) => ({
-			...r,
-			before: r.before ? (JSON.parse(r.before) as unknown) : null,
-			after: r.after ? (JSON.parse(r.after) as unknown) : null,
-		}));
-	},
-};

package/templates/features/authz/files+prisma/src/core/authz/db/store.ts

@@ -1,236 +0,0 @@
-import type { OverlayEffect, Scope } from "@tatara/authz";
-import { SYSTEM_ORG_ID } from "@tatara/authz";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
-import { db } from "#core/db/client";
-import { newId } from "@tatara/db";
-
-const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
-
-interface OverlayRecord {
-	id: string;
-	orgId: string;
-	userId: string;
-	resource: string;
-	action: string;
-	scope: string;
-	effect: string;
-	grantedBy: string | null;
-	reason: string | null;
-	expiresAt: Date | null;
-	createdAt: Date;
-}
-
-function toOverlay(row: OverlayRecord): OverlayRow {
-	return { ...row, scope: toScope(row.scope), effect: row.effect as OverlayEffect };
-}
-
-const roleInclude = (orgId: string) => ({
-	permissions: true,
-	_count: { select: { members: { where: { orgId } } } },
-});
-
-interface RoleRecord {
-	id: string;
-	orgId: string;
-	key: string;
-	name: string;
-	description: string | null;
-	isSystem: boolean;
-	permissions: { resource: string; action: string; scope: string }[];
-	_count: { members: number };
-}
-
-function toRole(role: RoleRecord): RoleRow {
-	return {
-		id: role.id,
-		orgId: role.orgId,
-		key: role.key,
-		name: role.name,
-		description: role.description,
-		isSystem: role.isSystem,
-		grants: role.permissions.map((g) => ({
-			resource: g.resource,
-			action: g.action,
-			scope: toScope(g.scope),
-		})),
-		memberCount: role._count.members,
-	};
-}
-
-const grantRows = (grants: PermissionGrant[]) =>
-	grants.map((g) => ({ id: newId(), resource: g.resource, action: g.action, scope: g.scope ?? "" }));
-
-export const store: AuthzStore = {
-	async roleGrants(orgId, userId, impliedRoleKeys) {
-		const roles = await db.authzRole.findMany({
-			where: {
-				OR: [
-					{ members: { some: { orgId, userId } } },
-					...(impliedRoleKeys.length
-						? [{ orgId: SYSTEM_ORG_ID, key: { in: impliedRoleKeys } }]
-						: []),
-				],
-			},
-			include: { permissions: true },
-		});
-		return {
-			roles: roles.map((r) => r.key),
-			grants: roles.flatMap((r) =>
-				r.permissions.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-			),
-		};
-	},
-
-	async activeOverlays(orgId, userId, now) {
-		const rows = await db.authzOverlay.findMany({
-			where: { orgId, userId, OR: [{ expiresAt: null }, { expiresAt: { gt: now } }] },
-		});
-		return rows.map(toOverlay);
-	},
-
-	async listRoles(orgId) {
-		const roles = await db.authzRole.findMany({
-			where: { orgId: { in: [SYSTEM_ORG_ID, orgId] } },
-			include: roleInclude(orgId),
-			orderBy: { key: "asc" },
-		});
-		return roles.map(toRole);
-	},
-
-	async findRole(orgId, roleId) {
-		const role = await db.authzRole.findFirst({
-			where: { id: roleId, orgId: { in: [SYSTEM_ORG_ID, orgId] } },
-			include: roleInclude(orgId),
-		});
-		return role ? toRole(role) : null;
-	},
-
-	async findRoleByKey(orgId, key) {
-		const role = await db.authzRole.findFirst({ where: { key, orgId }, include: roleInclude(orgId) });
-		return role ? toRole(role) : null;
-	},
-
-	async createRole(input) {
-		const id = newId();
-		await db.authzRole.create({
-			data: {
-				id,
-				orgId: input.orgId,
-				key: input.key,
-				name: input.name,
-				description: input.description,
-				isSystem: input.isSystem,
-				permissions: { create: grantRows(input.grants) },
-			},
-		});
-		return id;
-	},
-
-	async updateRole(roleId, input) {
-		await db.$transaction(async (tx) => {
-			await tx.authzRole.update({
-				where: { id: roleId },
-				data: {
-					...(input.name === undefined ? {} : { name: input.name }),
-					...(input.description === undefined ? {} : { description: input.description }),
-				},
-			});
-			if (input.grants) {
-				await tx.authzRolePermission.deleteMany({ where: { roleId } });
-				await tx.authzRolePermission.createMany({
-					data: grantRows(input.grants).map((g) => ({ ...g, roleId })),
-				});
-			}
-		});
-	},
-
-	async deleteRole(roleId) {
-		await db.authzRole.delete({ where: { id: roleId } });
-	},
-
-	async memberRoles(orgId, userId) {
-		const roles = await db.authzRole.findMany({
-			where: { members: { some: { orgId, userId } } },
-			include: roleInclude(orgId),
-		});
-		return roles.map(toRole);
-	},
-
-	async assignRole(orgId, userId, roleId, by) {
-		const existing = await db.authzMemberRole.findFirst({ where: { orgId, userId, roleId } });
-		if (existing) return false;
-		await db.authzMemberRole.create({ data: { id: newId(), orgId, userId, roleId, assignedBy: by } });
-		return true;
-	},
-
-	async revokeRole(orgId, userId, roleId) {
-		const { count } = await db.authzMemberRole.deleteMany({ where: { orgId, userId, roleId } });
-		return count > 0;
-	},
-
-	async removeMember(orgId, userId) {
-		const [roles, overlays] = await db.$transaction([
-			db.authzMemberRole.deleteMany({ where: { orgId, userId } }),
-			db.authzOverlay.deleteMany({ where: { orgId, userId } }),
-		]);
-		return { roles: roles.count, overlays: overlays.count };
-	},
-	async listOverlays(orgId, userId) {
-		const rows = await db.authzOverlay.findMany({
-			where: { orgId, userId },
-			orderBy: { createdAt: "desc" },
-		});
-		return rows.map(toOverlay);
-	},
-
-	async addOverlay(input) {
-		const id = newId();
-		const scope = input.scope ?? "";
-		await db.authzOverlay.deleteMany({
-			where: {
-				orgId: input.orgId,
-				userId: input.userId,
-				resource: input.resource,
-				action: input.action,
-				scope,
-				effect: input.effect,
-			},
-		});
-		await db.authzOverlay.create({ data: { ...input, id, scope } });
-		return id;
-	},
-
-	async removeOverlay(orgId, userId, overlayId) {
-		const row = await db.authzOverlay.findFirst({ where: { id: overlayId, orgId, userId } });
-		if (!row) return null;
-		await db.authzOverlay.deleteMany({ where: { id: overlayId, orgId, userId } });
-		return toOverlay(row);
-	},
-
-	async writeAudit(input) {
-		await db.authzAuditLog.create({
-			data: {
-				id: newId(),
-				orgId: input.orgId,
-				actorId: input.actorId,
-				targetUserId: input.targetUserId,
-				changeType: input.changeType,
-				before: input.before === undefined ? null : JSON.stringify(input.before),
-				after: input.after === undefined ? null : JSON.stringify(input.after),
-			},
-		});
-	},
-
-	async listAudit(orgId, limit) {
-		const rows = await db.authzAuditLog.findMany({
-			where: { orgId },
-			orderBy: { id: "desc" },
-			take: limit,
-		});
-		return rows.map((r) => ({
-			...r,
-			before: r.before ? (JSON.parse(r.before) as unknown) : null,
-			after: r.after ? (JSON.parse(r.after) as unknown) : null,
-		}));
-	},
-};

package/templates/features/db/files/src/core/db/commands/migrate.ts

@@ -1,12 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { env } from "#core/config/env";
-import { migrateDatabase } from "#core/db/migrate";
-
-export default defineCommand({
-	name: "db:migrate",
-	description: "Apply pending database migrations",
-	async run(_args, { logger }) {
-		await migrateDatabase(env.DATABASE_URL);
-		logger.info("migrations applied");
-	},
-});

package/templates/features/db/files/src/core/db/commands/reset.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-import { defineCommand, flag } from "@tatara/core";
-import { env } from "#core/config/env";
-import { dropAllTables } from "#core/db/admin";
-import { migrateDatabase } from "#core/db/migrate";
-
-export default defineCommand({
-	name: "db:reset",
-	description: "Drop every table and re-apply migrations (refuses to run in production)",
-	args: z.object({ force: flag() }),
-	async run({ force }, { logger }) {
-		if (env.NODE_ENV === "production" && !force) {
-			throw new Error("db:reset refuses to run with NODE_ENV=production (pass --force to override)");
-		}
-		await dropAllTables(env.DATABASE_URL);
-		await migrateDatabase(env.DATABASE_URL);
-		logger.info("database reset");
-	},
-});

package/templates/features/db/files/src/core/db/commands/seed.ts

@@ -1,13 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { seeds } from "#generated/seeds";
-
-export default defineCommand({
-	name: "db:seed",
-	description: "Run every idempotent seed (core first, then modules)",
-	async run(_args, { logger }) {
-		for (const seed of [...seeds].sort((a, b) => (a.order ?? 100) - (b.order ?? 100))) {
-			await seed.run({ logger: logger.child({ seed: seed.name }) });
-			logger.info({ seed: seed.name }, "seeded");
-		}
-	},
-});

package/templates/features/db/files/src/core/db/tests/reset.test.ts

@@ -1,7 +0,0 @@
-import { expect, it } from "vitest";
-import { parseFlags } from "@tatara/core";
-import reset from "#core/db/commands/reset";
-
-it("does not treat --force false as forcing db:reset", () => {
-	expect(reset.args?.parse(parseFlags(["--force", "false"]))).toEqual({ force: false });
-});