@zaaxch/tailframe 0.1.0

package/src/new.mjs

@@ -0,0 +1,754 @@
+import fs from "node:fs";
+import path from "node:path";
+import { GenerateError } from "./generate.mjs";
+
+function fail(message) {
+	throw new GenerateError(message);
+}
+
+function parseArgs(argv) {
+	const result = { db: "mongo", auth: "none", ui: false, redis: false, worker: false };
+	for (let i = 0; i < argv.length; i += 1) {
+		const arg = argv[i];
+		if (["--name", "--path", "--auth"].includes(arg)) result[arg.slice(2)] = argv[++i];
+		else if (["--ui", "--redis", "--worker"].includes(arg)) result[arg.slice(2)] = true;
+		else fail(`Unknown argument: ${arg}`);
+	}
+	if (!result.name || !/^[a-z][a-z0-9-]*$/.test(result.name)) fail("--name must use lowercase letters, digits, and hyphens and start with a letter");
+	if (!result.path) fail("--path is required");
+	if (!["none", "firebase"].includes(result.auth)) fail("--auth must be none or firebase");
+	if (result.worker) result.redis = true;
+	return result;
+}
+
+export function createProject(argv) {
+const options = parseArgs(argv);
+const parent = path.resolve(options.path);
+const root = path.join(parent, options.name);
+if (!fs.existsSync(parent) || !fs.statSync(parent).isDirectory()) fail(`Parent directory does not exist: ${parent}`);
+if (fs.existsSync(root) && fs.readdirSync(root).length) fail(`Refusing to overwrite non-empty directory: ${root}`);
+
+const title = options.name.split("-").map((part) => part[0].toUpperCase() + part.slice(1)).join(" ");
+const svc = `${options.name}-svc`;
+const ui = `${options.name}-ui`;
+const files = {};
+const add = (relative, content) => { files[relative] = content.endsWith("\n") ? content : `${content}\n`; };
+const architectureValidatorSource = fs.readFileSync(new URL("../assets/validate-architecture.mjs", import.meta.url), "utf8");
+const prettierConfig = {
+	useTabs: true,
+	tabWidth: 4,
+	printWidth: 120,
+	trailingComma: "none",
+	organizeImportsSkipDestructiveCodeActions: true,
+	endOfLine: "lf",
+	singleQuote: false
+};
+
+add(".prettierrc.json", JSON.stringify(prettierConfig, null, "\t"));
+add(".gitattributes", `* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.pdf binary
+`);
+
+const repos = [[svc, "Express/TypeScript API and background runtime."]];
+if (options.ui) repos.push([ui, "Vue/Vite customer interface."]);
+
+add("AGENTS.md", `# ${title} repository guidance
+
+## Sources of truth
+
+- Treat implementation and tests as the source of truth for current behavior.
+- Product documentation may establish intent but is not proof of implemented behavior.
+- Do not claim functionality works merely because a type, route, UI control, configuration key, placeholder, or planning entry exists.
+
+## Product boundary
+
+The product domain is not yet defined. Do not invent domain entities, workflows, claims, roles, or integrations. Add product-specific guidance only after an explicit decision or implementation establishes it.
+
+## Repository map
+
+This project root contains separate repositories. Do not assume that a convention from one repository applies to another.
+
+${repos.map(([name, description]) => `- \`${name}/\` — ${description} Read \`${name}/AGENTS.md\` before editing it.`).join("\n")}
+
+## Cross-repository changes
+
+1. Read each applicable child \`AGENTS.md\`.
+2. Inspect the nearest working implementation in each repository.
+3. Keep shared contracts aligned across all affected clients and services.
+4. Validate each repository with its own scripts.
+5. Do not claim end-to-end behavior from changes or static checks in only one repository.
+
+## Module workflow
+
+- Use the local \`new-module\` skill whenever creating or extending a domain module, public operation, persisted entity, or client capability module.
+- This applies when work affects one repository, multiple repositories, or one phase of a feature whose backend and clients will be implemented separately.
+- Do not wait for a task to become cross-repository before using the skill.
+- Create architecture files with \`tailframe generate\` in the affected repository; the skill orchestrates the work, the CLI creates the files.
+
+## Code-change guidelines
+
+- Keep changes small and focused and avoid unrelated refactoring.
+- Modify existing structures when they fit the requirement.
+- Preserve unrelated worktree changes.
+- Confirm every committed change belongs to the requested scope.
+
+## GitHub workflow
+
+- Use \`gh\` for GitHub interactions when it supports the action.
+- Inspect existing issues and pull requests before proposing duplicates.
+- Never mutate GitHub state without explicit authorization.
+- Verify external mutations with a read-only follow-up.
+
+## GitHub authentication and sandboxing
+
+- All \`gh\`, AWS/ECR, and Docker commands must run outside the sandbox. Request approval before the first attempt; do not try them inside the sandbox first.
+- Docker commands include \`docker\`, \`docker compose\`, \`docker exec\`, and package scripts whose purpose is to invoke Docker.
+- AWS/ECR commands include \`aws ecr\` authentication and package scripts that build or push ECR images.
+- Never print, log, commit, or include GitHub tokens in command output.
+- Keep mutation approvals separate from read-only GitHub access.
+
+## Starting work from a GitHub issue
+
+Resolve and read the issue and comments, load applicable guidance, inspect worktree state and related work, determine scope and validation, preserve unrelated changes, and use an isolated branch for implementation. Starting implementation does not authorize changing issue metadata. Report the issue, repositories, branch, scope, checks, preserved changes, and blockers.
+`);
+
+add(".agents/skills/new-module/SKILL.md", `---
+name: new-module
+description: Create or extend a domain-colocated module in one repository or across the optional service and UI repositories using explicit use cases, separate trusted request context, module-owned repository ports and persistence adapters, HTTP validation, and focused tests. Use for backend capabilities, HTTP operations, persisted entities, queries, commands, jobs, workers, frontend capability modules, or phased work where a client is implemented later.
+---
+
+# New module
+
+Use this workflow for any new domain capability or operation. Add only the layers earned by actual behavior.
+
+1. Identify the module, requested operations, entry points, and repositories in scope. Classify every intended file with the applicable AGENTS.md placement table before writing. Do not assume full CRUD.
+2. Read the root and every applicable child \`AGENTS.md\`.
+3. Inspect the nearest working module and tests.
+4. Create architecture files only with the tailframe CLI: \`tailframe generate\` creates service modules, use cases, http files, ports, adapters, identifiers, and integrations, and UI modules, api clients, views, components, stores, and composables on canonical paths with canonical names. Hand-creating architecture files is a conformance violation; complete the printed wiring checklist after each generation.
+5. Colocate product capability behavior under \`src/modules/<module>\` in both the service and UI. Never substitute \`features\` or global \`apis\`, \`views\`, \`services\`, \`stores\`, or \`types\` directories. Theme state, its toggle, tests, the router, and the application shell always belong under UI \`src/app\`; never create \`src/modules/theme\`. Start backend modules with \`use-cases/\`, \`http/\`, and tests; add \`domain/\` or \`persistence/\` only when required. Add only the UI module directories earned by the capability.
+6. Define use cases as \`execute(context, input)\`. Keep trusted \`RequestContext\` separate from client input.
+7. Put ownership, RBAC, entitlements, and domain policies in use-case or domain code, not client bodies or route metadata.
+8. Define repository contracts in the owning module and implement them in persistence adapters.
+9. For persisted capabilities, prefer branded, domain-owned string IDs at domain and repository-port boundaries; generate the module's identifier file with \`tailframe generate identifiers <module> <NameId...>\`. Keep MongoDB \`ObjectId\` conversion inside MongoDB persistence adapters, using persistence-only document types rather than \`any\` to bypass the boundary.
+10. Let HTTP routes, jobs, workers, scheduled tasks, and CLIs invoke use cases directly; do not call one entry point from another.
+11. Keep operation names, payloads, authentication, response contracts, and client types synchronized. A service module may import another only through a named file directly under the provider's use-cases directory and must keep the module dependency graph acyclic. UI modules never import one another; compose them in UI app.
+12. Add required container, route, client, navigation, worker, or process registration and focused tests.
+13. Run npm run validate:architecture in every affected repository, then run focused type checks and tests. Report repositories, operations, entry points, checks, placement decisions, and gaps.
+
+Do not create empty architectural layers, speculative operations, or mandatory controllers. Do not claim behavior from static files, weaken trusted context or persistence ownership, or change unrelated background behavior.
+`);
+
+const svcDeps = {
+	"@dotenvx/dotenvx": "^1.39.1",
+	"body-parser": "^2.2.0",
+	cors: "^2.8.5",
+	express: "^4.21.2",
+	joi: "^17.13.3",
+	"reflect-metadata": "^0.2.2",
+	tsyringe: "^4.9.1",
+	mongodb: "^6.17.0",
+	...(options.auth === "firebase" ? { "firebase-admin": "^13.0.0" } : {}),
+	...(options.redis ? { redis: "^5.10.0" } : {})
+};
+const svcDevDeps = {
+	"@types/cors": "^2.8.17", "@types/express": "^5.0.1", "@types/jest": "^30.0.0", "@types/node": "^22.13.14", "@types/supertest": "^7.2.1",
+	jest: "^30.0.0", nodemon: "^3.1.9", prettier: "3.5.3", "ts-jest": "^29.4.11", "ts-node": "^10.9.2",
+	"tsc-alias": "^1.8.16", "tsconfig-paths": "^4.2.0", typescript: "^5.8.2", supertest: "^7.2.2"
+};
+add(`${svc}/package.json`, JSON.stringify({
+	name: svc, version: "0.1.0", private: true, main: "dist/server.js",
+	engines: { node: ">=22.13.0" },
+		scripts: {
+		dev: "nodemon --legacy-watch --exec ts-node -r tsconfig-paths/register src/server.ts",
+		...(options.worker ? { "dev:worker": "nodemon --legacy-watch --exec ts-node -r tsconfig-paths/register src/worker.ts" } : {}),
+		build: "tsc && tsc-alias", start: "node dist/server.js",
+		...(options.worker ? { worker: "node dist/worker.js" } : {}),
+		test: "npm run test:unit && npm run test:integration", "test:unit": "jest --selectProjects unit --runInBand", "test:integration": "jest --selectProjects integration --runInBand", "validate:architecture": "node scripts/validate-architecture.mjs --kind service .", format: "prettier --write src/",
+		"test:db:up": "docker compose -f docker-compose.test.yml up -d", "test:db:down": "docker compose -f docker-compose.test.yml down -v",
+		"docker:dev": "docker compose -f docker-compose.dev.yml up",
+		"docker:prod": "docker compose -f docker-compose.yml up -d",
+		"docker:push": "bash scripts/build_and_push.sh"
+	}, dependencies: svcDeps, devDependencies: svcDevDeps
+}, null, "\t"));
+add(`${svc}/scripts/validate-architecture.mjs`, architectureValidatorSource);
+add(`${svc}/tsconfig.json`, JSON.stringify({
+	compilerOptions: { target: "ES2022", module: "commonjs", rootDir: "src", outDir: "dist", strict: true, esModuleInterop: true, experimentalDecorators: true, emitDecoratorMetadata: true, baseUrl: ".", paths: { "@/*": ["src/*"] }, skipLibCheck: true },
+	include: ["src/**/*.ts"]
+}, null, "\t"));
+add(`${svc}/jest.config.js`, `const base = { preset: "ts-jest", testEnvironment: "node", setupFiles: ["reflect-metadata"], roots: ["<rootDir>/src"], moduleNameMapper: { "^@/(.*)$": "<rootDir>/src/$1" } };
+module.exports = { projects: [
+	{ ...base, displayName: "unit", testMatch: ["**/*.test.ts"], testPathIgnorePatterns: ["/node_modules/", "\\\\.integration\\\\.test\\\\.ts$"] },
+	{ ...base, displayName: "integration", testMatch: ["**/*.integration.test.ts"] }
+] };`);
+add(`${svc}/.prettierrc.json`, JSON.stringify(prettierConfig, null, "\t"));
+add(`${svc}/.gitignore`, `node_modules/\ndist/\n.env*\n!.env.example\n*.log\nfirebase-service-account*.json\n`);
+add(`${svc}/.dockerignore`, `node_modules\ndist\n.git\n.env*\n!.env.example\n*.log\ndata\nfirebase-service-account*.json\n`);
+if (options.ui) add(".dockerignore", `**/node_modules\n**/dist\n**/.git\n**/.env*\n**/*.log\n**/data\n**/firebase-service-account*.json\n`);
+const dbEnv = "MONGODB_URI=mongodb://localhost:27017/?replicaSet=rs0&directConnection=true\nMONGODB_DB_NAME=" + options.name.replaceAll("-", "_");
+add(`${svc}/.env.example`, `NODE_ENV=development\nPORT=3000\nCORS_ORIGIN=https://localhost:5173\n${dbEnv}\n${options.auth === "firebase" ? "FIREBASE_PROJECT_ID=\n" : ""}${options.redis ? "REDIS_URL=redis://localhost:6379\n" : ""}`);
+add(`${svc}/src/platform/config/env.ts`, `import "@dotenvx/dotenvx/config";
+export const env = {
+	nodeEnv: process.env.NODE_ENV ?? "development",
+	port: Number(process.env.PORT ?? 3000),
+	corsOrigin: process.env.CORS_ORIGIN ?? "https://localhost:5173",
+	${options.auth === "firebase" ? `firebaseProjectId: process.env.FIREBASE_PROJECT_ID ?? "",` : ""}
+	mongodbUri: process.env.MONGODB_URI ?? "mongodb://localhost:27017/?replicaSet=rs0&directConnection=true",
+	mongodbDbName: process.env.MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}",
+	${options.redis ? `redisUrl: process.env.REDIS_URL ?? "redis://localhost:6379",` : ""}
+};`);
+const databaseSource = `import { MongoClient } from "mongodb";
+import { env } from "@/platform/config/env";
+export const mongo = new MongoClient(env.mongodbUri);
+export async function connectDatabase() { await mongo.connect(); return mongo.db(env.mongodbDbName); }
+export async function closeDatabase() { await mongo.close(); }`;
+add(`${svc}/src/platform/database/index.ts`, databaseSource);
+if (options.redis) add(`${svc}/src/platform/redis/index.ts`, `import { createClient, type RedisClientType } from "redis";
+import { env } from "@/platform/config/env";
+export const redis: RedisClientType = createClient({ url: env.redisUrl });
+redis.on("error", (error) => console.error("Redis client error", error));
+export async function connectRedis() { if (!redis.isOpen) await redis.connect(); return redis; }
+export async function closeRedis() { if (redis.isOpen) await redis.quit(); }
+`);
+add(`${svc}/src/core/RequestContext.ts`, `export interface AuthenticatedPrincipal {\n\tuid: string;\n\temail?: string;\n}\nexport interface RequestContext {\n\trequestId: string;\n\tprincipal?: AuthenticatedPrincipal;\n\troles: string[];\n}\n`);
+add(`${svc}/src/core/UseCase.ts`, `import type { RequestContext } from "@/core/RequestContext";\nexport interface UseCase<Input, Output> {\n\texecute(context: RequestContext, input: Input): Promise<Output>;\n}\n`);
+add(`${svc}/src/platform/http/createRequestContext.ts`, options.auth === "firebase" ? `import { randomUUID } from "node:crypto";
+import type { Request } from "express";
+import type { RequestContext } from "@/core/RequestContext";
+import { verifyFirebaseToken } from "@/platform/auth/firebase";
+export async function createRequestContext(req: Request): Promise<RequestContext> {
+	const requestId = String(req.headers["x-request-id"] ?? randomUUID());
+	const decoded = req.headers.authorization?.startsWith("Bearer ") ? await verifyFirebaseToken(req.headers.authorization.slice(7)) : undefined;
+	return { requestId, principal: decoded ? { uid: decoded.uid, email: decoded.email } : undefined, roles: [] };
+}
+export function systemRequestContext(requestId = "system"): RequestContext { return { requestId, roles: [] }; }
+` : `import { randomUUID } from "node:crypto";
+import type { Request } from "express";
+import type { RequestContext } from "@/core/RequestContext";
+export function createRequestContext(req: Request): RequestContext {
+	return { requestId: String(req.headers["x-request-id"] ?? randomUUID()), roles: [] };
+}
+export function systemRequestContext(requestId = "system"): RequestContext { return { requestId, roles: [] }; }
+`);
+if (options.auth === "firebase") add(`${svc}/src/platform/auth/firebase.ts`, `import { applicationDefault, getApps, initializeApp } from "firebase-admin/app";
+import { getAuth, type DecodedIdToken } from "firebase-admin/auth";
+import { env } from "@/platform/config/env";
+export function verifyFirebaseToken(token: string): Promise<DecodedIdToken> {
+	if (!getApps().length) initializeApp({ credential: applicationDefault(), projectId: env.firebaseProjectId || undefined });
+	return getAuth().verifyIdToken(token);
+}`);
+add(`${svc}/src/platform/http/rpc.ts`, `import type { Response } from "express";\nexport function rpcResult(res: Response, result: unknown) { return res.json({ result }); }\n`);
+add(`${svc}/src/platform/http/errors.ts`, `import type { ErrorRequestHandler } from "express";
+export const errorHandler: ErrorRequestHandler = (error, _req, res, _next) => {
+	if (error?.isJoi) { res.status(400).json({ error: { message: error.message } }); return; }
+	const status = Number(error?.status ?? 500);
+	res.status(status).json({ error: { message: status === 500 ? "Internal server error" : error.message } });
+};
+`);
+add(`${svc}/src/modules/health/use-cases/GetHealth.ts`, `import type { UseCase } from "@/core/UseCase";\nimport type { RequestContext } from "@/core/RequestContext";\nexport type HealthResult = { status: "ok" };\nexport class GetHealth implements UseCase<Record<string, never>, HealthResult> {\n\tasync execute(_context: RequestContext, _input: Record<string, never>): Promise<HealthResult> { return { status: "ok" }; }\n}\n`);
+add(`${svc}/src/modules/health/http/health.schemas.ts`, `import Joi from "joi";\nexport const GetHealthSchema = Joi.object({}).unknown(false);\n`);
+add(`${svc}/src/modules/health/http/health.routes.ts`, `import { Router } from "express";\nimport type { GetHealth } from "@/modules/health/use-cases/GetHealth";\nimport { GetHealthSchema } from "@/modules/health/http/health.schemas";\nimport { createRequestContext } from "@/platform/http/createRequestContext";\nimport { rpcResult } from "@/platform/http/rpc";\nexport function healthRoutes(getHealth: GetHealth) {\n\tconst router = Router();\n\trouter.post("/health.get", async (req, res, next) => { try { const input = await GetHealthSchema.validateAsync(req.body ?? {}); rpcResult(res, await getHealth.execute(await createRequestContext(req), input)); } catch (error) { next(error); } });\n\treturn router;\n}\n`);
+add(`${svc}/src/app/container.ts`, `import { container } from "tsyringe";\nimport { GetHealth } from "@/modules/health/use-cases/GetHealth";\ncontainer.registerSingleton(GetHealth, GetHealth);\nexport { container };\n`);
+add(`${svc}/src/app/routes.ts`, `import { Router } from "express";\nimport { container } from "@/app/container";\nimport { GetHealth } from "@/modules/health/use-cases/GetHealth";\nimport { healthRoutes } from "@/modules/health/http/health.routes";\nexport function applicationRoutes() { const router = Router(); router.use(healthRoutes(container.resolve(GetHealth))); return router; }\n`);
+add(`${svc}/src/app/server.ts`, `import path from "node:path";
+import express from "express";
+import cors from "cors";
+import { applicationRoutes } from "@/app/routes";
+import { env } from "@/platform/config/env";
+import { connectDatabase, closeDatabase } from "@/platform/database";
+import { errorHandler } from "@/platform/http/errors";
+export interface ApplicationOptions { publicPath?: string; production?: boolean; }
+export function createApplication(options: ApplicationOptions = {}) {
+	const app = express();
+	${options.ui ? `const publicPath = options.publicPath ?? path.join(__dirname, "..", "public");
+	const production = options.production ?? env.nodeEnv === "production";
+	if (production) app.use(express.static(publicPath, { index: false, maxAge: "1y", immutable: true }));` : ""}
+	app.use(cors({ origin: env.corsOrigin }));
+	app.use(express.json());
+	app.use("/api/v1", applicationRoutes());
+	${options.ui ? `if (production) {
+		app.get(/^(?!\\/api(?:\\/|$)).*/, (_req, res) => res.sendFile(path.join(publicPath, "index.html")));
+	}` : ""}
+	app.use(errorHandler);
+	return app;
+}
+export async function startServer() {
+	await connectDatabase();
+	const app = createApplication();
+	const server = app.listen(env.port);
+	const shutdown = async () => { server.close(); await closeDatabase(); };
+	process.once("SIGINT", shutdown);
+	process.once("SIGTERM", shutdown);
+	return { app, server, shutdown };
+}
+`);
+add(`${svc}/src/server.ts`, `import "reflect-metadata";\nimport { startServer } from "@/app/server";\nvoid startServer();\n`);
+if (options.worker) add(`${svc}/src/app/workers/startWorker.ts`, `import { connectDatabase, closeDatabase } from "@/platform/database";
+import { connectRedis, closeRedis } from "@/platform/redis";
+import { systemRequestContext } from "@/platform/http/createRequestContext";
+import { GetHealth } from "@/modules/health/use-cases/GetHealth";
+// Workers invoke use cases directly. Add real scheduled work only with an explicit domain workflow.
+export async function startWorker() {
+	await connectDatabase();
+	await connectRedis();
+	console.log("${title} worker runtime ready", await new GetHealth().execute(systemRequestContext(), {}));
+	const shutdown = async () => { await closeDatabase(); await closeRedis(); process.exit(0); };
+	process.once("SIGINT", shutdown);
+	process.once("SIGTERM", shutdown);
+}
+`);
+if (options.worker) add(`${svc}/src/worker.ts`, `import "reflect-metadata";\nimport { startWorker } from "@/app/workers/startWorker";\nvoid startWorker();\n`);
+add(`${svc}/src/modules/health/__tests__/GetHealth.test.ts`, `import { GetHealth } from "@/modules/health/use-cases/GetHealth";\ndescribe("GetHealth", () => { it("returns readiness through the use-case contract", async () => { await expect(new GetHealth().execute({ requestId: "test", roles: [] }, {})).resolves.toEqual({ status: "ok" }); }); });\n`);
+add(`${svc}/src/__tests__/testDb.ts`, `import { MongoClient } from "mongodb";
+const client = new MongoClient(process.env.TEST_MONGODB_URI ?? "mongodb://localhost:27018/?replicaSet=rs0&directConnection=true");
+export async function openTestDatabase() { await client.connect(); return client.db(process.env.TEST_MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}_test"); }
+export async function resetTestDatabase() { const database = await openTestDatabase(); await database.dropDatabase(); return database; }
+export async function closeTestDatabase() { await client.close(); }
+`);
+add(`${svc}/docker-compose.test.yml`, `name: ${options.name}-test
+services:
+  mongo:
+    image: mongo:8
+    command: mongod --replSet rs0 --bind_ip_all
+    ports:
+      - "27018:27017"
+    tmpfs:
+      - /data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+  mongo-init:
+    image: mongo:8
+    depends_on:
+      mongo:
+        condition: service_healthy
+    restart: "no"
+    entrypoint:
+      - bash
+      - -c
+      - |
+        mongosh --host mongo --quiet --eval '
+          try {
+            rs.status().ok
+          } catch (error) {
+            rs.initiate({ _id: "rs0", members: [{ _id: 0, host: "localhost:27017" }] })
+          }
+        '
+`);
+add(`${svc}/src/app/__tests__/boundary.integration.test.ts`, `import request from "supertest";
+${options.ui ? 'import path from "node:path";\n' : ""}
+import { createApplication } from "@/app/server";
+import { closeTestDatabase, resetTestDatabase } from "@/__tests__/testDb";
+describe("HTTP boundary", () => {
+	beforeAll(async () => { await resetTestDatabase(); });
+	afterAll(async () => { await closeTestDatabase(); });
+	it("returns a successful RPC envelope", async () => {
+		await request(createApplication()).post("/api/v1/health.get").send({}).expect(200).expect(({ body }) => {
+			expect(body).toEqual({ result: { status: "ok" } });
+		});
+	});
+	it("returns a validation error envelope", async () => {
+		await request(createApplication()).post("/api/v1/health.get").send({ unexpected: true }).expect(400).expect(({ body }) => {
+			expect(body.error.message).toEqual(expect.any(String));
+		});
+	});
+${options.ui ? `	it("serves the production SPA without falling through for API paths", async () => {
+		const app = createApplication({ production: true, publicPath: path.join(__dirname, "fixtures/public") });
+		await request(app).get("/dashboard").expect(200).expect(({ text }) => expect(text).toContain("boundary-test-spa"));
+		await request(app).get("/api/v1/does-not-exist").expect(404);
+	});
+` : ""}
+});
+`);
+if (options.ui) add(`${svc}/src/app/__tests__/fixtures/public/index.html`, `<!doctype html><html><body><div id="app">boundary-test-spa</div></body></html>`);
+add(`${svc}/AGENTS.md`, `# ${title} service guidance
+
+## Scope
+These conventions apply to \`${svc}\`. This service is a modular monolith organized around domain capabilities, not global technical layers.
+
+## Architecture vocabulary
+- Use \`src/app\` for process assembly, server creation, route mounting, and dependency registration.
+- Use \`src/core\` only for small technology-neutral contracts such as \`RequestContext\` and \`UseCase\`.
+- Use \`src/platform\` for technical mechanisms such as Express, authentication, configuration, databases, Redis, and shared HTTP behavior.
+- Use \`src/modules/<module>\` for product capabilities.
+- These are the only service architecture roots. Keep \`src/core\` flat. Put external-system adapters under \`src/platform/integrations/<provider>\`; directories immediately under \`src/app\` are limited to \`cli\`, \`jobs\`, \`mcp\`, \`scheduled-tasks\`, \`workers\`, and \`__tests__\`.
+- Inside a module, use \`use-cases/\`, \`http/\`, and tests first. Add \`domain/\` or \`persistence/\` only when behavior requires them.
+- Core contracts must not import Express, Firebase, database, Redis, worker, or UI code.
+- Domain and use-case code must not import framework or vendor packages.
+
+## Change placement
+| Change | Canonical owner |
+| --- | --- |
+| Product rule, query, command, or policy | \`src/modules/<module>/use-cases\` or \`domain\` |
+| Repository port | Owning module's \`use-cases/ports\` |
+| MongoDB implementation | Owning module's \`persistence\` |
+| Express route or request schema | Owning module's \`http\` |
+| Vendor or external-system adapter | \`src/platform/integrations/<provider>\` |
+| Database, Redis, authentication, or HTTP mechanism | \`src/platform\` |
+| Process lifecycle, registration, schedule, or consumer | \`src/app/<entry-point-kind>\` |
+| Cross-entry-point technology-neutral contract | Flat \`src/core\` |
+| Root executable | Bootstrap of matching \`src/app\` assembly only |
+
+Product vocabulary stays in the module that owns its meaning; never move it into \`core\`. A module may import another only through a named file directly under the provider's \`use-cases/\`; its domain, HTTP, persistence, ports, and tests remain private, and cross-module use-case dependencies must be acyclic.
+
+## Public API contract
+- Use singular RPC-shaped \`POST /api/v1/<module>.<operation>\` operations and the \`{ result: ... }\` success envelope.
+- Implement only requested operations; do not create speculative CRUD.
+
+## Module ownership
+- Create architecture files only with \`tailframe generate\`; hand-created architecture files are a conformance violation.
+- Colocate capability code under \`src/modules/<module>\`.
+- Start with \`use-cases/\`, required \`http/\` translation, and tests. Add \`domain/\` or \`persistence/\` only when real behavior earns them.
+- Use cases expose \`execute(context, input)\` and remain callable from HTTP, jobs, workers, scheduled tasks, or CLIs.
+- Do not require controllers that only validate and delegate.
+
+## Trusted request context
+- Keep trusted \`RequestContext\` separate from client input.
+- Entry points construct context; HTTP schemas validate only client input.${options.auth === "firebase" ? " Protected entry points verify Firebase tokens before constructing authenticated context." : " This scaffold is anonymous; add authentication only when the product requires it."}
+- Put ownership, RBAC, entitlements, and domain policies in use-case or domain code.
+- Do not require RBAC when ownership, public/private visibility, or another smaller policy fits.
+
+## Persistence ownership
+- Define repository contracts under the owning module's \`use-cases/ports\`.
+- Implement database-specific adapters under that module's \`persistence/\` directory.
+- For persisted capabilities, prefer branded, domain-owned string IDs in module types and repository ports. A technology-neutral \`Brand<Value, Tag>\` helper MAY be defined when a real module needs distinct ID types; do not create product entities or concrete ID types in the scaffold.
+- Repository ports and use cases MUST NOT expose database identifier types. Persistence adapters SHOULD define persistence-only document types and MUST NOT use \`any\` to bypass the domain/persistence distinction. MongoDB \`ObjectId\` conversion belongs inside the MongoDB persistence adapter.
+- Add appropriate schema or validation, indexes, initialization or migrations, and focused tests.
+
+## Project-specific persistence
+This service uses MongoDB. Module-owned MongoDB adapters own collection access, persistence-only document types, and conversion of branded module string IDs to and from ObjectId inside the adapter, along with queries, projections, validators, and indexes. Do not use any to bypass the domain/persistence distinction.
+
+## Queries and commands
+- Commands enforce invariants and change state.
+- Queries may return efficient client-facing projections without forcing reads through rich aggregates.
+
+## Entry points and integrations
+- HTTP routes, jobs, workers, scheduled tasks, and CLIs call use cases directly; they do not call each other.
+- Keep external-system clients under \`src/platform/integrations/<provider>\` and adapt them through module-owned ports.
+- Keep optional entry-point assembly under \`src/app/<entry-point-kind>\`; root files such as \`src/server.ts\` and \`src/worker.ts\` may only bootstrap that assembly.
+- Register dependencies, routes, workers, and jobs explicitly.
+${options.ui ? "- In production, serve the compiled UI from `dist/public` with a non-API SPA fallback. Never return the SPA for `/api` requests." : ""}
+
+## Tests and validation
+Run \`npm run validate:architecture\` after changing files or imports. The generated service also includes unit tests and Mongo-backed integration tests. Run \`npm run test:db:up\`, \`npm test\`, and \`npm run test:db:down\` for the full service check. Test use cases, policies, Mongo repository adapters, and HTTP boundaries where behavior lives. Every public operation needs success and error-envelope coverage; authenticated operations need trusted-identity coverage; persisted capabilities need Mongo ownership/query coverage; UI-enabled services must verify that \`/api\` paths never fall through to the SPA. All AWS/ECR and Docker commands, including \`npm run docker:push\`, must run outside the sandbox from the first attempt.
+`);
+
+if (options.ui) {
+const uiDeps = { "@tailwindcss/vite": "^4.1.18", "@vueuse/core": "^14.3.0", axios: "^1.9.0", pinia: "^3.0.1", primevue: "^4.2.5", vue: "^3.5.13", "vue-router": "^4.5.0", ...(options.auth === "firebase" ? { firebase: "^11.0.0" } : {}) };
+const uiDevDeps = { "@tsconfig/node22": "^22.0.1", "@types/node": "^22.13.14", "@vitejs/plugin-vue": "^5.2.3", "@vue/test-utils": "^2.4.10", "@vue/tsconfig": "^0.7.0", jsdom: "^29.1.1", "npm-run-all2": "^7.0.2", prettier: "3.5.3", typescript: "~5.8.0", vite: "^6.2.4", vitest: "^4.1.7", "vue-tsc": "^2.2.8" };
+add(`${ui}/package.json`, JSON.stringify({ name: ui, version: "0.1.0", private: true, type: "module", scripts: { dev: "vite --host 0.0.0.0", build: "run-p type-check \"build-only {@}\" --", "build-only": "vite build", "type-check": "vue-tsc --build", test: "vitest", "validate:architecture": "node scripts/validate-architecture.mjs --kind ui .", format: "prettier --write src/" }, dependencies: uiDeps, devDependencies: uiDevDeps }, null, "\t"));
+add(`${ui}/scripts/validate-architecture.mjs`, architectureValidatorSource);
+add(`${ui}/.prettierrc.json`, JSON.stringify(prettierConfig, null, "\t"));
+add(`${ui}/tsconfig.json`, JSON.stringify({ files: [], references: [{ path: "./tsconfig.app.json" }, { path: "./tsconfig.node.json" }] }, null, "\t"));
+add(`${ui}/tsconfig.app.json`, JSON.stringify({ extends: "@vue/tsconfig/tsconfig.dom.json", include: ["env.d.ts", "src/**/*", "src/**/*.vue"], compilerOptions: { composite: true, baseUrl: ".", paths: { "@/*": ["./src/*"] } } }, null, "\t"));
+add(`${ui}/tsconfig.node.json`, JSON.stringify({ extends: "@tsconfig/node22/tsconfig.json", include: ["vite.config.*"], compilerOptions: { composite: true, types: ["node"] } }, null, "\t"));
+add(`${ui}/vite.config.ts`, `import { fileURLToPath, URL } from "node:url";\nimport { defineConfig } from "vitest/config";\nimport vue from "@vitejs/plugin-vue";\nimport tailwindcss from "@tailwindcss/vite";\nexport default defineConfig({ plugins: [vue(), tailwindcss()], resolve: { alias: { "@": fileURLToPath(new URL("./src", import.meta.url)) } }, server: { proxy: { "/api": { target: "http://localhost:3000", changeOrigin: true } } }, test: { environment: "jsdom", globals: true } });`);
+add(`${ui}/env.d.ts`, `/// <reference types="vite/client" />`);
+add(`${ui}/index.html`, `<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<title>${title}</title>
+	</head>
+	<body>
+		<div id="app"></div>
+		<script type="module" src="/src/main.ts"></script>
+	</body>
+</html>
+`);
+add(`${ui}/.gitignore`, `node_modules/\ndist/\n.env*\n!.env.example\ncerts/\n*.log\n`);
+if (options.auth === "firebase") add(`${ui}/.env.example`, `VITE_FIREBASE_API_KEY=\nVITE_FIREBASE_AUTH_DOMAIN=\nVITE_FIREBASE_PROJECT_ID=\nVITE_FIREBASE_APP_ID=\n`);
+add(`${ui}/src/core/rpc.ts`, `export interface RpcResponse<T> { result: T; }\nexport interface RpcError { error: { message: string; code?: string }; }`);
+if (options.auth === "firebase") {
+	add(`${ui}/src/platform/firebase.ts`, `import { initializeApp } from "firebase/app";\nexport const firebaseApp = initializeApp({ apiKey: import.meta.env.VITE_FIREBASE_API_KEY, authDomain: import.meta.env.VITE_FIREBASE_AUTH_DOMAIN, projectId: import.meta.env.VITE_FIREBASE_PROJECT_ID, appId: import.meta.env.VITE_FIREBASE_APP_ID });`);
+	add(`${ui}/src/app/stores/auth.ts`, `import { defineStore } from "pinia";\nimport { getAuth, onAuthStateChanged, signOut, type User } from "firebase/auth";\nimport { ref } from "vue";\nimport { firebaseApp } from "@/platform/firebase";\nexport const useAuthStore = defineStore("auth", () => { const firebaseUser = ref<User|null>(null); const ready = ref(false); const auth = getAuth(firebaseApp); onAuthStateChanged(auth, user => { firebaseUser.value = user; ready.value = true; }); const getIdToken = () => firebaseUser.value?.getIdToken(); const logout = () => signOut(auth); return { firebaseUser, ready, getIdToken, logout }; });`);
+}
+add(`${ui}/src/app/router.ts`, `import { createRouter, createWebHistory } from "vue-router";\nexport enum RouteNames { HOME = "Home" }\nexport default createRouter({ history: createWebHistory(), routes: [{ path: "/", name: RouteNames.HOME, component: () => import("@/app/views/HomeView.vue") }] });`);
+add(`${ui}/src/platform/http.ts`, `import axios from "axios";\nexport const http = axios.create({ baseURL: \`\${window.location.origin}/api/v1\`, headers: { "Content-Type": "application/json" } });`);
+if (options.auth === "firebase") add(`${ui}/src/app/configureHttp.ts`, `import type { Pinia } from "pinia";\nimport router, { RouteNames } from "@/app/router";\nimport { useAuthStore } from "@/app/stores/auth";\nimport { http } from "@/platform/http";\nexport function configureHttp(pinia: Pinia) {\n\tconst auth = useAuthStore(pinia);\n\thttp.interceptors.request.use(async config => { const token = await auth.getIdToken(); if (token) config.headers.Authorization = \`Bearer \${token}\`; return config; });\n\thttp.interceptors.response.use(response => response, async error => { if (error?.response?.status === 401) { await auth.logout(); await router.push({ name: RouteNames.HOME }); } return Promise.reject(error); });\n}\n`);
+add(`${ui}/src/modules/health/api/health.api.ts`, `import { http } from "@/platform/http";\nimport type { RpcResponse } from "@/core/rpc";\nexport async function getHealth() { return (await http.post<RpcResponse<{ status: string }>>("health.get")).data.result; }`);
+add(`${ui}/src/app/views/HomeView.vue`, `<template><main class="mx-auto flex min-h-screen max-w-5xl flex-col justify-center gap-4 px-6 py-16"><p class="font-bold uppercase tracking-[0.12em] text-emerald-800">Project foundation</p><h1 class="m-0 text-5xl font-bold sm:text-7xl">${title}</h1><p>The product domain is intentionally undefined.</p></main></template>`);
+add(`${ui}/src/app/App.vue`, `<template><RouterView /></template><script setup lang="ts">import { RouterView } from "vue-router";</script>`);
+add(`${ui}/src/app/startApplication.ts`, `import { createApp } from "vue";\nimport { createPinia } from "pinia";\nimport PrimeVue from "primevue/config";\nimport App from "@/app/App.vue";\n${options.auth === "firebase" ? 'import { configureHttp } from "@/app/configureHttp";\n' : ""}import router from "@/app/router";\nimport "@/app/styles.css";\nexport function startApplication() {\n\tconst app = createApp(App);\n\tconst pinia = createPinia();\n\tapp.use(pinia).use(PrimeVue).use(router);\n\t${options.auth === "firebase" ? "configureHttp(pinia);\n\t" : ""}app.mount("#app");\n}\n`);
+add(`${ui}/src/main.ts`, `import { startApplication } from "@/app/startApplication";\nstartApplication();\n`);
+add(`${ui}/src/app/styles.css`, `@import "tailwindcss";\n:root { font-family: Inter, ui-sans-serif, system-ui; color: #17221c; background: #f5f3ec; }\nbody { margin: 0; }`);
+add(`${ui}/src/app/__tests__/App.spec.ts`, `import { mount } from "@vue/test-utils";\nimport App from "@/app/App.vue";\ndescribe("App", () => { it("renders a router view", () => { expect(mount(App, { global: { stubs: ["RouterView"] } }).exists()).toBe(true); }); });`);
+add(`${ui}/AGENTS.md`, `# ${title} UI guidance
+
+## Scope
+These conventions apply to \`${ui}/src\`. Inspect the nearest working module before adding files.
+
+## Architecture vocabulary
+- Use \`src/app\` for Vue bootstrap, the application shell, routing, global styles, and truly application-wide state.
+- Use \`src/core\` only for small technology-neutral client contracts.
+- Use \`src/platform\` for Axios, Firebase, browser APIs, and other technical adapters.
+- Use \`src/modules/<module>\` for every product capability. Never substitute \`src/features\` or global \`apis\`, \`views\`, \`services\`, \`stores\`, or \`types\` directories.
+- These are the only UI architecture roots. Keep \`src/core\` flat. Shared capability code belongs to the module that owns it; reusable application-shell presentation belongs under \`src/app\`, whose optional directories are limited to \`components\`, \`stores\`, \`views\`, and \`__tests__\`.
+- Keep application-wide theme state at \`src/app/stores/theme.store.ts\`, its toggle at \`src/app/components/ThemeToggle.vue\`, and its tests under \`src/app/__tests__\`. Never create \`src/modules/theme\`.
+
+## Change placement
+| Change | Canonical owner |
+| --- | --- |
+| Capability API, component, composable, state, type, or view | \`src/modules/<module>\` |
+| Axios, Firebase, browser, or vendor mechanism | \`src/platform\` |
+| Shell, router, global state/theme, or cross-capability composition | \`src/app\` |
+| Technology-neutral client contract | Flat \`src/core\` |
+| Root executable | Bootstrap of \`src/app\` only |
+
+UI modules never import one another. Compose capabilities in \`src/app\`; platform code never imports app or module code.
+
+## Module shape
+Under \`src/modules/<module>\`, add only needed \`api/\`, \`components/\`, \`composables/\`, \`routes/\`, \`stores/\`, \`types/\`, \`views/\`, and \`__tests__/\` directories. Do not invent alternative layer names or generate speculative CRUD. Create module files only with \`tailframe generate\`.
+
+## API contract
+- Use the shared Axios client and singular \`POST <module>.<operation>\` calls.
+- Return typed \`response.data.result\` values and keep payloads, authentication, and types aligned with the service.
+- Frontend checks do not replace backend authorization or validation.
+
+## Routing and authentication
+Use named routes.${options.auth === "firebase" ? " Preserve Firebase authentication readiness and global `401` behavior, and test redirect ordering." : " This scaffold has no authentication; do not add auth state or redirects until the product requires them."}
+
+## State management
+Keep local state local. Use Pinia only for state shared across routes or unrelated components.
+
+## UI behavior
+Reuse Vue, PrimeVue, Tailwind, loading, error, and accessibility conventions. Provide explicit loading, empty, error, and authorization states.
+
+## Styling
+- Prefer Tailwind utility classes in Vue templates over custom selectors and component-scoped CSS.
+- Prefer flex or grid containers with \`gap\` and container padding over sibling margins for layout and spacing.
+- Keep \`src/app/styles.css\` limited to Tailwind imports, theme tokens, and true global base behavior.
+
+## Production packaging
+The UI runs through Vite in development but has no production container. The service's multi-stage Dockerfile builds this repository and copies its output into \`dist/public\`; Express serves it with SPA fallback. AWS ECR stores the combined production image.
+
+## Product language
+The product domain is undefined. Do not invent entities, workflows, roles, claims, navigation, or customer-facing promises.
+
+## Validation
+Run \`npm run validate:architecture\`, then add focused Vitest coverage and run type-check, build, and tests as applicable.
+`);
+}
+
+add(`${svc}/Dockerfile`, options.ui ? `FROM node:22.13-bookworm AS service-build
+WORKDIR /app/service
+COPY ${svc}/package*.json ./
+RUN npm ci
+COPY ${svc}/ ./
+RUN npm run build
+
+FROM node:22.13-bookworm AS ui-build
+WORKDIR /app/ui
+COPY ${ui}/package*.json ./
+RUN npm ci
+COPY ${ui}/ ./
+RUN npm run build
+
+FROM node:22.13-bookworm-slim
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=service-build /app/service/dist ./dist
+COPY --from=service-build /app/service/package*.json ./
+COPY --from=service-build /app/service/node_modules ./node_modules
+COPY --from=ui-build /app/ui/dist ./dist/public
+EXPOSE 3000
+CMD ["node", "dist/server.js"]
+` : `FROM node:22.13-bookworm AS build
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22.13-bookworm-slim
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/package*.json ./
+COPY --from=build /app/node_modules ./node_modules
+EXPOSE 3000
+CMD ["node", "dist/server.js"]
+`);
+add(`${svc}/Dockerfile.dev`, `FROM node:22.13-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm install
+COPY . .
+EXPOSE 3000
+CMD ["npm", "run", "dev"]
+`);
+add(`${svc}/scripts/build_and_push.sh`, `#!/usr/bin/env bash
+set -euo pipefail
+
+: "\${AWS_ACCOUNT_ID:?Set AWS_ACCOUNT_ID}"
+: "\${AWS_REGION:?Set AWS_REGION}"
+
+ECR_REPOSITORY="\${ECR_REPOSITORY:-${options.name}}"
+IMAGE_TAG="\${IMAGE_TAG:-latest}"
+REGISTRY="\${AWS_ACCOUNT_ID}.dkr.ecr.\${AWS_REGION}.amazonaws.com"
+IMAGE="\${REGISTRY}/\${ECR_REPOSITORY}:\${IMAGE_TAG}"
+SVC_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+BUILD_CONTEXT="${options.ui ? `$(cd "\${SVC_DIR}/.." && pwd)` : `\${SVC_DIR}`}"
+DOCKERFILE="\${SVC_DIR}/Dockerfile"
+
+aws ecr get-login-password --region "\${AWS_REGION}" |
+	docker login --username AWS --password-stdin "\${REGISTRY}"
+
+docker build --file "\${DOCKERFILE}" --tag "\${IMAGE}" "\${BUILD_CONTEXT}"
+docker push "\${IMAGE}"
+
+echo "Pushed \${IMAGE}"
+`);
+
+const serviceVolumes = [
+	...(options.auth === "firebase" ? ["      - ./firebase-service-account.production.json:/app/firebase-service-account.production.json:ro"] : [])
+];
+const devVolumes = [
+	"      - .:/app",
+	"      - /app/node_modules",
+	...(options.auth === "firebase" ? ["      - ./firebase-service-account.development.json:/app/firebase-service-account.development.json:ro"] : [])
+];
+const dependencies = [
+	["mongo-init", "service_completed_successfully"],
+	...(options.redis ? [["redis", "service_started"]] : [])
+];
+const dependsBlock = `\n    depends_on:\n${dependencies.map(([dependency, condition]) => `      ${dependency}:\n        condition: ${condition}`).join("\n")}`;
+const databaseEnvironmentBlock = `\n    environment:\n      MONGODB_URI: "mongodb://mongodb:27017/?replicaSet=rs0&directConnection=true"`;
+const volumeBlock = serviceVolumes.length ? `\n    volumes:\n${serviceVolumes.join("\n")}` : "";
+const workerService = options.worker ? `\n  worker:
+    image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:-latest}
+    env_file:
+      - .env.production
+    command: ["node", "dist/worker.js"]${databaseEnvironmentBlock}${volumeBlock}${dependsBlock}
+    restart: unless-stopped` : "";
+const databaseService = `\n  mongodb:
+    image: mongo:8
+    command: mongod --replSet rs0 --bind_ip_all
+    volumes:
+      - mongodb-data:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+    restart: unless-stopped
+  mongo-init:
+    image: mongo:8
+    depends_on:
+      mongodb:
+        condition: service_healthy
+    restart: "no"
+    entrypoint:
+      - bash
+      - -c
+      - |
+        mongosh --host mongodb --quiet --eval '
+          try {
+            rs.status().ok
+          } catch (error) {
+            rs.initiate({ _id: "rs0", members: [{ _id: 0, host: "localhost:27017" }] })
+          }
+        '`;
+const redisService = options.redis ? `\n  redis:
+    image: redis:7-alpine
+    volumes:
+      - redis-data:/data
+    restart: unless-stopped` : "";
+const namedVolumes = [
+	"  mongodb-data:",
+	...(options.redis ? ["  redis-data:"] : [])
+];
+add(`${svc}/docker-compose.yml`, `name: ${options.name}-prod
+services:
+  ${options.name}:
+    image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:-latest}
+    env_file:
+      - .env.production
+    ports:
+      - "3000:3000"${databaseEnvironmentBlock}${volumeBlock}${dependsBlock}
+    restart: unless-stopped${workerService}${databaseService}${redisService}
+volumes:
+${namedVolumes.join("\n")}
+`);
+
+const devWorker = options.worker ? `\n  worker:
+    build:
+      context: .
+      dockerfile: Dockerfile.dev
+    env_file:
+      - .env.development
+    command: ["npm", "run", "dev:worker"]${databaseEnvironmentBlock}
+    volumes:
+${devVolumes.join("\n")}${dependsBlock}` : "";
+const devDatabase = `\n  mongodb:
+    image: mongo:8
+    command: mongod --replSet rs0 --bind_ip_all
+    ports:
+      - "27017:27017"
+    volumes:
+      - mongodb-dev-data:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+  mongo-init:
+    image: mongo:8
+    depends_on:
+      mongodb:
+        condition: service_healthy
+    restart: "no"
+    entrypoint:
+      - bash
+      - -c
+      - |
+        mongosh --host mongodb --quiet --eval '
+          try {
+            rs.status().ok
+          } catch (error) {
+            rs.initiate({ _id: "rs0", members: [{ _id: 0, host: "localhost:27017" }] })
+          }
+        '`;
+const devRedis = options.redis ? `\n  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-dev-data:/data` : "";
+const devNamedVolumes = [
+	"  mongodb-dev-data:",
+	...(options.redis ? ["  redis-dev-data:"] : [])
+];
+add(`${svc}/docker-compose.dev.yml`, `name: ${options.name}-dev
+services:
+  ${options.name}:
+    build:
+      context: .
+      dockerfile: Dockerfile.dev
+    env_file:
+      - .env.development
+    ports:
+      - "3000:3000"${databaseEnvironmentBlock}
+    volumes:
+${devVolumes.join("\n")}${dependsBlock}${devWorker}${devDatabase}${devRedis}
+volumes:
+${devNamedVolumes.join("\n")}
+`);
+
+for (const [relative, content] of Object.entries(files)) {
+	const destination = path.join(root, relative);
+	fs.mkdirSync(path.dirname(destination), { recursive: true });
+	fs.writeFileSync(destination, content);
+	if (relative.endsWith(".sh")) fs.chmodSync(destination, 0o755);
+}
+
+return { root, name: options.name, database: "mongo", authentication: options.auth, ui: options.ui, redis: options.redis, worker: options.worker, repositories: [svc, ...(options.ui ? [ui] : [])], files: Object.keys(files).length };
+}