@tulipes/cli 0.1.0 → 0.2.0-rc.1

package/templates/app/modules/users/routes/users.routes.ts

@@ -0,0 +1,60 @@
+import { Router } from "express";
+import type { BackendCtx } from "@tulipes/core/boot";
+import { z } from "zod/v4";
+
+import { UsersController } from "../controllers/users.controllers.ts";
+import { createBody, emailParam, listQuery, userShape } from "../schemas/users.schemas.ts";
+
+export default function usersRoutes(ctx: BackendCtx): void {
+  const { rai, routes } = ctx;
+  const router = Router();
+  const users = new UsersController(ctx);
+
+  router.get("/", rai({
+      id: "users:read",
+      name: "List users",
+      description: "Page through accounts, clamped by the shared bounds",
+      // Validated on the way in, and described on the way out: one
+      // declaration, so the spec cannot drift from what is enforced.
+      query: listQuery,
+      returns: z.array(userShape),
+    }), users.list());
+
+  router.delete("/:email", rai({
+      id: "users:delete",
+      name: "Soft-delete a user",
+      description: "Flags the account; ordinary queries stop returning it",
+      params: emailParam,
+    }), users.softDelete());
+
+  router.get("/deleted", rai({
+      id: "users:read-deleted",
+      name: "List soft-deleted users",
+    }), users.listDeleted());
+
+  router.post("/", rai({
+      id: "users:create",
+      status: 201,
+      name: "Create a user",
+      description: "Adds the account and queues its welcome email",
+      body: createBody,
+    }), users.create());
+
+  router.get("/ping", rai({
+      id: "users:ping",
+      name: "Users module status",
+    }), users.ping());
+
+  router.get("/missing", rai({
+      id: "users:demo-missing",
+      name: "HttpError demo",
+    }), users.demoMissing());
+
+  router.get("/boom", rai({
+      id: "users:demo-boom",
+      name: "Unhandled error demo",
+    }), users.demoBoom());
+
+  // Deliberately outside the API prefix, to show a mount of its own.
+  routes.mount(router, "/users");
+}

package/templates/app/modules/users/schemas/users.schemas.ts

@@ -0,0 +1,30 @@
+import { z } from "zod/v4";
+
+/**
+ * Shapes for the users endpoints. Declared once and used twice: `rai()`
+ * validates the request against them, and `tulipes spec` describes them
+ * in the generated OpenAPI document and Postman collection — so the
+ * documentation can never claim a shape the endpoint would reject.
+ *
+ * zod/v4, not the classic import: `z.toJSONSchema` is what the generator
+ * uses, and it only understands v4 schemas.
+ */
+export const listQuery = z.object({
+  page: z.coerce.number().int().min(1).optional(),
+  per_page: z.coerce.number().int().min(1).max(100).optional(),
+});
+
+export const createBody = z.object({
+  // The message doubles as an i18n key: the error handler translates it
+  // in this module's namespace, and falls back to the text as written.
+  email: z.email("emailInvalid"),
+});
+
+export const emailParam = z.object({
+  email: z.email("emailInvalid"),
+});
+
+export const userShape = z.object({
+  email: z.string(),
+  role: z.string(),
+});

package/templates/app/modules/users/sockets/users.sockets.ts

@@ -0,0 +1,18 @@
+import type { Ctx } from "@tulipes/core/boot";
+import type { SocketRegistry } from "@tulipes/socket.io";
+
+export default function usersSockets({ config }: Ctx, sockets: SocketRegistry): void {
+  sockets.namespace("/users", (nsp) => {
+    nsp.on("connection", (socket) => {
+      socket.emit("welcome", {
+        module: "users",
+        signupMode: config.users?.signupMode,
+        online: nsp.sockets.size,
+      });
+
+      socket.on("whoami", (ack: (reply: { id: string }) => void) => {
+        ack({ id: socket.id });
+      });
+    });
+  });
+}

package/templates/app/nginx/development.conf

@@ -0,0 +1,44 @@
+# {{DOMAIN}} — rendered from nginx/development.conf by scripts/deploy-nginx.ts.
+#
+# Development rarely needs nginx at all: `pnpm dev` already serves on
+# {{PORT}}. This exists so the proxy layer itself can be exercised locally —
+# websocket upgrades and forwarded headers behave differently through a
+# proxy, and finding that out in staging is finding out late.
+#
+# The deploy script refuses while core.publicDomain is still "localhost", so
+# using this means pointing a real hostname at the machine first.
+
+server {
+    listen 80;
+    server_name {{DOMAIN}};
+
+    access_log /var/log/nginx/{{DOMAIN}}.access.log;
+    error_log  /var/log/nginx/{{DOMAIN}}.error.log;
+
+    client_max_body_size 1m;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{PORT}};
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        # Single public ingress: overwrite client-supplied forwarding headers.
+        # For this local upstream, set TRUST_PROXY_CIDRS=127.0.0.1/32.
+        #
+        # That trust is only as good as the port below: the app binds every
+        # interface, so if {{PORT}} is reachable from outside this host a
+        # client can skip nginx entirely — no client_max_body_size, no TLS —
+        # and anything on the host can state its own X-Forwarded-For. Firewall
+        # the port to loopback, or run the app where the platform does it.
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $remote_addr;
+        proxy_set_header X-Forwarded-Host  $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}

package/templates/app/nginx/production.conf

@@ -0,0 +1,75 @@
+# {{DOMAIN}} — rendered from nginx/production.conf by scripts/deploy-nginx.ts.
+# Placeholders are substituted at deploy time; edit this template, never the
+# copy in /etc/nginx/sites-available.
+#
+# Debian/Ubuntu layout (sites-available + sites-enabled).
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{DOMAIN}};
+
+    access_log /var/log/nginx/{{DOMAIN}}.access.log;
+    error_log  /var/log/nginx/{{DOMAIN}}.error.log;
+
+    # Certbot's HTTP-01 challenge, kept above the proxy so certificate
+    # issuance and renewal work without touching this file.
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # Keep in step with the BODY_LIMIT variable. If nginx is stricter,
+    # oversized requests die here as an nginx HTML page instead of the
+    # API's JSON 413.
+    client_max_body_size 1m;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{PORT}};
+        proxy_http_version 1.1;
+
+        # Socket.IO upgrades. Without these the handshake still succeeds and
+        # every connection silently degrades to HTTP polling.
+        proxy_set_header Upgrade $http_upgrade;
+        # Passing the client's own Connection header rather than a mapped
+        # variable: a `map` block here would collide the moment a second
+        # site on this server defines the same variable.
+        proxy_set_header Connection $http_connection;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $remote_addr;
+        proxy_set_header X-Forwarded-Host  $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # For this local upstream, set TRUST_PROXY_CIDRS=127.0.0.1/32.
+        #
+        # That trust is only as good as the port below: the app binds every
+        # interface, so if {{PORT}} is reachable from outside this host a
+        # client can skip nginx entirely — no client_max_body_size, no TLS —
+        # and anything on the host can state its own X-Forwarded-For. Firewall
+        # the port to loopback, or run the app where the platform does it.
+        # These single-ingress templates overwrite client-supplied forwarding headers.
+
+        # Long-lived websockets must outlive nginx's 60s default.
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}
+
+# ── TLS ────────────────────────────────────────────────────────────────────
+# Commented out on purpose: nginx -t fails on certificate paths that do not
+# exist yet, which would make the very first deploy impossible. Install the
+# certificate, then uncomment this block, redeploy with --force, and add a
+# 301 redirect to the :80 server above.
+#
+# server {
+#     listen 443 ssl;
+#     listen [::]:443 ssl;
+#     http2 on;
+#     server_name {{DOMAIN}};
+#
+#     ssl_certificate     /etc/letsencrypt/live/{{DOMAIN}}/fullchain.pem;
+#     ssl_certificate_key /etc/letsencrypt/live/{{DOMAIN}}/privkey.pem;
+#
+#     # …repeat the location / block from above…
+# }

package/templates/app/nginx/staging.conf

@@ -0,0 +1,51 @@
+# {{DOMAIN}} — rendered from nginx/staging.conf by scripts/deploy-nginx.ts.
+# Placeholders are substituted at deploy time; edit this template, never the
+# copy in /etc/nginx/sites-available.
+#
+# Identical to production except for the noindex header below.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{DOMAIN}};
+
+    access_log /var/log/nginx/{{DOMAIN}}.access.log;
+    error_log  /var/log/nginx/{{DOMAIN}}.error.log;
+
+    # Staging must never reach a search index, even if a link leaks.
+    add_header X-Robots-Tag "noindex, nofollow" always;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    client_max_body_size 1m;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{PORT}};
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        # Single public ingress: overwrite client-supplied forwarding headers.
+        # For this local upstream, set TRUST_PROXY_CIDRS=127.0.0.1/32.
+        #
+        # That trust is only as good as the port below: the app binds every
+        # interface, so if {{PORT}} is reachable from outside this host a
+        # client can skip nginx entirely — no client_max_body_size, no TLS —
+        # and anything on the host can state its own X-Forwarded-For. Firewall
+        # the port to loopback, or run the app where the platform does it.
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $remote_addr;
+        proxy_set_header X-Forwarded-Host  $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}
+
+# TLS: see nginx/production.conf — same block, same reason it ships
+# commented out.

package/templates/app/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@tulipes-example/app",
+  "tulipes": {
+    "providers": {
+      "models": "@tulipes/mongoose",
+      "settings": "@tulipes/mongoose/settings",
+      "queues": "@tulipes/bullmq",
+      "sockets": "@tulipes/socket.io"
+    }
+  },
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tulipes dev",
+    "worker": "node worker.ts",
+    "sync": "tulipes sync",
+    "check": "tulipes env:check",
+    "typecheck": "tsc --noEmit",
+    "script": "node",
+    "spec": "tulipes spec --openapi docs/openapi.json --postman docs/collection.json",
+    "manifest": "tulipes agent manifest --out docs/agent-manifest.json",
+    "test": "vitest run",
+    "start": "node app.ts",
+    "pm2:start": "pm2 start ecosystem.config.cjs",
+    "pm2:start:staging": "pm2 start ecosystem.config.cjs --env staging",
+    "pm2:start:production": "pm2 start ecosystem.config.cjs --env production",
+    "pm2:stop": "pm2 stop ecosystem.config.cjs",
+    "pm2:restart": "pm2 restart ecosystem.config.cjs",
+    "pm2:delete": "pm2 delete ecosystem.config.cjs",
+    "pm2:logs": "pm2 logs",
+    "pm2:status": "pm2 status"
+  },
+  "dependencies": {
+    "@tulipes/bullmq": "workspace:*",
+    "@tulipes/core": "workspace:*",
+    "@tulipes/mongoose": "workspace:*",
+    "@tulipes/socket.io": "workspace:*",
+    "ioredis": "^5",
+    "mongoose": "^8",
+    "zod": "^3.25"
+  },
+  "devDependencies": {
+    "@tulipes/cli": "workspace:*",
+    "@tulipes/spec": "workspace:*",
+    "@tulipes/testing": "workspace:*",
+    "@types/express": "^5",
+    "@types/jsonwebtoken": "^9",
+    "@types/node": "^24",
+    "jsonwebtoken": "^9",
+    "pm2": "^7.0.4",
+    "typescript": "^7",
+    "vite": "^8.2.2",
+    "vitest": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=24.0.0 <25"
+  }
+}

package/templates/app/scripts/count-greetings.ts

@@ -0,0 +1,29 @@
+/**
+ * Example maintenance script. Run it with:
+ *
+ *   pnpm script scripts/count-greetings.ts
+ *
+ * Script mode runs every phase the backend runs — environment, modules,
+ * config, ACL, database, models, queue producers — and then starts nothing.
+ * So a script gets exactly what a route handler gets, minus the server.
+ *
+ * The one thing to always copy from this file is the try/finally: the mongo
+ * and redis connections hold the event loop open, so a script that skips
+ * shutdown() prints its output and then hangs forever.
+ */
+import { join } from "node:path";
+
+import { boot } from "@tulipes/core/boot";
+
+const handle = await boot({ rootDir: join(import.meta.dirname, ".."), mode: "script" });
+
+try {
+  const { models, config } = handle.ctx;
+
+  const greetings = await models!.get("Greeting").find().select("name times_used -_id").lean();
+
+  console.log(`${config.app?.name} — ${greetings.length} greeting(s)\n`);
+  console.table(greetings);
+} finally {
+  await handle.shutdown();
+}

package/templates/app/scripts/deploy-nginx.ts

@@ -0,0 +1,143 @@
+/**
+ * Install this app's nginx site config.
+ *
+ *   sudo -E APP_ENV=production pnpm script scripts/deploy-nginx.ts
+ *   APP_ENV=production pnpm script scripts/deploy-nginx.ts --dry-run
+ *
+ * APP_ENV picks everything at once — which template is rendered, and the
+ * domain and port rendered into it — so the three can never disagree.
+ *
+ * It boots in script mode like every other script, which means the database
+ * and redis must be reachable from wherever you run it. That is the price
+ * of every script looking the same; run --dry-run from anywhere to preview.
+ *
+ * Debian/Ubuntu only: it writes sites-available and links sites-enabled.
+ * Certificates are yours to install — the rendered conf is HTTP-only, with
+ * a commented TLS block to uncomment once they exist.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, readFileSync, readlinkSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { boot } from "@tulipes/core/boot";
+
+const SITES_AVAILABLE = "/etc/nginx/sites-available";
+const SITES_ENABLED = "/etc/nginx/sites-enabled";
+
+const flags = new Set(process.argv.slice(2));
+const dryRun = flags.has("--dry-run");
+const force = flags.has("--force");
+
+const rootDir = join(import.meta.dirname, "..");
+const handle = await boot({ rootDir, mode: "script" });
+
+try {
+  await deploy();
+} finally {
+  // Without this the open mongo and redis handles keep the process alive
+  // and the script appears to hang after doing its work.
+  await handle.shutdown();
+}
+
+async function deploy(): Promise<void> {
+  const { appEnv } = handle.env;
+  const domain = String(handle.ctx.config.core?.publicDomain ?? "localhost").trim();
+  const port = Number(handle.env.get("PORT"));
+
+  const templatePath = join(rootDir, "nginx", `${appEnv}.conf`);
+  if (!existsSync(templatePath)) {
+    return fail(`no template for APP_ENV=${appEnv} — expected nginx/${appEnv}.conf`);
+  }
+
+  const conf = readFileSync(templatePath, "utf8")
+    .replaceAll("{{DOMAIN}}", domain)
+    .replaceAll("{{PORT}}", String(port));
+
+  // Preview stays available everywhere, including a laptop with no nginx
+  // and a domain still set to localhost.
+  if (dryRun) {
+    console.log(`# ${templatePath} → ${SITES_AVAILABLE}/${domain}\n`);
+    console.log(conf);
+    return;
+  }
+
+  if (domain === "localhost" || domain === "") {
+    return fail(
+      `core.publicDomain is "${domain}" — set a real hostname through the console (PATCH /config/core) before deploying`,
+    );
+  }
+
+  // getuid is absent on Windows; its absence is itself a "not supported here".
+  if (process.getuid?.() !== 0) {
+    return fail("must run as root to write /etc/nginx — re-run with sudo -E");
+  }
+
+  if (!existsSync(SITES_AVAILABLE)) {
+    return fail(
+      `${SITES_AVAILABLE} does not exist — this script targets the Debian/Ubuntu nginx layout`,
+    );
+  }
+
+  const availablePath = join(SITES_AVAILABLE, domain);
+  if (existsSync(availablePath) && !force) {
+    return fail(
+      `${availablePath} already exists — re-run with --force to overwrite it (it may have been hand-tuned on this box)`,
+    );
+  }
+
+  writeFileSync(availablePath, conf);
+  console.log(`wrote ${availablePath}`);
+
+  const enabledPath = join(SITES_ENABLED, domain);
+  if (!linkSite(availablePath, enabledPath)) return;
+
+  if (!run("nginx", ["-t"], "nginx rejected the configuration — nothing was reloaded")) {
+    return;
+  }
+  if (!run("systemctl", ["reload", "nginx"], "nginx reload failed")) return;
+
+  console.log(`\n${domain} → 127.0.0.1:${port} (${appEnv}) — nginx reloaded`);
+}
+
+/** Idempotent: a link already pointing at the right file is the goal state. */
+function linkSite(target: string, link: string): boolean {
+  if (existsSync(link) || isSymlink(link)) {
+    const current = isSymlink(link) ? readlinkSync(link) : "(a regular file)";
+    if (current === target) {
+      console.log(`link ${link} already correct`);
+      return true;
+    }
+    fail(`${link} exists and points at ${current} — remove it and re-run`);
+    return false;
+  }
+
+  symlinkSync(target, link);
+  console.log(`linked ${link}`);
+  return true;
+}
+
+function isSymlink(path: string): boolean {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+function run(command: string, args: string[], message: string): boolean {
+  try {
+    execFileSync(command, args, { stdio: "inherit" });
+    return true;
+  } catch (error) {
+    // A missing binary is not a rejected config: reporting the latter would
+    // send you hunting a syntax error that does not exist.
+    const missing = (error as NodeJS.ErrnoException).code === "ENOENT";
+    fail(missing ? `could not run "${command}" — is it installed and on PATH?` : message);
+    return false;
+  }
+}
+
+function fail(message: string): void {
+  console.error(`deploy-nginx: ${message}`);
+  process.exitCode = 1;
+}

package/templates/app/scripts/list-users.ts

@@ -0,0 +1,34 @@
+/**
+ * Example maintenance script. Run it with:
+ *
+ *   pnpm script scripts/list-users.ts
+ *
+ * Script mode runs every phase the backend runs — environment, modules,
+ * config, ACL, database, models, queue producers — and then starts nothing.
+ * So a script gets exactly what a route handler gets, minus the server.
+ *
+ * The one thing to always copy from this file is the try/finally: the mongo
+ * and redis connections hold the event loop open, so a script that skips
+ * shutdown() prints its output and then hangs forever.
+ */
+import { join } from "node:path";
+
+import { boot } from "@tulipes/core/boot";
+
+const handle = await boot({ rootDir: join(import.meta.dirname, ".."), mode: "script" });
+
+try {
+  const { models, config } = handle.ctx;
+
+  const users = await models!
+    .get("User")
+    .find()
+    .select("email role -_id")
+    .limit(Number(config.pagination?.maxLimit ?? 100))
+    .lean();
+
+  console.log(`${config.app?.name} — ${users.length} user(s)\n`);
+  console.table(users);
+} finally {
+  await handle.shutdown();
+}

package/templates/app/tests/app.test.ts

@@ -0,0 +1,28 @@
+import { fileURLToPath } from "node:url";
+import { afterAll, beforeAll, expect, test } from "vitest";
+import { boot } from "@tulipes/core/boot";
+import { extract, toOpenApi, toPostman } from "@tulipes/spec";
+import { useTestApp } from "@tulipes/testing";
+
+import { testEnv, testSettings } from "./support.ts";
+
+/**
+ * App-level: what belongs to no module. Each module's tests live beside
+ * it, in modules/<name>/tests/, and boot the app the same way.
+ */
+const rootDir = fileURLToPath(new URL("../", import.meta.url));
+const app = useTestApp({ rootDir, env: testEnv(), settings: testSettings() }, { beforeAll, afterAll });
+
+test("an inspection boot describes the same routes and schemas as the running app", async () => {
+  const inspection = await boot({ rootDir, mode: "backend", inspect: true, handleSignals: false });
+
+  try {
+    const inspected = { ...extract(inspection.ctx), app: { name: "parity" } };
+    const runtime = { ...extract(app.handle.ctx), app: { name: "parity" } };
+
+    expect(await toOpenApi(inspected)).toEqual(await toOpenApi(runtime));
+    expect(await toPostman(inspected)).toEqual(await toPostman(runtime));
+  } finally {
+    await inspection.shutdown();
+  }
+});

package/templates/app/tests/support.ts

@@ -0,0 +1,36 @@
+import { randomBytes } from "node:crypto";
+
+/**
+ * What every module test boots the app with. The services are dedicated:
+ * the suite writes users, sessions and settings. The variables are the
+ * eleven the app declares; everything else the request pipeline needs is a
+ * setting, written after the boot the way an operator writes it.
+ */
+export function testEnv(): Record<string, string> {
+  if (!process.env.TEST_MONGO_URI || !process.env.TEST_REDIS_URL) {
+    throw new Error("Tests require dedicated TEST_MONGO_URI and TEST_REDIS_URL services");
+  }
+  return {
+    MONGO_URI: process.env.TEST_MONGO_URI,
+    REDIS_URL: process.env.TEST_REDIS_URL,
+    JWT_ACCESS_SECRET: randomBytes(32).toString("hex"),
+    JWT_REFRESH_SECRET: randomBytes(32).toString("hex"),
+    AUTH_ADMIN_EMAIL: "test-admin@example.test",
+    AUTH_ADMIN_PASSWORD: randomBytes(32).toString("hex"),
+    LOG_LEVEL: "fatal",
+    LOG_FILE: "false",
+    LOG_CONSOLE: "false",
+  };
+}
+
+export function testSettings(): Record<string, Record<string, unknown>> {
+  return {
+    security: {
+      trustProxyCidrs: "127.0.0.1/32,::1/128",
+      corsOrigins: "https://console.example.test",
+      corsCredentials: false,
+      rateLimits: { namespace: "test-" + randomBytes(12).toString("hex"), windowMs: 60_000, auth: 200, session: 1000, config: 200 },
+    },
+    hello: { greeting: "Hello" },
+  };
+}

package/templates/app/tsconfig.json

@@ -0,0 +1,28 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": [
+      "ES2023"
+    ],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "allowImportingTsExtensions": true,
+    "rewriteRelativeImportExtensions": true,
+    "erasableSyntaxOnly": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true
+  },
+  "include": [
+    "app.ts",
+    "worker.ts",
+    "types",
+    "modules",
+    "config",
+    "scripts",
+    "tests"
+  ]
+}

package/templates/app/vitest.config.ts

@@ -0,0 +1,6 @@
+import { defineConfig } from "vitest/config";
+
+// Node strips types natively, so the app's own files import without a loader.
+// Every file boots the app once (@tulipes/testing) against one database, so
+// files run one after another.
+export default defineConfig({ test: { include: ["tests/**/*.test.ts", "modules/*/tests/**/*.test.ts"], fileParallelism: false } });

package/templates/app/worker.ts

@@ -0,0 +1,6 @@
+import { boot } from "@tulipes/core/boot";
+
+// Worker mode refuses to start until at least one module registers a
+// queue processor — a consumer with nothing to consume is a
+// misconfigured deployment, not a valid idle state.
+await boot({ rootDir: import.meta.dirname, mode: "worker" });