@tulipes/core 0.1.1 → 0.1.3

package/README.md

@@ -247,6 +247,7 @@ router.get("/users/:id", async (req) => {
 ## The CLI
 
 ```
+tulipes init [dir]           scaffold a new application — boots with zero infrastructure
 tulipes sync                 regenerate types/config.d.ts and .env.example
 tulipes env:check            validate env against every meta contract — CI gate, exit 1 on failure
 tulipes new module <name>    scaffold a module (scope auto-detected from siblings)

package/dist/boot/app-files.js

@@ -1,11 +1,14 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { BootReport } from "../errors/boot-error.js";
-import { detectSourceExtension } from "../modules/explorer.js";
 import { importFile } from "./import-file.js";
 export async function loadAppConfigSeed(rootDir, ctx, report) {
-    const file = join(rootDir, "config", `app.config${detectSourceExtension()}`);
-    if (!existsSync(file))
+    // Whichever extension exists wins (.ts first) — the app decides its own
+    // world; core's compilation state must never influence discovery.
+    const file = [".ts", ".js"]
+        .map((ext) => join(rootDir, "config", `app.config${ext}`))
+        .find((candidate) => existsSync(candidate));
+    if (!file)
         return;
     const exported = await importFile(file, "config", "app", report);
     if (!exported)

package/dist/boot/app-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-files.js","sourceRoot":"","sources":["../../src/boot/app-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAqB9C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,GAAQ,EACR,MAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAE9B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAwB,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAO,QAAQ,CAAC,OAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,qBAAsB,KAAe,CAAC,OAAO,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"app-files.js","sourceRoot":"","sources":["../../src/boot/app-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAqB9C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,GAAQ,EACR,MAAkB;IAElB,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;SACxB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;SACzD,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAwB,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAO,QAAQ,CAAC,OAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,qBAAsB,KAAe,CAAC,OAAO,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/cli/init.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `tulipes init [dir]` — scaffold a complete application that boots with
+ * ZERO infrastructure: the generated core module declares no MONGO_URI or
+ * REDIS_URL, and with no models and no queue files the pipeline skips both
+ * engines legitimately. `yarn install && yarn dev` must always succeed on a
+ * bare machine; databases arrive later as one meta.variables.json entry.
+ *
+ * Three modules ship: core (sys 0 — env contract, roles, request ids),
+ * security (sys 10 — headers, pino logging, body parsing) and hello (the
+ * app-tier proof route). Templates live inline, like `new module`.
+ */
+export declare function runInit(rootDir: string, target?: string): Promise<void>;

package/dist/cli/init.js

@@ -0,0 +1,529 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * `tulipes init [dir]` — scaffold a complete application that boots with
+ * ZERO infrastructure: the generated core module declares no MONGO_URI or
+ * REDIS_URL, and with no models and no queue files the pipeline skips both
+ * engines legitimately. `yarn install && yarn dev` must always succeed on a
+ * bare machine; databases arrive later as one meta.variables.json entry.
+ *
+ * Three modules ship: core (sys 0 — env contract, roles, request ids),
+ * security (sys 10 — headers, pino logging, body parsing) and hello (the
+ * app-tier proof route). Templates live inline, like `new module`.
+ */
+export async function runInit(rootDir, target) {
+    const dir = resolve(rootDir, target ?? ".");
+    const name = sanitizeName(basename(dir));
+    if (existsSync(dir) && readdirSync(dir).some((entry) => entry !== ".git")) {
+        console.error(`refusing to init: ${dir} is not empty`);
+        process.exitCode = 1;
+        return;
+    }
+    const coreVersion = ownVersion();
+    const files = renderProject(name, coreVersion);
+    for (const [relPath, content] of files) {
+        const filePath = join(dir, relPath);
+        mkdirSync(dirname(filePath), { recursive: true });
+        writeFileSync(filePath, content);
+        console.log(`  create ${relPath}`);
+    }
+    console.log([
+        "",
+        `Project "${name}" is ready. Next:`,
+        "",
+        target && target !== "." ? `  cd ${target}` : undefined,
+        "  corepack enable   # once per machine — activates the pinned yarn 4",
+        "  yarn install",
+        "  yarn dev",
+        "",
+        "  → http://localhost:3000/hello",
+        "",
+        "No database or redis needed to boot — add MONGO_URI / REDIS_URL to",
+        "modules/core/meta.variables.json when your first model or queue lands.",
+    ].filter((line) => line !== undefined).join("\n"));
+}
+/**
+ * The version of the core running this CLI. Resolved relative to this file
+ * (src/cli or dist/cli — both sit two levels below the package root) since
+ * the exports map deliberately doesn't expose package.json.
+ */
+function ownVersion() {
+    const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    return pkg.version;
+}
+function sanitizeName(raw) {
+    const name = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+    return name || "tulipes-app";
+}
+const json = (value) => JSON.stringify(value, null, 2) + "\n";
+function renderProject(name, coreVersion) {
+    const core = `^${coreVersion}`;
+    return [
+        ["package.json", json({
+                name,
+                private: true,
+                type: "module",
+                // Pins yarn 4 through corepack; without it a global classic yarn
+                // would handle the workspaces and produce a v1 lockfile.
+                packageManager: "yarn@4.18.0",
+                workspaces: ["modules/*"],
+                scripts: {
+                    dev: "tulipes dev",
+                    worker: "tsx worker.ts",
+                    sync: "tulipes sync",
+                    check: "tulipes env:check",
+                    typecheck: "tsc --noEmit",
+                },
+                dependencies: {
+                    "@tulipes/core": core,
+                    express: "^5",
+                },
+                devDependencies: {
+                    "@types/express": "^5",
+                    "@types/node": "^24",
+                    tsx: "^4",
+                    typescript: "^7",
+                },
+            })],
+        ["tsconfig.json", json({
+                compilerOptions: {
+                    target: "ES2023",
+                    lib: ["ES2023"],
+                    module: "NodeNext",
+                    moduleResolution: "NodeNext",
+                    strict: true,
+                    noUncheckedIndexedAccess: true,
+                    verbatimModuleSyntax: true,
+                    skipLibCheck: true,
+                    forceConsistentCasingInFileNames: true,
+                    noEmit: true,
+                },
+                include: ["app.ts", "worker.ts", "types", "modules", "config"],
+            })],
+        [".yarnrc.yml", [
+                `nodeLinker: node-modules`,
+                ``,
+                `# tsx (esbuild) and bullmq's native helpers need their install scripts;`,
+                `# stated explicitly so a restrictive global yarn config can't break dev.`,
+                `enableScripts: true`,
+                ``,
+                `# Yarn's release-age gate quarantines freshly published packages, which`,
+                `# would block brand-new @tulipes releases from installing. Preapprove the`,
+                `# framework scope only — the gate stays active for everything else.`,
+                `npmPreapprovedPackages:`,
+                `  - "@tulipes/*"`,
+                ``,
+            ].join("\n")],
+        [".gitignore", [
+                "node_modules/",
+                "dist/",
+                "*.log",
+                "",
+                "# local env overrides — the committed .envs/.env.<mode> files hold",
+                "# dev defaults; real secrets ride the container environment",
+                ".env.local",
+                ".envs/.env.*.local",
+                "",
+            ].join("\n")],
+        ["app.ts", [
+                `import { boot } from "@tulipes/core/boot";`,
+                ``,
+                `await boot({ rootDir: import.meta.dirname, mode: "web" });`,
+                ``,
+            ].join("\n")],
+        ["worker.ts", [
+                `import { boot } from "@tulipes/core/boot";`,
+                ``,
+                `// Worker mode refuses to start until at least one module registers a`,
+                `// queue processor — a consumer with nothing to consume is a`,
+                `// misconfigured deployment, not a valid idle state.`,
+                `await boot({ rootDir: import.meta.dirname, mode: "worker" });`,
+                ``,
+            ].join("\n")],
+        ["config/app.config.ts", [
+                `import type { AppConfigFn } from "@tulipes/core/boot";`,
+                ``,
+                `/**`,
+                ` * ── The app-wide config seed ──────────────────────────────────────────`,
+                ` *`,
+                ` * Runs FIRST in boot phase 6, before any module.config.ts factory, and`,
+                ` * whatever it returns becomes the base of the global config. Every`,
+                ` * module then reads it through \`ctx.config.<key>\`:`,
+                ` *`,
+                ` *   export default function usersRoutes({ config }: Ctx) {`,
+                ` *     const router = Router();`,
+                ` *     router.get(\`\${config.api!.prefix}/users\`, handler);`,
+                ` *   }`,
+                ` *`,
+                ` * The framework itself reads exactly ONE field: \`app.name\`, for the`,
+                ` * startup banner. Everything else below is convention — YOUR keys, read`,
+                ` * by YOUR modules. Rename them, delete them, invent new ones freely;`,
+                ` * nothing in core depends on them.`,
+                ` *`,
+                ` * Config that belongs to one feature does NOT go here — it goes in that`,
+                ` * module's \`module.config.ts\`, where codegen types it automatically.`,
+                ` * This file is for values two or more modules share.`,
+                ` *`,
+                ` * Values can be hardcoded (below) or driven by the environment. To make`,
+                ` * any of them env-driven, declare the variable in a module's`,
+                ` * meta.variables.json first, then read it here with`,
+                ` * \`Environment.get("NAME")\` — reads of undeclared variables throw on`,
+                ` * purpose, so a typo can never boot.`,
+                ` */`,
+                `// \`satisfies\` (not a type annotation) so TypeScript keeps the exact`,
+                `// shape of this object for the augmentation at the bottom of the file.`,
+                `const appConfig = ((Environment) => ({`,
+                `  /**`,
+                `   * Identity. \`name\` is the one field core consumes — it titles the`,
+                `   * startup banner ("▲ ${name}"). The rest is yours: stamp \`version\``,
+                `   * into a /health payload, switch behaviour on \`env\`, etc.`,
+                `   */`,
+                `  app: {`,
+                `    name: ${JSON.stringify(name)},`,
+                `    version: "0.1.0",`,
+                `    description: "A Tulipes API",`,
+                `    // development | staging | production | test — resolved from APP_ENV`,
+                `    env: Environment.appEnv,`,
+                `    // Read a declared variable (PORT lives in modules/core/meta.variables.json)`,
+                `    port: Environment.get("PORT"),`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Route prefixing. Modules build their paths from this instead of`,
+                `   * hardcoding "/api/v1", so versioning the whole API is a one-line`,
+                `   * change here: \`router.get(\\\`\${config.api!.prefix}/users\\\`, …)\`.`,
+                `   */`,
+                `  api: {`,
+                `    prefix: "/api/v1",`,
+                `    // Where the docs/collection live, if you expose them`,
+                `    docsPath: "/api/docs",`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * HTTP behaviour consumed by the sys security module`,
+                `   * (modules/security/routes/security.routes.ts). Change the body limit`,
+                `   * or CORS origins here rather than editing that file.`,
+                `   */`,
+                `  http: {`,
+                `    // Passed to express.json({ limit }) — a parser without a cap is a`,
+                `    // memory-exhaustion invitation.`,
+                `    bodyLimit: "1mb",`,
+                `    // Browser origins allowed to call this API. Add a cors() middleware`,
+                `    // in the security module and feed it this list.`,
+                `    corsOrigins: ["http://localhost:5173"],`,
+                `    // Set true behind nginx/a load balancer so req.ip is the real client`,
+                `    // (app.set("trust proxy", config.http!.trustProxy)).`,
+                `    trustProxy: false,`,
+                `    // Seconds a request may run before you abort it, if you add a timeout`,
+                `    // middleware.`,
+                `    requestTimeout: 30,`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * List-endpoint defaults, so every module paginates identically and`,
+                `   * no caller can ask for 10 000 rows at once.`,
+                `   */`,
+                `  pagination: {`,
+                `    defaultLimit: 20,`,
+                `    maxLimit: 100,`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Cross-cutting security knobs. Secrets themselves never live here —`,
+                `   * declare them as \`"type": "secret"\` variables in meta.variables.json`,
+                `   * (redacted in logs and the banner) and read them where needed.`,
+                `   */`,
+                `  security: {`,
+                `    // Token lifetimes for an auth module, in seconds`,
+                `    accessTokenTtl: 900,        // 15 minutes`,
+                `    refreshTokenTtl: 2_592_000, // 30 days`,
+                `    // bcrypt/argon cost factor`,
+                `    passwordRounds: 12,`,
+                `    // Rate limiting, if you mount a limiter in the security module`,
+                `    rateLimit: { windowSeconds: 60, max: 100 },`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Public-facing URLs. Anything that builds a link a human will click —`,
+                `   * password-reset emails, webhook callbacks, OAuth redirects — reads`,
+                `   * these instead of guessing the host from a request.`,
+                `   */`,
+                `  urls: {`,
+                `    api: \`http://localhost:\${Environment.get("PORT")}\`,`,
+                `    frontend: "http://localhost:5173",`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Upload constraints shared by every module that accepts files.`,
+                `   */`,
+                `  uploads: {`,
+                `    maxSizeMb: 10,`,
+                `    allowedMimeTypes: ["image/png", "image/jpeg", "application/pdf"],`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Feature flags. Cheap way to ship dark code: a module checks`,
+                `   * \`config.features!.signup\` before mounting a route. Flip per`,
+                `   * environment by reading a declared boolean variable instead of a`,
+                `   * literal.`,
+                `   */`,
+                `  features: {`,
+                `    signup: true,`,
+                `    maintenanceMode: false,`,
+                `  },`,
+                ``,
+                `  /**`,
+                `   * Localization defaults for modules that render text (emails, errors).`,
+                `   */`,
+                `  i18n: {`,
+                `    defaultLocale: "en",`,
+                `    supportedLocales: ["en", "fr"],`,
+                `  },`,
+                `})) satisfies AppConfigFn;`,
+                ``,
+                `export default appConfig;`,
+                ``,
+                `/**`,
+                ` * Types the keys above at every call site: \`ctx.config.api?.prefix\` is a`,
+                ` * string, not \`unknown\`. \`tulipes sync\` does this automatically for`,
+                ` * module.config.ts factories; the app-level seed types itself here.`,
+                ` * Optional (Partial) because the config object is empty until this`,
+                ` * factory has run.`,
+                ` */`,
+                `declare module "@tulipes/core/config" {`,
+                `  interface GlobalConfig extends Partial<ReturnType<typeof appConfig>> {}`,
+                `}`,
+                ``,
+            ].join("\n")],
+        [".envs/.env.development", [
+                `# Development mode — committed on purpose; values here are dev defaults.`,
+                `# Real deployments inject variables through the container environment,`,
+                `# which always wins over this file.`,
+                ``,
+                `PORT=3000`,
+                `LOG_LEVEL=debug`,
+                ``,
+            ].join("\n")],
+        // ── modules/core — sys tier, priority 0: the very first router ─────────
+        ["modules/core/package.json", json({
+                name: `@app/core`,
+                version: "0.0.0",
+                private: true,
+                type: "module",
+                tulipes: { tier: "sys", priority: 0 },
+                dependencies: { "@tulipes/core": core },
+            })],
+        ["modules/core/meta.variables.json", json({
+                variables: [
+                    {
+                        name: "PORT",
+                        type: "number",
+                        group: "http",
+                        description: "HTTP port the web process listens on",
+                        default: 3000,
+                    },
+                ],
+            })],
+        ["modules/core/module.acl.ts", [
+                `import type { AclBuilder } from "@tulipes/core/acl";`,
+                ``,
+                `/**`,
+                ` * The sys core module owns the global role vocabulary. Business modules`,
+                ` * never define roles — they attach grants to these.`,
+                ` */`,
+                `export default function coreAcl(acl: AclBuilder): void {`,
+                `  acl.defineRole("admin").defineRole("user");`,
+                ``,
+                `  // admin can do everything, per resource-namespace wildcard rules.`,
+                `  acl.allow("admin", "*");`,
+                `}`,
+                ``,
+            ].join("\n")],
+        ["modules/core/routes/core.routes.ts", [
+                `import { randomUUID } from "node:crypto";`,
+                `import type { Ctx } from "@tulipes/core/boot";`,
+                ``,
+                `/**`,
+                ` * Global middleware lives HERE: the core module is tier "sys",`,
+                ` * priority 0 — the first router of the whole pipeline — so mounting on`,
+                ` * ctx.app puts this ahead of everything, security's stack included.`,
+                ` */`,
+                `export default function coreRoutes({ app }: Ctx): void {`,
+                `  app!.use((_req, res, next) => {`,
+                `    res.setHeader("X-Request-Id", randomUUID());`,
+                `    next();`,
+                `  });`,
+                `}`,
+                ``,
+            ].join("\n")],
+        // ── modules/security — sys tier, priority 10: the hardening stack ──────
+        ["modules/security/package.json", json({
+                name: `@app/security`,
+                version: "0.0.0",
+                private: true,
+                type: "module",
+                tulipes: { tier: "sys", priority: 10 },
+                dependencies: {
+                    "@tulipes/core": core,
+                    express: "^5",
+                    pino: "^9",
+                    "pino-http": "^10",
+                    "pino-pretty": "^13",
+                },
+            })],
+        ["modules/security/meta.variables.json", json({
+                variables: [
+                    {
+                        name: "LOG_LEVEL",
+                        type: "enum",
+                        enum: ["fatal", "error", "warn", "info", "debug", "trace"],
+                        group: "logging",
+                        description: "Minimum pino log level",
+                        default: "info",
+                    },
+                ],
+            })],
+        ["modules/security/helpers/security-headers.ts", [
+                `import type { RequestHandler } from "express";`,
+                ``,
+                `/**`,
+                ` * Baseline hardening applied to every response before anything else`,
+                ` * runs. Dependency-free — swap in the full helmet suite here if this`,
+                ` * app ever needs it.`,
+                ` */`,
+                `export function securityHeaders(): RequestHandler {`,
+                `  return (_req, res, next) => {`,
+                `    res.setHeader("X-Content-Type-Options", "nosniff");`,
+                `    res.setHeader("X-Frame-Options", "DENY");`,
+                `    res.setHeader("Referrer-Policy", "no-referrer");`,
+                `    // An API serves no active content; a restrictive CSP costs nothing`,
+                `    // and defuses any HTML-ish response a bug might produce.`,
+                `    res.setHeader("Content-Security-Policy", "default-src 'none'");`,
+                `    next();`,
+                `  };`,
+                `}`,
+                ``,
+            ].join("\n")],
+        ["modules/security/helpers/logger.ts", [
+                `import { pino, type Logger } from "pino";`,
+                `import type { Environment } from "@tulipes/core/env";`,
+                ``,
+                `let instance: Logger | undefined;`,
+                ``,
+                `/**`,
+                ` * The app's pino logger — JSON lines in production, pretty-printed in`,
+                ` * development. Level comes from LOG_LEVEL so a deploy can turn on`,
+                ` * debug without a code change.`,
+                ` */`,
+                `export function logger(environment: Environment): Logger {`,
+                `  if (instance) return instance;`,
+                ``,
+                `  instance = pino({`,
+                `    level: String(environment.get("LOG_LEVEL")),`,
+                `    ...(environment.appEnv === "development" && {`,
+                `      transport: {`,
+                `        target: "pino-pretty",`,
+                `        options: { translateTime: "HH:MM:ss", ignore: "pid,hostname" },`,
+                `      },`,
+                `    }),`,
+                `  });`,
+                `  return instance;`,
+                `}`,
+                ``,
+            ].join("\n")],
+        ["modules/security/routes/security.routes.ts", [
+                `import express from "express";`,
+                `import { pinoHttp } from "pino-http";`,
+                `import type { Ctx } from "@tulipes/core/boot";`,
+                ``,
+                `import { securityHeaders } from "../helpers/security-headers.js";`,
+                `import { logger } from "../helpers/logger.js";`,
+                ``,
+                `/**`,
+                ` * The app's request-hardening stack. Sys tier, so this mounts ahead of`,
+                ` * every app-tier router — the framework core mounts no middleware of`,
+                ` * its own; this module IS the pipeline's head.`,
+                ` */`,
+                `export default function securityRoutes({ app, Environment }: Ctx): void {`,
+                `  app!.use(securityHeaders());`,
+                ``,
+                `  app!.use(`,
+                `    pinoHttp({`,
+                `      logger: logger(Environment),`,
+                `      // The core module (priority 0) stamps X-Request-Id first — reuse`,
+                `      // it so log lines and response headers tell one story.`,
+                `      genReqId: (_req, res) => String(res.getHeader("X-Request-Id") ?? ""),`,
+                `      serializers: {`,
+                `        req: (req: { method: string; url: string }) => ({`,
+                `          method: req.method,`,
+                `          url: req.url,`,
+                `        }),`,
+                `        res: (res: { statusCode: number }) => ({ status: res.statusCode }),`,
+                `      },`,
+                `    }),`,
+                `  );`,
+                ``,
+                `  // Body-size cap is a security control too — a parser without a limit`,
+                `  // is a memory-exhaustion invitation.`,
+                `  app!.use(express.json({ limit: "1mb" }));`,
+                `}`,
+                ``,
+            ].join("\n")],
+        // ── modules/hello — app tier: the proof route ──────────────────────────
+        ["modules/hello/package.json", json({
+                name: `@app/hello`,
+                version: "0.0.0",
+                private: true,
+                type: "module",
+                tulipes: { tier: "app", priority: 100, dependsOn: [] },
+                dependencies: { "@tulipes/core": core, express: "^5" },
+            })],
+        ["modules/hello/routes/hello.routes.ts", [
+                `import { Router } from "express";`,
+                `import type { Ctx } from "@tulipes/core/boot";`,
+                ``,
+                `export default function helloRoutes({ config }: Ctx): Router {`,
+                `  const router = Router();`,
+                ``,
+                `  router.get("/hello", (_req, res) => {`,
+                `    res.json({ hello: "world", app: config.app?.name });`,
+                `  });`,
+                ``,
+                `  return router;`,
+                `}`,
+                ``,
+            ].join("\n")],
+        ["README.md", [
+                `# ${name}`,
+                ``,
+                `A [Tulipes](https://www.npmjs.com/package/@tulipes/core) application.`,
+                ``,
+                `## Run`,
+                ``,
+                "```sh",
+                `corepack enable   # once per machine — activates the pinned yarn 4`,
+                `yarn install`,
+                `yarn dev          # boot the web process → http://localhost:3000/hello`,
+                "```",
+                ``,
+                `Boots with no database and no redis: the pipeline skips engines no`,
+                `module asks for. When your first model lands, declare \`MONGO_URI\``,
+                `(type \`url\`, required) in \`modules/core/meta.variables.json\` and set`,
+                `it in \`.envs/.env.development\`; same with \`REDIS_URL\` for queues.`,
+                ``,
+                `## Daily commands`,
+                ``,
+                `| command | does |`,
+                `|---|---|`,
+                `| \`yarn dev\` | regenerate types, run web process under tsx watch |`,
+                `| \`yarn worker\` | run the queue-consumer process (needs a queue first) |`,
+                `| \`yarn sync\` | regenerate \`types/config.d.ts\` + \`.env.example\` |`,
+                `| \`yarn check\` | validate env against every module contract — CI gate |`,
+                `| \`yarn tulipes new module <name>\` | scaffold a module |`,
+                ``,
+            ].join("\n")],
+    ];
+}
+//# sourceMappingURL=init.js.map

package/dist/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,MAAe;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,eAAe,CAAC,CAAC;QACvD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE/C,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC;QACV,EAAE;QACF,YAAY,IAAI,mBAAmB;QACnC,EAAE;QACF,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvD,sEAAsE;QACtE,gBAAgB;QAChB,YAAY;QACZ,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,oEAAoE;QACpE,wEAAwE;KACzE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;IAC7E,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,IAAI,aAAa,CAAC;AAC/B,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAE/E,SAAS,aAAa,CAAC,IAAY,EAAE,WAAmB;IACtD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAE/B,OAAO;QACL,CAAC,cAAc,EAAE,IAAI,CAAC;gBACpB,IAAI;gBACJ,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,iEAAiE;gBACjE,yDAAyD;gBACzD,cAAc,EAAE,aAAa;gBAC7B,UAAU,EAAE,CAAC,WAAW,CAAC;gBACzB,OAAO,EAAE;oBACP,GAAG,EAAE,aAAa;oBAClB,MAAM,EAAE,eAAe;oBACvB,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,mBAAmB;oBAC1B,SAAS,EAAE,cAAc;iBAC1B;gBACD,YAAY,EAAE;oBACZ,eAAe,EAAE,IAAI;oBACrB,OAAO,EAAE,IAAI;iBACd;gBACD,eAAe,EAAE;oBACf,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,KAAK;oBACpB,GAAG,EAAE,IAAI;oBACT,UAAU,EAAE,IAAI;iBACjB;aACF,CAAC,CAAC;QAEH,CAAC,eAAe,EAAE,IAAI,CAAC;gBACrB,eAAe,EAAE;oBACf,MAAM,EAAE,QAAQ;oBAChB,GAAG,EAAE,CAAC,QAAQ,CAAC;oBACf,MAAM,EAAE,UAAU;oBAClB,gBAAgB,EAAE,UAAU;oBAC5B,MAAM,EAAE,IAAI;oBACZ,wBAAwB,EAAE,IAAI;oBAC9B,oBAAoB,EAAE,IAAI;oBAC1B,YAAY,EAAE,IAAI;oBAClB,gCAAgC,EAAE,IAAI;oBACtC,MAAM,EAAE,IAAI;iBACb;gBACD,OAAO,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;aAC/D,CAAC,CAAC;QAEH,CAAC,aAAa,EAAE;gBACd,0BAA0B;gBAC1B,EAAE;gBACF,yEAAyE;gBACzE,0EAA0E;gBAC1E,qBAAqB;gBACrB,EAAE;gBACF,yEAAyE;gBACzE,2EAA2E;gBAC3E,qEAAqE;gBACrE,yBAAyB;gBACzB,kBAAkB;gBAClB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,YAAY,EAAE;gBACb,eAAe;gBACf,OAAO;gBACP,OAAO;gBACP,EAAE;gBACF,oEAAoE;gBACpE,6DAA6D;gBAC7D,YAAY;gBACZ,oBAAoB;gBACpB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,QAAQ,EAAE;gBACT,4CAA4C;gBAC5C,EAAE;gBACF,4DAA4D;gBAC5D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,WAAW,EAAE;gBACZ,4CAA4C;gBAC5C,EAAE;gBACF,uEAAuE;gBACvE,8DAA8D;gBAC9D,sDAAsD;gBACtD,+DAA+D;gBAC/D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,sBAAsB,EAAE;gBACvB,wDAAwD;gBACxD,EAAE;gBACF,KAAK;gBACL,2EAA2E;gBAC3E,IAAI;gBACJ,yEAAyE;gBACzE,qEAAqE;gBACrE,uDAAuD;gBACvD,IAAI;gBACJ,6DAA6D;gBAC7D,iCAAiC;gBACjC,+DAA+D;gBAC/D,QAAQ;gBACR,IAAI;gBACJ,wEAAwE;gBACxE,0EAA0E;gBAC1E,uEAAuE;gBACvE,qCAAqC;gBACrC,IAAI;gBACJ,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,IAAI;gBACJ,0EAA0E;gBAC1E,+DAA+D;gBAC/D,sDAAsD;gBACtD,yEAAyE;gBACzE,uCAAuC;gBACvC,KAAK;gBACL,wEAAwE;gBACxE,yEAAyE;gBACzE,wCAAwC;gBACxC,OAAO;gBACP,wEAAwE;gBACxE,2BAA2B,IAAI,0CAA0C;gBACzE,gEAAgE;gBAChE,OAAO;gBACP,UAAU;gBACV,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;gBACpC,uBAAuB;gBACvB,mCAAmC;gBACnC,0EAA0E;gBAC1E,8BAA8B;gBAC9B,kFAAkF;gBAClF,oCAAoC;gBACpC,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,sEAAsE;gBACtE,sEAAsE;gBACtE,4EAA4E;gBAC5E,OAAO;gBACP,UAAU;gBACV,wBAAwB;gBACxB,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,yDAAyD;gBACzD,0EAA0E;gBAC1E,0DAA0D;gBAC1D,OAAO;gBACP,WAAW;gBACX,wEAAwE;gBACxE,sCAAsC;gBACtC,uBAAuB;gBACvB,0EAA0E;gBAC1E,sDAAsD;gBACtD,6CAA6C;gBAC7C,2EAA2E;gBAC3E,2DAA2D;gBAC3D,wBAAwB;gBACxB,4EAA4E;gBAC5E,oBAAoB;gBACpB,yBAAyB;gBACzB,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,wEAAwE;gBACxE,iDAAiD;gBACjD,OAAO;gBACP,iBAAiB;gBACjB,uBAAuB;gBACvB,oBAAoB;gBACpB,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,yEAAyE;gBACzE,4EAA4E;gBAC5E,oEAAoE;gBACpE,OAAO;gBACP,eAAe;gBACf,uDAAuD;gBACvD,+CAA+C;gBAC/C,4CAA4C;gBAC5C,iCAAiC;gBACjC,yBAAyB;gBACzB,qEAAqE;gBACrE,iDAAiD;gBACjD,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,2EAA2E;gBAC3E,wEAAwE;gBACxE,yDAAyD;gBACzD,OAAO;gBACP,WAAW;gBACX,4DAA4D;gBAC5D,wCAAwC;gBACxC,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,oEAAoE;gBACpE,OAAO;gBACP,cAAc;gBACd,oBAAoB;gBACpB,uEAAuE;gBACvE,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,kEAAkE;gBAClE,oEAAoE;gBACpE,sEAAsE;gBACtE,eAAe;gBACf,OAAO;gBACP,eAAe;gBACf,mBAAmB;gBACnB,6BAA6B;gBAC7B,MAAM;gBACN,EAAE;gBACF,OAAO;gBACP,2EAA2E;gBAC3E,OAAO;gBACP,WAAW;gBACX,0BAA0B;gBAC1B,qCAAqC;gBACrC,MAAM;gBACN,4BAA4B;gBAC5B,EAAE;gBACF,2BAA2B;gBAC3B,EAAE;gBACF,KAAK;gBACL,6EAA6E;gBAC7E,0EAA0E;gBAC1E,sEAAsE;gBACtE,qEAAqE;gBACrE,qBAAqB;gBACrB,KAAK;gBACL,yCAAyC;gBACzC,2EAA2E;gBAC3E,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,wBAAwB,EAAE;gBACzB,0EAA0E;gBAC1E,wEAAwE;gBACxE,qCAAqC;gBACrC,EAAE;gBACF,WAAW;gBACX,iBAAiB;gBACjB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,0EAA0E;QAC1E,CAAC,2BAA2B,EAAE,IAAI,CAAC;gBACjC,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACrC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;aACxC,CAAC,CAAC;QAEH,CAAC,kCAAkC,EAAE,IAAI,CAAC;gBACxC,SAAS,EAAE;oBACT;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE,sCAAsC;wBACnD,OAAO,EAAE,IAAI;qBACd;iBACF;aACF,CAAC,CAAC;QAEH,CAAC,4BAA4B,EAAE;gBAC7B,sDAAsD;gBACtD,EAAE;gBACF,KAAK;gBACL,0EAA0E;gBAC1E,sDAAsD;gBACtD,KAAK;gBACL,0DAA0D;gBAC1D,+CAA+C;gBAC/C,EAAE;gBACF,sEAAsE;gBACtE,4BAA4B;gBAC5B,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,oCAAoC,EAAE;gBACrC,2CAA2C;gBAC3C,gDAAgD;gBAChD,EAAE;gBACF,KAAK;gBACL,iEAAiE;gBACjE,yEAAyE;gBACzE,sEAAsE;gBACtE,KAAK;gBACL,0DAA0D;gBAC1D,mCAAmC;gBACnC,kDAAkD;gBAClD,aAAa;gBACb,OAAO;gBACP,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,0EAA0E;QAC1E,CAAC,+BAA+B,EAAE,IAAI,CAAC;gBACrC,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACtC,YAAY,EAAE;oBACZ,eAAe,EAAE,IAAI;oBACrB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,KAAK;oBAClB,aAAa,EAAE,KAAK;iBACrB;aACF,CAAC,CAAC;QAEH,CAAC,sCAAsC,EAAE,IAAI,CAAC;gBAC5C,SAAS,EAAE;oBACT;wBACE,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;wBAC1D,KAAK,EAAE,SAAS;wBAChB,WAAW,EAAE,wBAAwB;wBACrC,OAAO,EAAE,MAAM;qBAChB;iBACF;aACF,CAAC,CAAC;QAEH,CAAC,8CAA8C,EAAE;gBAC/C,gDAAgD;gBAChD,EAAE;gBACF,KAAK;gBACL,sEAAsE;gBACtE,uEAAuE;gBACvE,uBAAuB;gBACvB,KAAK;gBACL,qDAAqD;gBACrD,iCAAiC;gBACjC,yDAAyD;gBACzD,+CAA+C;gBAC/C,sDAAsD;gBACtD,yEAAyE;gBACzE,+DAA+D;gBAC/D,qEAAqE;gBACrE,aAAa;gBACb,MAAM;gBACN,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,oCAAoC,EAAE;gBACrC,2CAA2C;gBAC3C,uDAAuD;gBACvD,EAAE;gBACF,mCAAmC;gBACnC,EAAE;gBACF,KAAK;gBACL,wEAAwE;gBACxE,oEAAoE;gBACpE,iCAAiC;gBACjC,KAAK;gBACL,4DAA4D;gBAC5D,kCAAkC;gBAClC,EAAE;gBACF,qBAAqB;gBACrB,kDAAkD;gBAClD,mDAAmD;gBACnD,oBAAoB;gBACpB,gCAAgC;gBAChC,yEAAyE;gBACzE,UAAU;gBACV,SAAS;gBACT,OAAO;gBACP,oBAAoB;gBACpB,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,4CAA4C,EAAE;gBAC7C,gCAAgC;gBAChC,uCAAuC;gBACvC,gDAAgD;gBAChD,EAAE;gBACF,mEAAmE;gBACnE,gDAAgD;gBAChD,EAAE;gBACF,KAAK;gBACL,yEAAyE;gBACzE,uEAAuE;gBACvE,iDAAiD;gBACjD,KAAK;gBACL,2EAA2E;gBAC3E,gCAAgC;gBAChC,EAAE;gBACF,aAAa;gBACb,gBAAgB;gBAChB,oCAAoC;gBACpC,yEAAyE;gBACzE,+DAA+D;gBAC/D,6EAA6E;gBAC7E,sBAAsB;gBACtB,2DAA2D;gBAC3D,+BAA+B;gBAC/B,yBAAyB;gBACzB,aAAa;gBACb,6EAA6E;gBAC7E,UAAU;gBACV,SAAS;gBACT,MAAM;gBACN,EAAE;gBACF,yEAAyE;gBACzE,yCAAyC;gBACzC,6CAA6C;gBAC7C,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,0EAA0E;QAC1E,CAAC,4BAA4B,EAAE,IAAI,CAAC;gBAClC,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;gBACtD,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;aACvD,CAAC,CAAC;QAEH,CAAC,sCAAsC,EAAE;gBACvC,mCAAmC;gBACnC,gDAAgD;gBAChD,EAAE;gBACF,gEAAgE;gBAChE,4BAA4B;gBAC5B,EAAE;gBACF,yCAAyC;gBACzC,0DAA0D;gBAC1D,OAAO;gBACP,EAAE;gBACF,kBAAkB;gBAClB,GAAG;gBACH,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,CAAC,WAAW,EAAE;gBACZ,KAAK,IAAI,EAAE;gBACX,EAAE;gBACF,uEAAuE;gBACvE,EAAE;gBACF,QAAQ;gBACR,EAAE;gBACF,OAAO;gBACP,oEAAoE;gBACpE,cAAc;gBACd,wEAAwE;gBACxE,KAAK;gBACL,EAAE;gBACF,oEAAoE;gBACpE,qEAAqE;gBACrE,0EAA0E;gBAC1E,uEAAuE;gBACvE,EAAE;gBACF,mBAAmB;gBACnB,EAAE;gBACF,oBAAoB;gBACpB,WAAW;gBACX,sEAAsE;gBACtE,4EAA4E;gBAC5E,yEAAyE;gBACzE,2EAA2E;gBAC3E,4DAA4D;gBAC5D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACd,CAAC;AACJ,CAAC"}

package/dist/cli/main.js

@@ -1,3 +1,4 @@
+import { runInit } from "./init.js";
 import { runSync } from "./sync.js";
 import { runEnvCheck } from "./env-check.js";
 import { runNewModule } from "./new-module.js";
@@ -10,6 +11,7 @@ import { runDev } from "./dev.js";
 const HELP = `tulipes — module-based express framework
 
 Usage:
+  tulipes init [dir]           scaffold a new application (boots with zero infrastructure)
   tulipes sync                 regenerate types/config.d.ts and .env.example
   tulipes env:check            validate env against every meta.variables.json (CI-friendly)
   tulipes new module <name>    scaffold a module under ./modules
@@ -19,6 +21,8 @@ export async function main(argv) {
     const [command, ...rest] = argv;
     const rootDir = process.cwd();
     switch (command) {
+        case "init":
+            return runInit(rootDir, rest[0]);
         case "sync":
             return runSync(rootDir);
         case "env:check":

package/dist/cli/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC;;;;GAIG;AACH,MAAM,IAAI,GAAG;;;;;;;CAOZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,KAAK;YACR,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC9C,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO;QACT;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,QAAQ,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC;;;;GAIG;AACH,MAAM,IAAI,GAAG;;;;;;;;CAQZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,KAAK;YACR,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC9C,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO;QACT;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,QAAQ,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/modules/explorer.d.ts

@@ -12,11 +12,14 @@ import type { ModuleManifest } from "./manifest.js";
 export type SourceExtension = ".ts" | ".js";
 /**
  * In dev the app runs straight from TypeScript (via tsx) so conventions
- * resolve to .ts files; a compiled deployment runs .js from dist. Core infers
- * which world it's in from its own file — this very file is only ever .js
- * after a build. The URL alone isn't trustworthy: tsx's tsImport presents
- * modules under a .js URL while only the .ts source exists on disk, so a
- * .js verdict is confirmed against the filesystem.
+ * resolve to .ts files; a compiled deployment runs .js. Crucially the
+ * verdict must describe the APP's files, never core's own compilation —
+ * the published core is always .js while the app it boots is usually .ts.
+ *
+ * Heuristic fallback (no module dirs to probe): the entry script's
+ * extension, then core's own file. The URL alone isn't trustworthy there:
+ * tsx's tsImport presents modules under a .js URL while only the .ts
+ * source exists on disk, so a .js verdict is confirmed against the disk.
  */
 export declare function detectSourceExtension(): SourceExtension;
 export interface ModuleFiles {

package/dist/modules/explorer.js

@@ -3,13 +3,19 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 /**
  * In dev the app runs straight from TypeScript (via tsx) so conventions
- * resolve to .ts files; a compiled deployment runs .js from dist. Core infers
- * which world it's in from its own file — this very file is only ever .js
- * after a build. The URL alone isn't trustworthy: tsx's tsImport presents
- * modules under a .js URL while only the .ts source exists on disk, so a
- * .js verdict is confirmed against the filesystem.
+ * resolve to .ts files; a compiled deployment runs .js. Crucially the
+ * verdict must describe the APP's files, never core's own compilation —
+ * the published core is always .js while the app it boots is usually .ts.
+ *
+ * Heuristic fallback (no module dirs to probe): the entry script's
+ * extension, then core's own file. The URL alone isn't trustworthy there:
+ * tsx's tsImport presents modules under a .js URL while only the .ts
+ * source exists on disk, so a .js verdict is confirmed against the disk.
  */
 export function detectSourceExtension() {
+    const entry = process.argv[1];
+    if (entry?.endsWith(".ts") || entry?.endsWith(".mts"))
+        return ".ts";
     const self = fileURLToPath(import.meta.url);
     if (self.endsWith(".ts"))
         return ".ts";
@@ -17,6 +23,31 @@ export function detectSourceExtension() {
         return ".ts";
     return ".js";
 }
+/**
+ * The authoritative verdict: look at what the modules actually contain.
+ * Only when a project has conventional files in BOTH extensions (or none
+ * at all) does the runtime heuristic break the tie.
+ */
+function probeSourceExtension(modules) {
+    let sawTs = false;
+    let sawJs = false;
+    for (const module of modules) {
+        for (const ext of [".ts", ".js"]) {
+            const hit = existsSync(join(module.dir, `module.config${ext}`)) ||
+                existsSync(join(module.dir, `module.acl${ext}`)) ||
+                COLLECTIONS.some(([, dirName, suffix]) => listWithSuffix(join(module.dir, dirName), suffix + ext).length > 0);
+            if (ext === ".ts")
+                sawTs ||= hit;
+            else
+                sawJs ||= hit;
+        }
+        if (sawTs && sawJs)
+            break;
+    }
+    if (sawTs !== sawJs)
+        return sawTs ? ".ts" : ".js";
+    return detectSourceExtension();
+}
 /** dir name → file suffix, e.g. routes/users.routes.ts */
 const COLLECTIONS = [
     ["routeFiles", "routes", ".routes"],
@@ -26,7 +57,7 @@ const COLLECTIONS = [
     ["socketFiles", "sockets", ".sockets"],
 ];
 export function exploreModules(modules, options = {}) {
-    const ext = options.sourceExtension ?? detectSourceExtension();
+    const ext = options.sourceExtension ?? probeSourceExtension(modules);
     return modules.map((module) => {
         const files = {
             module,

package/dist/modules/explorer.js.map

@@ -1 +1 @@
-{"version":3,"file":"explorer.js","sourceRoot":"","sources":["../../src/modules/explorer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiBzC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,0DAA0D;AAC1D,MAAM,WAAW,GAAG;IAClB,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAClC,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,CAAC;IAC7C,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC;CAC9B,CAAC;AAOX,MAAM,UAAU,cAAc,CAC5B,OAAkC,EAClC,OAAO,GAAmB,EAAE;IAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IAE/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAgB;YACzB,MAAM;YACN,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,MAAc;IACjD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,yDAAyD;IACtE,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,EAAE,CAAC,CAAC,sCAAsC;AACnD,CAAC"}
+{"version":3,"file":"explorer.js","sourceRoot":"","sources":["../../src/modules/explorer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiBzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;YAC1C,MAAM,GAAG,GACP,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;gBACnD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;gBAChD,WAAW,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CACtB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CACrE,CAAC;YACJ,IAAI,GAAG,KAAK,KAAK;gBAAE,KAAK,KAAK,GAAG,CAAC;;gBAC5B,KAAK,KAAK,GAAG,CAAC;QACrB,CAAC;QACD,IAAI,KAAK,IAAI,KAAK;YAAE,MAAM;IAC5B,CAAC;IAED,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAeD,0DAA0D;AAC1D,MAAM,WAAW,GAAG;IAClB,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAClC,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,CAAC;IAC7C,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC;CAC9B,CAAC;AAOX,MAAM,UAAU,cAAc,CAC5B,OAAkC,EAClC,OAAO,GAAmB,EAAE;IAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAgB;YACzB,MAAM;YACN,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,MAAc;IACjD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,yDAAyD;IACtE,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,EAAE,CAAC,CAAC,sCAAsC;AACnD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tulipes/core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Module-based Express framework: convention-driven boot pipeline, env contracts, ACL, queues, sockets and CLI",
   "type": "module",
   "bin": {