@tatara/cli 0.8.0 → 0.9.0

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import pc from "picocolors";
 import { spawn } from "node:child_process";
 import { cp, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
@@ -239,6 +239,55 @@ ${imports.join("\n")}${imports.length ? "\n" : ""}
 export const ${options.exportName}: ${options.typeName}[] = [${names.join(", ")}];
 `;
 }
+/** What the app's installed (or ejected) @tatara/* packages contribute, by package name. */
+async function contributions(project, kind) {
+	const pkg = JSON.parse(await readFile(join(project.root, "package.json"), "utf8"));
+	const ejected = ejectedPackages(project.config);
+	const names = [...Object.keys({
+		...pkg.dependencies,
+		...pkg.devDependencies
+	}).filter((n) => n.startsWith("@tatara/")).map((n) => n.slice(8)), ...ejected];
+	const out = [];
+	for (const name of [...new Set(names)].sort()) {
+		const file = ejected.includes(name) ? join(project.root, "src/ejected", name, "tatara-package.json") : join(project.root, "node_modules/@tatara", name, "package.json");
+		if (!existsSync(file)) continue;
+		const json = JSON.parse(await readFile(file, "utf8"));
+		out.push(...(ejected.includes(name) ? json[kind] : json.tatara?.[kind]) ?? []);
+	}
+	return out;
+}
+/**
+* Like listModule, plus the packages' factories: `own` are the app's files, and an own entry wins
+* over a package's entry with the same name.
+*/
+function listWithPackages(files, from, options) {
+	if (from.length === 0) return listModule(files, options);
+	const imports = /* @__PURE__ */ new Map();
+	const bind = (name, spec) => {
+		const existing = imports.get(name);
+		if (existing && existing !== spec) throw new Error(`tatara packages need "${name}" from both ${existing} and ${spec}`);
+		imports.set(name, spec);
+	};
+	for (const c of from) {
+		bind(c.factory, c.import);
+		for (const [arg, spec] of Object.entries(c.args)) bind(arg, spec);
+	}
+	const named = [...imports].map(([name, spec]) => `import { ${name} } from "${spec}";`);
+	const own = files.map((f) => `import ${identifier(f, options.prefix)} from "${specifier(f)}";`);
+	const calls = from.map((c) => `...${c.factory}({ ${Object.keys(c.args).join(", ")} })`);
+	const t = options.typeName;
+	return `${HEADER}${options.typeImport}
+${[...named, ...own].join("\n")}
+
+const own: ${t}[] = [${files.map((f) => identifier(f, options.prefix)).join(", ")}];
+// from the installed @tatara/* packages; the app's own entry of the same name wins
+const fromPackages: ${t}[] = [${calls.join(", ")}];
+export const ${options.exportName}: ${t}[] = [
+	...own,
+	...fromPackages.filter((c) => !own.some((o) => o.name === c.name)),
+];
+`;
+}
 async function writeIfChanged(path, content, written) {
 	if ((existsSync(path) ? await readFile(path, "utf8") : void 0) !== content) {
 		await writeFile(path, content);
@@ -261,7 +310,7 @@ async function sync(project = loadProject()) {
 		exportName: "routes"
 	}), written);
 	const commands = await find(root, dirs.map((d) => `${d}/commands/*.ts`));
-	await write(join(out, "commands.ts"), listModule(commands, {
+	await write(join(out, "commands.ts"), listWithPackages(commands, await contributions(project, "commands"), {
 		prefix: "command",
 		typeImport: "import type { CommandDefinition } from \"@tatara/core\";",
 		typeName: "CommandDefinition",
@@ -297,7 +346,7 @@ export type PermissionKey =
 	}
 	if (project.config.database !== "none") {
 		const seeds = await find(root, dirs.map((d) => `${d}/db/seed.ts`));
-		await write(join(out, "seeds.ts"), listModule(seeds, {
+		await write(join(out, "seeds.ts"), listWithPackages(seeds, await contributions(project, "seeds"), {
 			prefix: "seed",
 			typeImport: "import type { SeedDefinition } from \"@tatara/db\";",
 			typeName: "SeedDefinition",
@@ -722,6 +771,10 @@ async function eject(project, name, opts = {}) {
 			await cp(join(source, file), join(project.root, to));
 			report.copied.push(to);
 		}
+		if (manifest.tatara) {
+			const to = `src/ejected/${dep}/tatara-package.json`;
+			await writeFile(join(project.root, to), `${JSON.stringify(manifest.tatara, null, "	")}\n`);
+		}
 	}
 	const ejected = [...already, ...chain];
 	for (const file of await glob(["src/**/*.ts", "tests/**/*.ts"], { cwd: project.root })) {
@@ -2383,6 +2436,10 @@ function pnpmWorkspace(features) {
 	lines.push("# tatara's own packages are installed as soon as they are released", "minimumReleaseAgeExclude:", "  - \"@tatara/*\"");
 	return `${lines.join("\n")}\n`;
 }
+/** Tests of tatara's wiring, not of the app; generated apps leave them out. */
+function isFrameworkTest(path) {
+	return /^src\/core\/.+\/tests\/[^/]+\.test\.ts$/.test(path);
+}
 /** Folds applicable variants into each feature so later steps see one flat definition. */
 function effectiveFeatures(options) {
 	const features = resolveFeatures(options);
@@ -2406,6 +2463,9 @@ async function renderApp(options, generate = {}) {
 	const selected = new Set(features.map((f) => f.id));
 	const tokenValues = tokens(options);
 	const files = await collectTemplateFiles(features, selected);
+	if (!generate.frameworkTests) {
+		for (const path of files.keys()) if (isFrameworkTest(path)) files.delete(path);
+	}
 	const env = dedupeEnv(features, tokenValues);
 	files.set("src/core/config/env.ts", envModule(env.filter((v) => !v.composeOnly)));
 	files.set(".env.example", envFile(env, "example"));
@@ -2998,7 +3058,10 @@ async function newApp(dir, rawFlags) {
 	const name = root.split(/[\\/]/).at(-1) ?? "app";
 	const options = validateOptions(interactive ? await prompt(name, flags) : fromFlags(name, flags));
 	const pm = pmCommands(options.packageManager);
-	await writeFiles(root, await renderApp(options, { pmVersion: await pmVersion(options.packageManager) }), { env: devEnvFromExample(options) });
+	await writeFiles(root, await renderApp(options, {
+		pmVersion: await pmVersion(options.packageManager),
+		frameworkTests: flags.frameworkTests
+	}), { env: devEnvFromExample(options) });
 	const project = loadProject(root);
 	await afterCreate(project, "files");
 	if (flags.install !== false) {
@@ -3384,10 +3447,7 @@ async function blockersOf$1(ctx, group, sources) {
 	return blockers;
 }
 async function applyGroup(ctx, group) {
-	for (const path of group.regenerate) {
-		const next = await ctx.renderCurrent(path);
-		if (next !== void 0) await ctx.write(path, next);
-	}
+	for (const path of group.regenerate) await ctx.regenerate(path);
 	for (const path of group.remove) await ctx.removeIfUnchanged(path);
 	for (const rewrite of group.rewrites) await ctx.rewriteImports(rewrite.from, rewrite.to);
 }
@@ -3633,8 +3693,7 @@ const authPackage = {
 		for (const group of ready) {
 			for (const path of group.regenerate) {
 				if (await read$3(ctx, path) === void 0) continue;
-				const next = await ctx.renderCurrent(path);
-				if (next !== void 0) await ctx.write(path, next);
+				await ctx.regenerate(path);
 			}
 			for (const path of group.remove) await ctx.removeIfUnchanged(path);
 		}
@@ -3779,15 +3838,43 @@ const authzPackage = {
 			ctx.report.blocked.push("authz-package");
 			return;
 		}
-		for (const path of regenerate) {
-			const next = await ctx.renderCurrent(path);
-			if (next !== void 0) await ctx.write(path, next);
-		}
+		for (const path of regenerate) await ctx.regenerate(path);
 		for (const path of removed) await ctx.removeIfUnchanged(path);
 		for (const move of MOVES) await ctx.rewriteImports(move.from, move.to);
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/authz-stores.ts
+const group = {
+	name: "authz store",
+	regenerate: ["src/core/authz/index.ts"],
+	remove: ["src/core/authz/db/store.ts"],
+	rewrites: [{
+		from: "#core/authz/db/store",
+		to: "#core/authz/index",
+		names: []
+	}]
+};
+const authzStores = {
+	version: "0.9.0",
+	id: "authz-stores",
+	description: "Use the Prisma or Drizzle authz store from @tatara/authz",
+	async run(ctx) {
+		if (!ctx.project.config.addons.includes("authz")) return;
+		if (ejectedPackages(ctx.project.config).includes("authz")) {
+			ctx.report.notes.push("@tatara/authz is ejected; its store stays in src/core/authz/db/store.ts");
+			return;
+		}
+		const blockers = await blockersOf$1(ctx, group, await sourceFiles(ctx));
+		if (blockers.length > 0) {
+			ctx.report.notes.push(`The authz store was not moved onto @tatara/authz: ${blockers.join("; ")}. Pass prismaAuthzStore(db) or drizzleAuthzStore(db, tables) to createAuthz by hand.`);
+			ctx.report.blocked.push("authz-stores");
+			return;
+		}
+		await applyGroup(ctx, group);
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/core-package.ts
 const CORE = "@tatara/core";
 /** Files @tatara/core replaces, with the import specifier apps used for each. */
@@ -3952,6 +4039,20 @@ const dbTesting = {
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/framework-tests.ts
+const frameworkTests = {
+	version: "0.9.0",
+	id: "framework-tests",
+	description: "Remove tatara's own wiring tests from src/core; the packages and tatara's e2e cover them",
+	async run(ctx) {
+		for (const path of await sourceFiles(ctx)) {
+			if (!isFrameworkTest(path)) continue;
+			if (!await ctx.baseline.isUnchanged(path, await ctx.read(path))) continue;
+			await ctx.removeIfUnchanged(path);
+		}
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/http-package.ts
 const HTTP = "@tatara/http";
 /** Wiring files the app keeps; replaced by what this CLI generates when the app never changed them. */
@@ -4014,58 +4115,94 @@ async function outsideImporters(ctx) {
 	}
 	return out;
 }
+const httpPackage = {
+	version: "0.3.0",
+	id: "http-package",
+	description: "Use @tatara/http for app setup, errors, the envelope, OpenAPI docs and the server",
+	async run(ctx) {
+		await ctx.addDependency(HTTP, versionOf(HTTP));
+		const blockers = [];
+		const replace = [];
+		for (const path of [
+			APP,
+			ROUTES,
+			...SERVERS
+		]) {
+			const text = await read(ctx, path);
+			if (text === void 0) continue;
+			if (await ctx.baseline.isUnchanged(path, text)) replace.push(path);
+			else blockers.push(`${path} is customised`);
+		}
+		const present = [];
+		for (const entry of MOVED) {
+			const text = await read(ctx, entry.path);
+			if (text === void 0) continue;
+			present.push(entry);
+			if (!await ctx.baseline.isUnchanged(entry.path, text)) blockers.push(`${entry.path} is customised`);
+		}
+		for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
+		if (blockers.length > 0) {
+			ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
+			ctx.report.blocked.push("http-package");
+			return;
+		}
+		for (const path of replace) await ctx.regenerate(path);
+		for (const entry of present) await ctx.removeIfUnchanged(entry.path);
+		for (const specifier of [
+			"#core/http/errors",
+			"#core/http/response",
+			"#core/http/middleware/validation"
+		]) await ctx.rewriteImports(specifier, HTTP);
+	}
+};
+//#endregion
+//#region src/upgrade/codemods/package-commands.ts
+/** Copies whose commands and seeds the packages contribute now (wired by `tatara sync`). */
+const COPIES = [
+	"src/core/db/commands/migrate.ts",
+	"src/core/db/commands/reset.ts",
+	"src/core/db/commands/seed.ts",
+	"src/core/authz/commands/grant-role.ts",
+	"src/core/authz/commands/sync-permissions.ts",
+	"src/core/authz/db/seed.ts",
+	"src/core/email/commands/send-test.ts",
+	"src/core/storage/commands/check.ts",
+	"src/core/jobs/commands/enqueue.ts"
+];
+const specifierOf = (path) => `#${path.replace(/^src\//, "").replace(/\.ts$/, "")}`;
 //#endregion
 //#region src/upgrade/codemods.ts
 /** Every codemod tatara ships, oldest first. Each step that moves code into a package adds one. */
 const CODEMODS = [
 	corePackage,
+	httpPackage,
+	dbTesting,
+	authPackage,
+	authzPackage,
+	addonPackages,
+	frameworkTests,
+	authzStores,
 	{
-		version: "0.3.0",
-		id: "http-package",
-		description: "Use @tatara/http for app setup, errors, the envelope, OpenAPI docs and the server",
+		version: "0.9.0",
+		id: "package-commands",
+		description: "Take db, authz, email, storage and jobs commands and seeds from their packages",
 		async run(ctx) {
-			await ctx.addDependency(HTTP, versionOf(HTTP));
-			const blockers = [];
-			const replace = [];
-			for (const path of [
-				APP,
-				ROUTES,
-				...SERVERS
-			]) {
-				const text = await read(ctx, path);
-				if (text === void 0) continue;
-				if (await ctx.baseline.isUnchanged(path, text)) replace.push(path);
-				else blockers.push(`${path} is customised`);
-			}
-			const present = [];
-			for (const entry of MOVED) {
-				const text = await read(ctx, entry.path);
-				if (text === void 0) continue;
-				present.push(entry);
-				if (!await ctx.baseline.isUnchanged(entry.path, text)) blockers.push(`${entry.path} is customised`);
-			}
-			for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
-			if (blockers.length > 0) {
-				ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
-				ctx.report.blocked.push("http-package");
-				return;
-			}
-			for (const path of replace) {
-				const next = await ctx.renderCurrent(path);
-				if (next !== void 0) await ctx.write(path, next);
+			const sources = await sourceFiles(ctx);
+			const texts = /* @__PURE__ */ new Map();
+			for (const path of sources) texts.set(path, await ctx.read(path));
+			const ejected = ejectedPackages(ctx.project.config);
+			for (const path of COPIES) {
+				if (!texts.has(path)) continue;
+				if (ejected.includes(path.split("/")[2] ?? "")) continue;
+				const importers = [...texts].filter(([other, text]) => other !== path && importsOf(text, specifierOf(path)));
+				if (importers.length > 0) {
+					ctx.report.notes.push(`${path} was kept: ${importers.map(([p]) => p).join(", ")} import it.`);
+					continue;
+				}
+				await ctx.removeIfUnchanged(path);
 			}
-			for (const entry of present) await ctx.removeIfUnchanged(entry.path);
-			for (const specifier of [
-				"#core/http/errors",
-				"#core/http/response",
-				"#core/http/middleware/validation"
-			]) await ctx.rewriteImports(specifier, HTTP);
 		}
-	},
-	dbTesting,
-	authPackage,
-	authzPackage,
-	addonPackages
+	}
 ];
 //#endregion
 //#region src/upgrade/context.ts
@@ -4094,7 +4231,7 @@ function createContext(project, baseline, opts = {}) {
 		await mkdir(dirname(abs(path)), { recursive: true });
 		await writeFile(abs(path), text);
 	};
-	return {
+	const ctx = {
 		project,
 		baseline,
 		report,
@@ -4144,6 +4281,24 @@ function createContext(project, baseline, opts = {}) {
 			});
 			return (await rendered).get(path);
 		},
+		async regenerate(path) {
+			const next = await ctx.renderCurrent(path);
+			if (next === void 0) {
+				const spec = `#${path.replace(/^src\//, "").replace(/\.ts$/, "")}`;
+				const importers = [];
+				for (const other of await glob(["src/**/*.ts", "tests/**/*.ts"], {
+					cwd: project.root,
+					ignore: ["src/generated/**"]
+				})) if (other !== path && importsOf(await readFile(abs(other), "utf8"), spec)) importers.push(other);
+				if (importers.length > 0) {
+					report.notes.push(`${path} was kept: ${importers.join(", ")} import it.`);
+					return "kept";
+				}
+				return ctx.removeIfUnchanged(path);
+			}
+			await write(path, next);
+			return "written";
+		},
 		async addDependency(name, range, { dev = false } = {}) {
 			if (ejected.includes(name.replace(/^@tatara\//, ""))) {
 				const note = `${name} is ejected; it was not added (its code is in src/ejected)`;
@@ -4159,9 +4314,33 @@ function createContext(project, baseline, opts = {}) {
 			await write("package.json", `${JSON.stringify(pkg, null, "	")}\n`);
 		}
 	};
+	return ctx;
 }
 //#endregion
 //#region src/commands/upgrade.ts
+async function pmInstall(project) {
+	const [cmd = "pnpm", ...args] = pmCommands(project.config.packageManager).install;
+	if ((await x(cmd, args, {
+		throwOnError: false,
+		nodeOptions: {
+			cwd: project.root,
+			stdio: "inherit"
+		}
+	})).exitCode !== 0) throw new Error(`${cmd} ${args.join(" ")} failed; fix it, then run tatara upgrade again`);
+}
+/** Sets every @tatara/* library the app depends on to the range this CLI ships with. */
+async function bumpPackages(ctx) {
+	const pkg = JSON.parse(await ctx.read("package.json"));
+	const known = templateVersions();
+	for (const dev of [false, true]) for (const [name, range] of Object.entries((dev ? pkg.devDependencies : pkg.dependencies) ?? {})) {
+		if (!name.startsWith("@tatara/") || name === "@tatara/cli" || !(name in known)) continue;
+		const current = /^\^(\d+\.\d+\.\d+)$/.exec(range)?.[1];
+		const next = versionOf(name);
+		const shipped = /^\^(\d+\.\d+\.\d+)$/.exec(next)?.[1];
+		if (!current || !shipped || compareVersions(current, shipped) >= 0) continue;
+		await ctx.addDependency(name, next, { dev });
+	}
+}
 async function biomeFormat(file, project) {
 	const biome = join(project.root, "node_modules", ".bin", "biome");
 	if (!existsSync(biome)) return;
@@ -4208,9 +4387,11 @@ async function upgrade(project, opts = {}) {
 		ctx.report.ran.push(mod.id);
 		if (ctx.report.blocked.length > blockedBefore && reached === target) reached = due.slice(0, due.indexOf(mod)).at(-1)?.version ?? from;
 	}
+	await bumpPackages(ctx);
 	if (opts.dryRun) return ctx.report;
 	const format = opts.formatFile ?? biomeFormat;
 	for (const path of ctx.report.written) await format(path, project);
+	await (opts.runInstall ?? pmInstall)(project);
 	await (opts.runSync ?? sync)(project);
 	const path = join(project.root, "tatara.json");
 	const config = JSON.parse(await readFile(path, "utf8"));
@@ -4243,7 +4424,7 @@ function printUpgrade(report, from, to) {
 //#endregion
 //#region src/bin.ts
 const program = new Command("tatara").description("Create and grow opinionated Hono backends").version(cliVersion());
-program.command("new").description("Create a new app").argument("[dir]", "directory to create").option("--orm <orm>", "drizzle | prisma | none").option("--db <database>", "postgres | mysql | none").option("--auth <provider>", "better-auth | none (keycloak = better-auth with --auth-methods keycloak)").option("--auth-methods <list>", "email-otp,phone-otp,password,orgs (better-auth)").option("--addons <list>", "authz,jobs,admin,storage,email,i18n").option("--pm <pm>", "pnpm | npm | bun").option("-y, --yes", "skip prompts and use flags/defaults").option("--no-install", "do not install dependencies").option("--no-git", "do not initialise git").action(async (dir, flags) => {
+program.command("new").description("Create a new app").argument("[dir]", "directory to create").option("--orm <orm>", "drizzle | prisma | none").option("--db <database>", "postgres | mysql | none").option("--auth <provider>", "better-auth | none (keycloak = better-auth with --auth-methods keycloak)").option("--auth-methods <list>", "email-otp,phone-otp,password,orgs (better-auth)").option("--addons <list>", "authz,jobs,admin,storage,email,i18n").option("--pm <pm>", "pnpm | npm | bun").option("-y, --yes", "skip prompts and use flags/defaults").option("--no-install", "do not install dependencies").option("--no-git", "do not initialise git").addOption(new Option("--framework-tests", "include tatara's own wiring tests (e2e)").hideHelp()).action(async (dir, flags) => {
 	await newApp(dir, flags);
 });
 program.command("sync").description("Regenerate src/generated from discovered module files").option("--quiet", "no output").action(async (flags) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/authz/files+drizzle/src/core/authz/index.ts

@@ -0,0 +1,15 @@
+import { createAuthz } from "@tatara/authz";
+import { drizzleAuthzStore } from "@tatara/authz/drizzle";
+import * as tables from "#core/authz/db/authz.schema";
+import { SYSTEM_ROLES } from "#core/authz/system-roles";
+import { db } from "#core/db/client";
+import { catalog, type PermissionKey } from "#generated/permissions";
+
+/** The app's authorization: its tables (authz.schema.ts), the catalog from `tatara sync`, built-in roles. */
+export const authz = createAuthz<PermissionKey>({
+	store: drizzleAuthzStore(db, tables),
+	catalog,
+	systemRoles: SYSTEM_ROLES,
+});
+
+export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/authz/files+prisma/src/core/authz/index.ts

@@ -0,0 +1,14 @@
+import { createAuthz } from "@tatara/authz";
+import { prismaAuthzStore } from "@tatara/authz/prisma";
+import { SYSTEM_ROLES } from "#core/authz/system-roles";
+import { db } from "#core/db/client";
+import { catalog, type PermissionKey } from "#generated/permissions";
+
+/** The app's authorization: its tables (prisma/models/authz.prisma), the catalog from `tatara sync`, built-in roles. */
+export const authz = createAuthz<PermissionKey>({
+	store: prismaAuthzStore(db),
+	catalog,
+	systemRoles: SYSTEM_ROLES,
+});
+
+export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/versions.json

@@ -33,13 +33,13 @@
   "@types/nodemailer": "8.0.2",
   "@tatara/core": "0.1.1",
   "@tatara/http": "0.1.1",
-  "@tatara/db": "0.1.1",
+  "@tatara/db": "0.2.0",
   "@tatara/testing": "0.1.1",
   "@tatara/auth": "0.1.1",
   "@tatara/keycloak": "0.1.1",
-  "@tatara/authz": "0.1.0",
-  "@tatara/storage": "0.1.0",
-  "@tatara/email": "0.1.0",
+  "@tatara/authz": "0.2.0",
+  "@tatara/storage": "0.2.0",
+  "@tatara/email": "0.2.0",
   "@tatara/i18n": "0.1.0",
-  "@tatara/jobs": "0.1.0"
+  "@tatara/jobs": "0.2.0"
 }

package/templates/features/authz/files/src/core/authz/commands/grant-role.ts

@@ -1,21 +0,0 @@
-import { z } from "zod";
-import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "@tatara/authz";
-import { authz } from "#core/authz/index";
-import { defineCommand } from "@tatara/core";
-
-export default defineCommand({
-	name: "authz:grant-role",
-	description: "Assign a role (built-in key or custom role key) to a user in an org",
-	args: z.object({
-		user: z.string().min(1),
-		role: z.string().min(1),
-		org: z.string().default(DEFAULT_ORG_ID),
-	}),
-	async run({ user, role, org }, { logger }) {
-		const found = (await authz.store.findRoleByKey(org, role)) ??
-			(await authz.store.findRoleByKey(SYSTEM_ORG_ID, role));
-		if (!found) throw new Error(`No role "${role}" (run authz:sync-permissions first for built-in roles)`);
-		const added = await authz.assignRole(null, org, user, found.id);
-		logger.info({ user, role, org, added }, added ? "role assigned" : "role already assigned");
-	},
-});

package/templates/features/authz/files/src/core/authz/commands/sync-permissions.ts

@@ -1,11 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { authz } from "#core/authz/index";
-
-export default defineCommand({
-	name: "authz:sync-permissions",
-	description: "Create/update built-in roles so their grants match the code (run on every deploy)",
-	async run(_args, { logger }) {
-		const result = await authz.syncSystemRoles();
-		logger.info(result, "built-in roles in sync");
-	},
-});

package/templates/features/authz/files/src/core/authz/db/seed.ts

@@ -1,10 +0,0 @@
-import { authz } from "#core/authz/index";
-import { defineSeed } from "@tatara/db";
-
-export default defineSeed({
-	name: "authz:system-roles",
-	order: -10,
-	async run({ logger }) {
-		logger.info(await authz.syncSystemRoles(), "built-in roles in sync");
-	},
-});

package/templates/features/authz/files/src/core/authz/index.ts

@@ -1,9 +0,0 @@
-import { createAuthz } from "@tatara/authz";
-import { store } from "#core/authz/db/store";
-import { SYSTEM_ROLES } from "#core/authz/system-roles";
-import { catalog, type PermissionKey } from "#generated/permissions";
-
-/** The app's authorization: its store, the permission catalog from `tatara sync`, built-in roles. */
-export const authz = createAuthz<PermissionKey>({ store, catalog, systemRoles: SYSTEM_ROLES });
-
-export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/authz/files+drizzle/src/core/authz/db/store.ts

@@ -1,275 +0,0 @@
-import { and, count, desc, eq, gt, inArray, isNull, or } from "drizzle-orm";
-import type { OverlayEffect, Scope } from "@tatara/authz";
-import { SYSTEM_ORG_ID } from "@tatara/authz";
-import {
-	authzAuditLog,
-	authzMemberRoles,
-	authzOverlays,
-	authzRolePermissions,
-	authzRoles,
-} from "#core/authz/db/authz.schema";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
-import { db } from "#core/db/client";
-import { newId } from "@tatara/db";
-
-const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
-
-type RoleRecord = typeof authzRoles.$inferSelect;
-type OverlayRecord = typeof authzOverlays.$inferSelect;
-
-function toOverlay(row: OverlayRecord): OverlayRow {
-	return { ...row, scope: toScope(row.scope), effect: row.effect as OverlayEffect };
-}
-
-async function hydrate(roles: RoleRecord[], orgId: string): Promise<RoleRow[]> {
-	if (roles.length === 0) return [];
-	const ids = roles.map((r) => r.id);
-	const [grants, members] = await Promise.all([
-		db.select().from(authzRolePermissions).where(inArray(authzRolePermissions.roleId, ids)),
-		db
-			.select({ roleId: authzMemberRoles.roleId, total: count() })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), inArray(authzMemberRoles.roleId, ids)))
-			.groupBy(authzMemberRoles.roleId),
-	]);
-	return roles.map((role) => ({
-		id: role.id,
-		orgId: role.orgId,
-		key: role.key,
-		name: role.name,
-		description: role.description,
-		isSystem: role.isSystem,
-		grants: grants
-			.filter((g) => g.roleId === role.id)
-			.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-		memberCount: members.find((m) => m.roleId === role.id)?.total ?? 0,
-	}));
-}
-
-const visibleTo = (orgId: string) => or(eq(authzRoles.orgId, SYSTEM_ORG_ID), eq(authzRoles.orgId, orgId));
-
-async function insertGrants(roleId: string, grants: PermissionGrant[]) {
-	if (grants.length === 0) return;
-	await db.insert(authzRolePermissions).values(
-		grants.map((g) => ({
-			id: newId(),
-			roleId,
-			resource: g.resource,
-			action: g.action,
-			scope: g.scope ?? "",
-		})),
-	);
-}
-
-export const store: AuthzStore = {
-	async roleGrants(orgId, userId, impliedRoleKeys) {
-		const assigned = await db
-			.select({ roleId: authzMemberRoles.roleId })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId)));
-		const implied = impliedRoleKeys.length
-			? await db
-					.select({ id: authzRoles.id })
-					.from(authzRoles)
-					.where(and(eq(authzRoles.orgId, SYSTEM_ORG_ID), inArray(authzRoles.key, impliedRoleKeys)))
-			: [];
-		const roleIds = [...new Set([...assigned.map((r) => r.roleId), ...implied.map((r) => r.id)])];
-		if (roleIds.length === 0) return { roles: [], grants: [] };
-		const [roles, grants] = await Promise.all([
-			db.select({ key: authzRoles.key }).from(authzRoles).where(inArray(authzRoles.id, roleIds)),
-			db.select().from(authzRolePermissions).where(inArray(authzRolePermissions.roleId, roleIds)),
-		]);
-		return {
-			roles: roles.map((r) => r.key),
-			grants: grants.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-		};
-	},
-
-	async activeOverlays(orgId, userId, now) {
-		const rows = await db
-			.select()
-			.from(authzOverlays)
-			.where(
-				and(
-					eq(authzOverlays.orgId, orgId),
-					eq(authzOverlays.userId, userId),
-					or(isNull(authzOverlays.expiresAt), gt(authzOverlays.expiresAt, now)),
-				),
-			);
-		return rows.map(toOverlay);
-	},
-
-	async listRoles(orgId) {
-		const roles = await db.select().from(authzRoles).where(visibleTo(orgId)).orderBy(authzRoles.key);
-		return hydrate(roles, orgId);
-	},
-
-	async findRole(orgId, roleId) {
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(and(eq(authzRoles.id, roleId), visibleTo(orgId)));
-		return (await hydrate(roles, orgId))[0] ?? null;
-	},
-
-	async findRoleByKey(orgId, key) {
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(and(eq(authzRoles.key, key), eq(authzRoles.orgId, orgId)));
-		return (await hydrate(roles, orgId))[0] ?? null;
-	},
-
-	async createRole(input) {
-		const id = newId();
-		await db.insert(authzRoles).values({
-			id,
-			orgId: input.orgId,
-			key: input.key,
-			name: input.name,
-			description: input.description,
-			isSystem: input.isSystem,
-		});
-		await insertGrants(id, input.grants);
-		return id;
-	},
-
-	async updateRole(roleId, input) {
-		const fields = {
-			...(input.name === undefined ? {} : { name: input.name }),
-			...(input.description === undefined ? {} : { description: input.description }),
-		};
-		await db
-			.update(authzRoles)
-			.set({ ...fields, updatedAt: new Date() })
-			.where(eq(authzRoles.id, roleId));
-		if (input.grants) {
-			await db.delete(authzRolePermissions).where(eq(authzRolePermissions.roleId, roleId));
-			await insertGrants(roleId, input.grants);
-		}
-	},
-
-	async deleteRole(roleId) {
-		await db.delete(authzRoles).where(eq(authzRoles.id, roleId));
-	},
-
-	async memberRoles(orgId, userId) {
-		const assigned = await db
-			.select({ roleId: authzMemberRoles.roleId })
-			.from(authzMemberRoles)
-			.where(and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId)));
-		if (assigned.length === 0) return [];
-		const roles = await db
-			.select()
-			.from(authzRoles)
-			.where(inArray(authzRoles.id, assigned.map((a) => a.roleId)));
-		return hydrate(roles, orgId);
-	},
-
-	async assignRole(orgId, userId, roleId, by) {
-		const existing = await db
-			.select({ id: authzMemberRoles.id })
-			.from(authzMemberRoles)
-			.where(
-				and(
-					eq(authzMemberRoles.orgId, orgId),
-					eq(authzMemberRoles.userId, userId),
-					eq(authzMemberRoles.roleId, roleId),
-				),
-			);
-		if (existing.length > 0) return false;
-		await db.insert(authzMemberRoles).values({ id: newId(), orgId, userId, roleId, assignedBy: by });
-		return true;
-	},
-
-	async revokeRole(orgId, userId, roleId) {
-		const where = and(
-			eq(authzMemberRoles.orgId, orgId),
-			eq(authzMemberRoles.userId, userId),
-			eq(authzMemberRoles.roleId, roleId),
-		);
-		const existing = await db.select({ id: authzMemberRoles.id }).from(authzMemberRoles).where(where);
-		if (existing.length === 0) return false;
-		await db.delete(authzMemberRoles).where(where);
-		return true;
-	},
-
-	async removeMember(orgId, userId) {
-		const roleWhere = and(eq(authzMemberRoles.orgId, orgId), eq(authzMemberRoles.userId, userId));
-		const overlayWhere = and(eq(authzOverlays.orgId, orgId), eq(authzOverlays.userId, userId));
-		// count first: MySQL has no RETURNING
-		return db.transaction(async (tx) => {
-			const [roles] = await tx.select({ n: count() }).from(authzMemberRoles).where(roleWhere);
-			const [overlays] = await tx.select({ n: count() }).from(authzOverlays).where(overlayWhere);
-			await tx.delete(authzMemberRoles).where(roleWhere);
-			await tx.delete(authzOverlays).where(overlayWhere);
-			return { roles: roles?.n ?? 0, overlays: overlays?.n ?? 0 };
-		});
-	},
-
-	async listOverlays(orgId, userId) {
-		const rows = await db
-			.select()
-			.from(authzOverlays)
-			.where(and(eq(authzOverlays.orgId, orgId), eq(authzOverlays.userId, userId)))
-			.orderBy(desc(authzOverlays.createdAt));
-		return rows.map(toOverlay);
-	},
-
-	async addOverlay(input) {
-		const id = newId();
-		const scope = input.scope ?? "";
-		await db
-			.delete(authzOverlays)
-			.where(
-				and(
-					eq(authzOverlays.orgId, input.orgId),
-					eq(authzOverlays.userId, input.userId),
-					eq(authzOverlays.resource, input.resource),
-					eq(authzOverlays.action, input.action),
-					eq(authzOverlays.scope, scope),
-					eq(authzOverlays.effect, input.effect),
-				),
-			);
-		await db.insert(authzOverlays).values({ ...input, id, scope });
-		return id;
-	},
-
-	async removeOverlay(orgId, userId, overlayId) {
-		const where = and(
-			eq(authzOverlays.orgId, orgId),
-			eq(authzOverlays.userId, userId),
-			eq(authzOverlays.id, overlayId),
-		);
-		const [row] = await db.select().from(authzOverlays).where(where);
-		if (!row) return null;
-		await db.delete(authzOverlays).where(where);
-		return toOverlay(row);
-	},
-
-	async writeAudit(input) {
-		await db.insert(authzAuditLog).values({
-			id: newId(),
-			orgId: input.orgId,
-			actorId: input.actorId,
-			targetUserId: input.targetUserId,
-			changeType: input.changeType,
-			before: input.before === undefined ? null : JSON.stringify(input.before),
-			after: input.after === undefined ? null : JSON.stringify(input.after),
-		});
-	},
-
-	async listAudit(orgId, limit) {
-		const rows = await db
-			.select()
-			.from(authzAuditLog)
-			.where(eq(authzAuditLog.orgId, orgId))
-			.orderBy(desc(authzAuditLog.id))
-			.limit(limit);
-		return rows.map((r) => ({
-			...r,
-			before: r.before ? (JSON.parse(r.before) as unknown) : null,
-			after: r.after ? (JSON.parse(r.after) as unknown) : null,
-		}));
-	},
-};

package/templates/features/authz/files+prisma/src/core/authz/db/store.ts

@@ -1,236 +0,0 @@
-import type { OverlayEffect, Scope } from "@tatara/authz";
-import { SYSTEM_ORG_ID } from "@tatara/authz";
-import type { AuthzStore, OverlayRow, PermissionGrant, RoleRow } from "@tatara/authz";
-import { db } from "#core/db/client";
-import { newId } from "@tatara/db";
-
-const toScope = (scope: string): Scope | null => (scope === "" ? null : (scope as Scope));
-
-interface OverlayRecord {
-	id: string;
-	orgId: string;
-	userId: string;
-	resource: string;
-	action: string;
-	scope: string;
-	effect: string;
-	grantedBy: string | null;
-	reason: string | null;
-	expiresAt: Date | null;
-	createdAt: Date;
-}
-
-function toOverlay(row: OverlayRecord): OverlayRow {
-	return { ...row, scope: toScope(row.scope), effect: row.effect as OverlayEffect };
-}
-
-const roleInclude = (orgId: string) => ({
-	permissions: true,
-	_count: { select: { members: { where: { orgId } } } },
-});
-
-interface RoleRecord {
-	id: string;
-	orgId: string;
-	key: string;
-	name: string;
-	description: string | null;
-	isSystem: boolean;
-	permissions: { resource: string; action: string; scope: string }[];
-	_count: { members: number };
-}
-
-function toRole(role: RoleRecord): RoleRow {
-	return {
-		id: role.id,
-		orgId: role.orgId,
-		key: role.key,
-		name: role.name,
-		description: role.description,
-		isSystem: role.isSystem,
-		grants: role.permissions.map((g) => ({
-			resource: g.resource,
-			action: g.action,
-			scope: toScope(g.scope),
-		})),
-		memberCount: role._count.members,
-	};
-}
-
-const grantRows = (grants: PermissionGrant[]) =>
-	grants.map((g) => ({ id: newId(), resource: g.resource, action: g.action, scope: g.scope ?? "" }));
-
-export const store: AuthzStore = {
-	async roleGrants(orgId, userId, impliedRoleKeys) {
-		const roles = await db.authzRole.findMany({
-			where: {
-				OR: [
-					{ members: { some: { orgId, userId } } },
-					...(impliedRoleKeys.length
-						? [{ orgId: SYSTEM_ORG_ID, key: { in: impliedRoleKeys } }]
-						: []),
-				],
-			},
-			include: { permissions: true },
-		});
-		return {
-			roles: roles.map((r) => r.key),
-			grants: roles.flatMap((r) =>
-				r.permissions.map((g) => ({ resource: g.resource, action: g.action, scope: toScope(g.scope) })),
-			),
-		};
-	},
-
-	async activeOverlays(orgId, userId, now) {
-		const rows = await db.authzOverlay.findMany({
-			where: { orgId, userId, OR: [{ expiresAt: null }, { expiresAt: { gt: now } }] },
-		});
-		return rows.map(toOverlay);
-	},
-
-	async listRoles(orgId) {
-		const roles = await db.authzRole.findMany({
-			where: { orgId: { in: [SYSTEM_ORG_ID, orgId] } },
-			include: roleInclude(orgId),
-			orderBy: { key: "asc" },
-		});
-		return roles.map(toRole);
-	},
-
-	async findRole(orgId, roleId) {
-		const role = await db.authzRole.findFirst({
-			where: { id: roleId, orgId: { in: [SYSTEM_ORG_ID, orgId] } },
-			include: roleInclude(orgId),
-		});
-		return role ? toRole(role) : null;
-	},
-
-	async findRoleByKey(orgId, key) {
-		const role = await db.authzRole.findFirst({ where: { key, orgId }, include: roleInclude(orgId) });
-		return role ? toRole(role) : null;
-	},
-
-	async createRole(input) {
-		const id = newId();
-		await db.authzRole.create({
-			data: {
-				id,
-				orgId: input.orgId,
-				key: input.key,
-				name: input.name,
-				description: input.description,
-				isSystem: input.isSystem,
-				permissions: { create: grantRows(input.grants) },
-			},
-		});
-		return id;
-	},
-
-	async updateRole(roleId, input) {
-		await db.$transaction(async (tx) => {
-			await tx.authzRole.update({
-				where: { id: roleId },
-				data: {
-					...(input.name === undefined ? {} : { name: input.name }),
-					...(input.description === undefined ? {} : { description: input.description }),
-				},
-			});
-			if (input.grants) {
-				await tx.authzRolePermission.deleteMany({ where: { roleId } });
-				await tx.authzRolePermission.createMany({
-					data: grantRows(input.grants).map((g) => ({ ...g, roleId })),
-				});
-			}
-		});
-	},
-
-	async deleteRole(roleId) {
-		await db.authzRole.delete({ where: { id: roleId } });
-	},
-
-	async memberRoles(orgId, userId) {
-		const roles = await db.authzRole.findMany({
-			where: { members: { some: { orgId, userId } } },
-			include: roleInclude(orgId),
-		});
-		return roles.map(toRole);
-	},
-
-	async assignRole(orgId, userId, roleId, by) {
-		const existing = await db.authzMemberRole.findFirst({ where: { orgId, userId, roleId } });
-		if (existing) return false;
-		await db.authzMemberRole.create({ data: { id: newId(), orgId, userId, roleId, assignedBy: by } });
-		return true;
-	},
-
-	async revokeRole(orgId, userId, roleId) {
-		const { count } = await db.authzMemberRole.deleteMany({ where: { orgId, userId, roleId } });
-		return count > 0;
-	},
-
-	async removeMember(orgId, userId) {
-		const [roles, overlays] = await db.$transaction([
-			db.authzMemberRole.deleteMany({ where: { orgId, userId } }),
-			db.authzOverlay.deleteMany({ where: { orgId, userId } }),
-		]);
-		return { roles: roles.count, overlays: overlays.count };
-	},
-	async listOverlays(orgId, userId) {
-		const rows = await db.authzOverlay.findMany({
-			where: { orgId, userId },
-			orderBy: { createdAt: "desc" },
-		});
-		return rows.map(toOverlay);
-	},
-
-	async addOverlay(input) {
-		const id = newId();
-		const scope = input.scope ?? "";
-		await db.authzOverlay.deleteMany({
-			where: {
-				orgId: input.orgId,
-				userId: input.userId,
-				resource: input.resource,
-				action: input.action,
-				scope,
-				effect: input.effect,
-			},
-		});
-		await db.authzOverlay.create({ data: { ...input, id, scope } });
-		return id;
-	},
-
-	async removeOverlay(orgId, userId, overlayId) {
-		const row = await db.authzOverlay.findFirst({ where: { id: overlayId, orgId, userId } });
-		if (!row) return null;
-		await db.authzOverlay.deleteMany({ where: { id: overlayId, orgId, userId } });
-		return toOverlay(row);
-	},
-
-	async writeAudit(input) {
-		await db.authzAuditLog.create({
-			data: {
-				id: newId(),
-				orgId: input.orgId,
-				actorId: input.actorId,
-				targetUserId: input.targetUserId,
-				changeType: input.changeType,
-				before: input.before === undefined ? null : JSON.stringify(input.before),
-				after: input.after === undefined ? null : JSON.stringify(input.after),
-			},
-		});
-	},
-
-	async listAudit(orgId, limit) {
-		const rows = await db.authzAuditLog.findMany({
-			where: { orgId },
-			orderBy: { id: "desc" },
-			take: limit,
-		});
-		return rows.map((r) => ({
-			...r,
-			before: r.before ? (JSON.parse(r.before) as unknown) : null,
-			after: r.after ? (JSON.parse(r.after) as unknown) : null,
-		}));
-	},
-};

package/templates/features/db/files/src/core/db/commands/migrate.ts

@@ -1,12 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { env } from "#core/config/env";
-import { migrateDatabase } from "#core/db/migrate";
-
-export default defineCommand({
-	name: "db:migrate",
-	description: "Apply pending database migrations",
-	async run(_args, { logger }) {
-		await migrateDatabase(env.DATABASE_URL);
-		logger.info("migrations applied");
-	},
-});

package/templates/features/db/files/src/core/db/commands/reset.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-import { defineCommand, flag } from "@tatara/core";
-import { env } from "#core/config/env";
-import { dropAllTables } from "#core/db/admin";
-import { migrateDatabase } from "#core/db/migrate";
-
-export default defineCommand({
-	name: "db:reset",
-	description: "Drop every table and re-apply migrations (refuses to run in production)",
-	args: z.object({ force: flag() }),
-	async run({ force }, { logger }) {
-		if (env.NODE_ENV === "production" && !force) {
-			throw new Error("db:reset refuses to run with NODE_ENV=production (pass --force to override)");
-		}
-		await dropAllTables(env.DATABASE_URL);
-		await migrateDatabase(env.DATABASE_URL);
-		logger.info("database reset");
-	},
-});

package/templates/features/db/files/src/core/db/commands/seed.ts

@@ -1,13 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { seeds } from "#generated/seeds";
-
-export default defineCommand({
-	name: "db:seed",
-	description: "Run every idempotent seed (core first, then modules)",
-	async run(_args, { logger }) {
-		for (const seed of [...seeds].sort((a, b) => (a.order ?? 100) - (b.order ?? 100))) {
-			await seed.run({ logger: logger.child({ seed: seed.name }) });
-			logger.info({ seed: seed.name }, "seeded");
-		}
-	},
-});

package/templates/features/db/files/src/core/db/tests/reset.test.ts

@@ -1,7 +0,0 @@
-import { expect, it } from "vitest";
-import { parseFlags } from "@tatara/core";
-import reset from "#core/db/commands/reset";
-
-it("does not treat --force false as forcing db:reset", () => {
-	expect(reset.args?.parse(parseFlags(["--force", "false"]))).toEqual({ force: false });
-});

package/templates/features/email/files/src/core/email/commands/send-test.ts

@@ -1,13 +0,0 @@
-import { z } from "zod";
-import { defineCommand } from "@tatara/core";
-import { sendEmail } from "#core/email/send";
-
-export default defineCommand({
-	name: "email:send-test",
-	description: "Send a test email (see it in Mailpit locally)",
-	args: z.object({ to: z.email().default("dev@example.com") }),
-	async run({ to }, { logger }) {
-		await sendEmail({ to, subject: "Test email", text: "It works." });
-		logger.info({ to }, "test email sent");
-	},
-});

package/templates/features/jobs/files/src/core/jobs/commands/enqueue.ts

@@ -1,13 +0,0 @@
-import { z } from "zod";
-import { defineCommand } from "@tatara/core";
-import { enqueue } from "#core/jobs/index";
-
-export default defineCommand({
-	name: "jobs:enqueue",
-	description: "Enqueue a job by topic with a JSON payload (for development and debugging)",
-	args: z.object({ topic: z.string().min(1), data: z.string().default("{}") }),
-	async run({ topic, data }, { logger }) {
-		const id = await enqueue(topic, JSON.parse(data) as unknown);
-		logger.info({ topic, id }, "job enqueued");
-	},
-});

package/templates/features/storage/files/src/core/storage/commands/check.ts

@@ -1,18 +0,0 @@
-import { defineCommand } from "@tatara/core";
-import { env } from "#core/config/env";
-import { ensureBucket } from "@tatara/storage/s3";
-import { s3, storage } from "#core/storage/index";
-
-export default defineCommand({
-	name: "storage:check",
-	description: "Create the bucket if needed, then write, read and delete a probe object",
-	async run(_args, { logger }) {
-		if (env.STORAGE_DRIVER === "s3" && (await ensureBucket(s3, env.S3_BUCKET))) logger.info({ bucket: env.S3_BUCKET }, "bucket created");
-		const key = `tatara-check/${Date.now()}.txt`;
-		await storage.put(key, "ok", "text/plain");
-		const body = await storage.get(key);
-		await storage.delete(key);
-		if (new TextDecoder().decode(body ?? new Uint8Array()) !== "ok") throw new Error("storage round-trip failed");
-		logger.info({ driver: env.STORAGE_DRIVER }, "storage OK");
-	},
-});