@zaaxch/tailframe 2.1.0 → 3.0.0

package/src/new.mjs

@@ -1,6 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { authAppStoreSource, GenerateError } from "./generate.mjs";
+import { configSource } from "./config.mjs";
+import { ownedSources } from "./owned-sources.mjs";
+import { runSync } from "./sync.mjs";
 import {
 	appErrorSource,
 	applicationRoutesSource,
@@ -16,6 +19,7 @@ import {
 	healthSchemasSource,
 	httpErrorsSource,
 	mongoReadinessProbeSource,
+	postgresReadinessProbeSource,
 	readinessProbeSource,
 	redisReadinessProbeSource,
 	redisSource,
@@ -42,13 +46,14 @@ function parseArgs(argv) {
 	const result = { db: "mongo", auth: "none", ui: false, redis: false, worker: false };
 	for (let i = 0; i < argv.length; i += 1) {
 		const arg = argv[i];
-		if (["--name", "--path", "--auth"].includes(arg)) result[arg.slice(2)] = argv[++i];
+		if (["--name", "--path", "--auth", "--db"].includes(arg)) result[arg.slice(2)] = argv[++i];
 		else if (["--ui", "--redis", "--worker"].includes(arg)) result[arg.slice(2)] = true;
 		else fail(`Unknown argument: ${arg}`);
 	}
 	if (!result.name || !/^[a-z][a-z0-9-]*$/.test(result.name)) fail("--name must use lowercase letters, digits, and hyphens and start with a letter");
 	if (!result.path) fail("--path is required");
 	if (!["none", "firebase"].includes(result.auth)) fail("--auth must be none or firebase");
+	if (!["mongo", "postgres"].includes(result.db)) fail("--db must be mongo or postgres");
 	if (result.worker) result.redis = true;
 	return result;
 }
@@ -63,11 +68,22 @@ if (fs.existsSync(root) && fs.readdirSync(root).length) fail(`Refusing to overwr
 const title = options.name.split("-").map((part) => part[0].toUpperCase() + part.slice(1)).join(" ");
 const svc = `${options.name}-svc`;
 const ui = `${options.name}-ui`;
+const databaseName = options.name.replaceAll("-", "_");
+const postgres = options.db === "postgres";
+const mongoApplicationUser = `${options.name}-app`;
+const mongoBackupUser = `${options.name}-backup`;
 const files = {};
 const add = (relative, content) => { files[relative] = content.endsWith("\n") ? content : `${content}\n`; };
 // Generated repositories depend on the published toolkit rather than copying a validator, and they
 // pin the exact contract version they were generated against.
 const contractVersion = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+const serviceProfiles = [
+	...(options.auth === "firebase" ? ["firebase"] : []),
+	options.db,
+	...(options.redis ? ["redis", "rate-limit"] : []),
+	...(options.worker ? ["worker"] : []),
+	...(options.ui ? ["ui-host"] : [])
+];
 const prettierConfig = {
 	useTabs: true,
 	tabWidth: 4,
@@ -166,13 +182,13 @@ Use this workflow for any new domain capability or operation. Add only the layer
 2. Read the root and every applicable child \`AGENTS.md\`.
 3. Inspect the nearest working module and tests.
 4. Create architecture files only with the tailframe CLI: \`tailframe generate\` creates service modules, use cases, http files, ports, adapters, identifiers, integrations, UI modules, and the closed UI shell catalog on canonical paths with canonical names. Service module generation also registers the new use case and mounts or extends its single route factory through deterministic composition-file edits. Hand-creating architecture files or editing generated shell-catalog implementations is a conformance violation; inspect the generated diff and complete only the remaining behavior-specific checklist.
-5. Colocate product capability behavior under \`src/modules/<module>\` in both the service and UI. Never substitute \`features\` or global \`apis\`, \`views\`, \`services\`, \`stores\`, or \`types\` directories. UI \`app/stores\` is closed to generated \`auth.store.ts\` and \`theme.store.ts\`; \`app/public\` is closed to generated \`ThemeToggle.vue\`. Never create \`src/modules/theme\` or \`src/modules/auth\`. Product records, current-user domain records, selections, filters, and workflows stay in their owning module. Start backend modules with \`use-cases/\`, \`http/\`, and tests; add \`domain/\` or \`persistence/\` only when required. Add only the UI module directories earned by the capability.
+5. Colocate product capability behavior under \`src/modules/<module>\` in both the service and UI. Never substitute \`features\` or global \`apis\`, \`views\`, \`services\`, \`stores\`, or \`types\` directories. UI \`app/stores\` is closed to generated \`auth.store.ts\`, \`notification.store.ts\`, and \`theme.store.ts\`; \`app/public\` is closed to generated \`ThemeToggle.vue\`. Never create \`src/modules/theme\`, \`src/modules/auth\`, or \`src/modules/notification\`. Product records, current-user domain records, selections, filters, and workflows stay in their owning module. Start backend modules with \`use-cases/\`, \`http/\`, and tests; add \`domain/\` or \`persistence/\` only when required. Add only the UI module directories earned by the capability.
 6. Define use cases as \`execute(context, input)\`. Keep trusted \`RequestContext\` separate from client input.
 7. Put ownership, RBAC, entitlements, and domain policies in use-case or domain code, not client bodies or route metadata.
 8. Define repository contracts in the owning module and implement them in persistence adapters.
 9. For persisted capabilities, prefer branded, domain-owned string IDs at domain and repository-port boundaries; generate the module's identifier file with \`tailframe generate identifiers <module> <NameId...>\`. Keep MongoDB \`ObjectId\` conversion inside MongoDB persistence adapters, using persistence-only document types rather than \`any\` to bypass the boundary.
 10. Let HTTP routes, jobs, workers, scheduled tasks, and CLIs invoke use cases directly; do not call one entry point from another.
-11. Keep operation names, payloads, authentication, response contracts, and client types synchronized. A service module may import another only through a named file directly under the provider's use-cases directory. A UI module may import another only through a named file directly under the provider's public directory. Both graphs must remain acyclic. UI modules may import only the generated auth/theme app stores and \`ThemeToggle\` from app; every other app path is private.
+11. Keep operation names, payloads, authentication, response contracts, and client types synchronized. A service module may import another only through a named file directly under the provider's use-cases directory. A UI module may import another only through a named file directly under the provider's public directory. Both graphs must remain acyclic. UI modules may import only the generated auth/notification/theme app stores and \`ThemeToggle\` from app; every other app path is private.
 12. Verify generated container and route wiring, then add only dependency construction, client, navigation, worker, or process registration earned by real behavior. Route module views directly from \`app/router.ts\`. App views and shell components consume product modules only through named module \`public/\` entries; they never import module views or other internals.
 13. Run npm run validate:architecture in every affected repository, then run focused type checks and tests. Report repositories, operations, entry points, checks, placement decisions, and gaps.
 
@@ -186,12 +202,13 @@ const svcDeps = {
 	joi: "^17.13.3",
 	"reflect-metadata": "^0.2.2",
 	tsyringe: "^4.9.1",
-	mongodb: "^6.17.0",
+	...(postgres ? { pg: "^8.16.3" } : { mongodb: "^6.17.0" }),
 	...(options.auth === "firebase" ? { "firebase-admin": "^13.0.0" } : {}),
-	...(options.redis ? { redis: "^5.10.0" } : {})
+	...(options.redis ? { "rate-limiter-flexible": "^11.2.0", redis: "^5.10.0" } : {})
 };
 const svcDevDeps = {
 	"@types/cors": "^2.8.17", "@types/express": "^5.0.1", "@types/jest": "^30.0.0", "@types/node": "^22.13.14", "@types/supertest": "^7.2.1",
+	...(postgres ? { "@types/pg": "^8.15.5" } : {}),
 	"@zaaxch/tailframe": contractVersion,
 	jest: "^30.0.0", nodemon: "^3.1.9", prettier: "3.5.3", "ts-jest": "^29.4.11", "ts-node": "^10.9.2",
 	"tsc-alias": "^1.8.16", "tsconfig-paths": "^4.2.0", typescript: "^5.8.2", supertest: "^7.2.2"
@@ -204,13 +221,15 @@ add(`${svc}/package.json`, JSON.stringify({
 		...(options.worker ? { "dev:worker": "nodemon --legacy-watch --exec ts-node -r tsconfig-paths/register src/worker.ts" } : {}),
 		build: "tsc && tsc-alias", start: "node dist/server.js",
 		...(options.worker ? { worker: "node dist/worker.js" } : {}),
-		test: "npm run test:unit && npm run test:integration", "test:unit": "jest --selectProjects unit --runInBand", "test:integration": "jest --selectProjects integration --runInBand", "validate:architecture": "tailframe validate --kind service .", format: "prettier --write src/", "format:check": "prettier --check src/",
+		test: "npm run test:unit && npm run test:integration", "test:unit": "jest --selectProjects unit --runInBand", "test:integration": "jest --selectProjects integration --runInBand", "validate:architecture": "tailframe validate .", "sync:architecture": "tailframe sync --check .", format: "prettier --write src/", "format:check": "prettier --check src/",
+		"schema:apply": "node dist/app/cli/applySchema.js", "schema:apply:dev": "ts-node -r tsconfig-paths/register src/app/cli/applySchema.ts",
 		"test:db:up": "docker compose -f docker-compose.test.yml up -d", "test:db:down": "docker compose -f docker-compose.test.yml down -v",
 		"docker:dev": "docker compose -f docker-compose.dev.yml up",
 		"docker:prod": "docker compose -f docker-compose.yml up -d",
 		"docker:push": "bash scripts/build_and_push.sh"
 	}, dependencies: svcDeps, devDependencies: svcDevDeps
 }, null, "\t"));
+add(`${svc}/tailframe.json`, configSource({ kind: "service", profiles: serviceProfiles, contractVersion }));
 add(`${svc}/tsconfig.json`, JSON.stringify({
 	compilerOptions: { target: "ES2022", module: "commonjs", rootDir: "src", outDir: "dist", strict: true, esModuleInterop: true, experimentalDecorators: true, emitDecoratorMetadata: true, baseUrl: ".", paths: { "@/*": ["src/*"] }, skipLibCheck: true },
 	include: ["src/**/*.ts"]
@@ -222,22 +241,54 @@ module.exports = { projects: [
 ] };`);
 add(`${svc}/.prettierrc.json`, JSON.stringify(prettierConfig, null, "\t"));
 add(`${svc}/.gitattributes`, gitAttributes);
-add(`${svc}/.gitignore`, `node_modules/\ndist/\n.env*\n!.env.example\n*.log\nfirebase-service-account*.json\n`);
+add(`${svc}/.gitignore`, `node_modules/\ndist/\n.env*\n!.env.example\n!.env.infrastructure.example\n*.log\nfirebase-service-account*.json\n`);
 add(`${svc}/.dockerignore`, `node_modules\ndist\n.git\n.env*\n!.env.example\n*.log\ndata\nfirebase-service-account*.json\n`);
 if (options.ui) add(".dockerignore", `**/node_modules\n**/dist\n**/.git\n**/.env*\n**/*.log\n**/data\n**/firebase-service-account*.json\n`);
-const dbEnv = "MONGODB_URI=mongodb://localhost:27017/?replicaSet=rs0&directConnection=true\nMONGODB_DB_NAME=" + options.name.replaceAll("-", "_");
+const dbEnv = postgres
+	? `POSTGRES_URI=postgresql://${options.name}-app:development@localhost:5432/${databaseName}`
+	: "MONGODB_URI=mongodb://localhost:27017/?replicaSet=rs0&directConnection=true\nMONGODB_DB_NAME=" + databaseName;
 add(`${svc}/.env.example`, `NODE_ENV=development\nPORT=3000\nCORS_ORIGIN=https://localhost:5173\n${dbEnv}\n${options.auth === "firebase" ? "FIREBASE_PROJECT_ID=\n" : ""}${options.redis ? "REDIS_URL=redis://localhost:6379\n" : ""}`);
+add(`${svc}/.env.infrastructure.example`, `ECR_IMAGE=<account>.dkr.ecr.<region>.amazonaws.com/${options.name}
+IMAGE_TAG=<service-sha>${options.ui ? "_<ui-sha>" : ""}
+APP_ENV_FILE=/opt/${options.name}/shared/.env.production
+${postgres ? `POSTGRES_DATA_DIR=/opt/${options.name}/shared/postgres/data
+POSTGRES_ROOT_PASSWORD=<uri-safe-random-value>
+POSTGRES_APP_PASSWORD=<different-uri-safe-random-value>
+` : `MONGO_DATA_DIR=/opt/${options.name}/shared/mongo/data
+MONGO_KEYFILE=/opt/${options.name}/shared/mongo/config/keyfile
+MONGO_INIT_SCRIPT=/opt/${options.name}/current/deploy/mongo/10-create-users.js
+MONGODB_ROOT_PASSWORD=<uri-safe-random-value>
+MONGODB_APP_PASSWORD=<different-uri-safe-random-value>
+MONGODB_BACKUP_PASSWORD=<different-uri-safe-random-value>
+`}
+${options.auth === "firebase" ? `SECRETS_DIR=/opt/${options.name}/shared/secrets
+` : ""}${options.redis ? `REDIS_DATA_DIR=/opt/${options.name}/shared/redis/data
+REDIS_PASSWORD=<different-uri-safe-random-value>
+` : ""}`);
 add(`${svc}/src/platform/config/env.ts`, `import "@dotenvx/dotenvx/config";
 export const env = {
 	nodeEnv: process.env.NODE_ENV ?? "development",
 	port: Number(process.env.PORT ?? 3000),
 	corsOrigin: process.env.CORS_ORIGIN ?? "https://localhost:5173",
-	${options.auth === "firebase" ? `firebaseProjectId: process.env.FIREBASE_PROJECT_ID ?? "",` : ""}
-	mongodbUri: process.env.MONGODB_URI ?? "mongodb://localhost:27017/?replicaSet=rs0&directConnection=true",
-	mongodbDbName: process.env.MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}",
+	${options.auth === "firebase" ? `firebaseProjectId: process.env.FIREBASE_PROJECT_ID ?? "",
+	firebaseServiceAccountPath: process.env.FIREBASE_SERVICE_ACCOUNT_PATH,` : ""}
+	${postgres ? `postgresUri: process.env.POSTGRES_URI ?? "postgresql://${options.name}-app:development@localhost:5432/${databaseName}",` : `mongodbUri: process.env.MONGODB_URI ?? "mongodb://localhost:27017/?replicaSet=rs0&directConnection=true",
+	mongodbDbName: process.env.MONGODB_DB_NAME ?? "${databaseName}",`}
 	${options.redis ? `redisUrl: process.env.REDIS_URL ?? "redis://localhost:6379",` : ""}
 };`);
-const databaseSource = `import { MongoClient } from "mongodb";
+const databaseSource = postgres ? `import { Pool } from "pg";
+import { env } from "@/platform/config/env";
+
+export const postgres = new Pool({ connectionString: env.postgresUri });
+
+export async function connectDatabase() {
+	await postgres.query("SELECT 1");
+	return postgres;
+}
+
+export async function closeDatabase() {
+	await postgres.end();
+}` : `import { MongoClient } from "mongodb";
 import { env } from "@/platform/config/env";
 
 export const mongo = new MongoClient(env.mongodbUri);
@@ -251,6 +302,15 @@ export async function closeDatabase() {
 	await mongo.close();
 }`;
 add(`${svc}/src/platform/database/index.ts`, databaseSource);
+add(`${svc}/src/app/schema.ts`, `import type { SchemaLifecycle } from "@/core/SchemaLifecycle";
+import { closeDatabase, connectDatabase } from "@/platform/database";
+
+export const schemaLifecycle: SchemaLifecycle = {
+	async apply() {
+		await connectDatabase();
+	},
+	close: closeDatabase
+};`);
 if (options.redis) add(`${svc}/src/platform/redis/index.ts`, redisSource);
 add(`${svc}/src/core/RequestContext.ts`, requestContextSource);
 add(`${svc}/src/core/UseCase.ts`, useCaseSource);
@@ -267,9 +327,10 @@ add(`${svc}/src/modules/health/use-cases/GetReadiness.ts`, getReadinessSource);
 add(`${svc}/src/modules/health/use-cases/ports/ReadinessProbe.ts`, readinessProbeSource);
 add(`${svc}/src/modules/health/http/health.schemas.ts`, healthSchemasSource);
 add(`${svc}/src/modules/health/http/health.routes.ts`, healthRoutesSource);
-add(`${svc}/src/platform/integrations/mongodb/MongoReadinessProbe.ts`, mongoReadinessProbeSource);
+if (postgres) add(`${svc}/src/platform/integrations/postgres/PostgresReadinessProbe.ts`, postgresReadinessProbeSource);
+else add(`${svc}/src/platform/integrations/mongodb/MongoReadinessProbe.ts`, mongoReadinessProbeSource);
 if (options.redis) add(`${svc}/src/platform/integrations/redis/RedisReadinessProbe.ts`, redisReadinessProbeSource);
-add(`${svc}/src/app/container.ts`, containerSource({ redis: options.redis }));
+add(`${svc}/src/app/container.ts`, containerSource({ database: options.db, redis: options.redis }));
 add(`${svc}/src/app/routes.ts`, applicationRoutesSource);
 add(`${svc}/src/app/server.ts`, serverSource({ ui: options.ui, redis: options.redis, csrf }));
 add(`${svc}/src/server.ts`, `import "reflect-metadata";\nimport { startServer } from "@/app/server";\nvoid startServer();\n`);
@@ -277,13 +338,34 @@ if (options.worker) add(`${svc}/src/app/workers/startWorker.ts`, workerSource())
 if (options.worker) add(`${svc}/src/worker.ts`, `import "reflect-metadata";\nimport { startWorker } from "@/app/workers/startWorker";\nvoid startWorker();\n`);
 add(`${svc}/src/modules/health/__tests__/GetHealth.test.ts`, getHealthTestSource);
 add(`${svc}/src/modules/health/__tests__/GetReadiness.test.ts`, getReadinessTestSource);
-add(`${svc}/src/__tests__/testDb.ts`, `import { MongoClient } from "mongodb";
+add(`${svc}/src/__tests__/testDb.ts`, postgres ? `import { Pool } from "pg";
+const pool = new Pool({ connectionString: process.env.TEST_POSTGRES_URI ?? "postgresql://postgres:postgres@localhost:5433/${databaseName}_test" });
+export async function openTestDatabase() { await pool.query("SELECT 1"); return pool; }
+export async function resetTestDatabase() { await pool.query("DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public"); return pool; }
+export async function closeTestDatabase() { await pool.end(); }
+` : `import { MongoClient } from "mongodb";
 const client = new MongoClient(process.env.TEST_MONGODB_URI ?? "mongodb://localhost:27018/?replicaSet=rs0&directConnection=true");
 export async function openTestDatabase() { await client.connect(); return client.db(process.env.TEST_MONGODB_DB_NAME ?? "${options.name.replaceAll("-", "_")}_test"); }
 export async function resetTestDatabase() { const database = await openTestDatabase(); await database.dropDatabase(); return database; }
 export async function closeTestDatabase() { await client.close(); }
 `);
-add(`${svc}/docker-compose.test.yml`, `name: ${options.name}-test
+add(`${svc}/docker-compose.test.yml`, postgres ? `name: ${options.name}-test
+services:
+  postgres:
+    image: postgres:17
+    ports:
+      - "5433:5432"
+    environment:
+      POSTGRES_DB: ${databaseName}_test
+      POSTGRES_PASSWORD: postgres
+    tmpfs:
+      - /var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d ${databaseName}_test"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+` : `name: ${options.name}-test
 services:
   mongo:
     image: mongo:8
@@ -444,10 +526,14 @@ This service uses MongoDB. Module-owned MongoDB adapters own collection access,
 - Keep optional entry-point assembly under \`src/app/<entry-point-kind>\`; root files such as \`src/server.ts\` and \`src/worker.ts\` may only bootstrap that assembly.
 - Initialize infrastructure first, then call \`registerDependencies(...)\` from every process entry point. The composition root resets the container, explicitly constructs dependencies, and registers class-token instances. Keep tsyringe, injection tokens, decorators, and container resolution out of modules and platform adapters.
 - Register routes, workers, and jobs explicitly. Shutdown paths are awaitable and close resources without forcing \`process.exit\`.
+- Scheduled work prevents unintended overlap, stops intake before shutdown, awaits the active run, destroys its scheduler or consumer, and only then closes Redis and database clients.
 ${options.ui ? "- In production, serve the compiled UI from `dist/public` with a non-API SPA fallback. Never return the SPA for `/api` requests." : ""}
 
 ## Production image
-The ECR build targets \`linux/amd64\`. ${options.ui ? "Its default immutable tag is `<service-sha>_<ui-sha>` and production Compose requires that exact tag." : "Its default immutable tag is `<service-sha>` and production Compose requires that exact tag."}${options.ui && options.auth === "firebase" ? ` The build requires \`${ui}/.env.production\` and mounts it as a BuildKit secret only while Vite compiles the browser bundle; it is not copied into the final image.` : ""}
+The ECR build targets \`linux/amd64\`. ${options.ui ? "Its default immutable tag is `<service-sha>_<ui-sha>` and production Compose requires that exact tag." : "Its default immutable tag is `<service-sha>` and production Compose requires that exact tag."} The runtime image contains production dependencies only and runs as the Node user.${options.ui && options.auth === "firebase" ? ` The build requires \`${ui}/.env.production\` and mounts it as a BuildKit secret only while Vite compiles the browser bundle; it is not copied into the final image.` : ""}
+
+## Production deployment
+Only service \`main\` pushes or manual workflow dispatch deploy; UI pushes never trigger deployment. GitHub Actions may replace files under \`/opt/${options.name}/current\` and MUST NOT replace persistent configuration, credentials, keyfiles, or data under \`/opt/${options.name}/shared\`. Keep Node runtime behavior in the shared service \`.env.production\`, Compose interpolation and infrastructure credentials in \`.env.infrastructure\`, and fixed topology wiring in Compose \`environment:\`. The optional UI build-time \`.env.production\` is a separate ephemeral file. Do not run deployment until the host and GitHub production environment have been bootstrapped according to \`docs/production-deployment.md\`.
 
 ## Tests and validation
 Run \`npm run validate:architecture\` and \`npm run format:check\` after changing files or imports. The generated service also includes unit tests and Mongo-backed integration tests. Run \`npm run test:db:up\`, \`npm test\`, and \`npm run test:db:down\` for the full service check. Test use cases, policies, Mongo repository adapters, and HTTP boundaries where behavior lives. Every public operation needs success and error-envelope coverage; authenticated operations need trusted-identity coverage; persisted capabilities need Mongo ownership/query coverage; UI-enabled services must verify that \`/api\` paths never fall through to the SPA. All AWS/ECR and Docker commands, including \`npm run docker:push\`, must run outside the sandbox from the first attempt.
@@ -456,7 +542,12 @@ Run \`npm run validate:architecture\` and \`npm run format:check\` after changin
 if (options.ui) {
 const uiDeps = { "@tailwindcss/vite": "^4.1.18", "@vueuse/core": "^14.3.0", axios: "^1.9.0", pinia: "^3.0.1", primevue: "^4.2.5", vue: "^3.5.13", "vue-router": "^4.5.0", ...(options.auth === "firebase" ? { firebase: "^11.0.0" } : {}) };
 const uiDevDeps = { "@tsconfig/node22": "^22.0.1", "@zaaxch/tailframe": contractVersion, "@types/node": "^22.13.14", "@vitejs/plugin-vue": "^5.2.3", "@vue/test-utils": "^2.4.10", "@vue/tsconfig": "^0.7.0", jsdom: "^29.1.1", "npm-run-all2": "^7.0.2", prettier: "3.5.3", typescript: "~5.8.0", vite: "^6.2.4", vitest: "^4.1.7", "vue-tsc": "^2.2.8" };
-add(`${ui}/package.json`, JSON.stringify({ name: ui, version: "0.1.0", private: true, type: "module", scripts: { dev: "vite --host 0.0.0.0", build: "run-p type-check \"build-only {@}\" --", "build-only": "vite build", "type-check": "vue-tsc --build", test: "vitest run", "test:watch": "vitest", "validate:architecture": "tailframe validate --kind ui .", format: "prettier --write src/", "format:check": "prettier --check src/" }, dependencies: uiDeps, devDependencies: uiDevDeps }, null, "\t"));
+add(`${ui}/package.json`, JSON.stringify({ name: ui, version: "0.1.0", private: true, type: "module", scripts: { dev: "vite --host 0.0.0.0", build: "run-p type-check \"build-only {@}\" --", "build-only": "vite build", "type-check": "vue-tsc --build", test: "vitest run", "test:watch": "vitest", "validate:architecture": "tailframe validate .", "sync:architecture": "tailframe sync --check .", format: "prettier --write src/", "format:check": "prettier --check src/" }, dependencies: uiDeps, devDependencies: uiDevDeps }, null, "\t"));
+add(`${ui}/tailframe.json`, configSource({
+	kind: "ui",
+	profiles: [...(options.auth === "firebase" ? ["firebase"] : []), "notifications"],
+	contractVersion
+}));
 add(`${ui}/.prettierrc.json`, JSON.stringify(prettierConfig, null, "\t"));
 add(`${ui}/.gitattributes`, gitAttributes);
 add(`${ui}/tsconfig.json`, JSON.stringify({ files: [], references: [{ path: "./tsconfig.app.json" }, { path: "./tsconfig.node.json" }] }, null, "\t"));
@@ -495,6 +586,7 @@ export default createRouter({
 });`);
 add(`${ui}/src/platform/http.ts`, uiHttpSource);
 if (options.auth === "firebase") add(`${ui}/src/app/configureHttp.ts`, configureHttpSource);
+add(`${ui}/src/platform/config.ts`, `export const apiBaseUrl = \`\${window.location.origin}/api/v1\`;`);
 add(`${ui}/src/modules/health/api/health.api.ts`, healthApiSource);
 add(`${ui}/src/modules/health/views/HealthView.vue`, `<script setup lang="ts">
 import { ref } from "vue";
@@ -536,23 +628,31 @@ async function checkReadiness() {
 		<p v-if="error" role="alert">{{ error }}</p>
 	</main>
 </template>`);
-add(`${ui}/src/app/App.vue`, `<template><RouterView /></template><script setup lang="ts">import { RouterView } from "vue-router";</script>`);
+add(`${ui}/src/app/App.vue`, `<template>
+	<RouterView />
+	<NotificationHost />
+</template>
+
+<script setup lang="ts">
+import { RouterView } from "vue-router";
+import NotificationHost from "@/app/components/NotificationHost.vue";
+</script>`);
 add(`${ui}/src/app/startApplication.ts`, `import { createApp } from "vue";\nimport { createPinia } from "pinia";\nimport PrimeVue from "primevue/config";\nimport App from "@/app/App.vue";\n${options.auth === "firebase" ? 'import { configureHttp } from "@/app/configureHttp";\n' : ""}import router from "@/app/router";\nimport "@/app/styles.css";\nexport function startApplication() {\n\tconst app = createApp(App);\n\tconst pinia = createPinia();\n\tapp.use(pinia).use(PrimeVue).use(router);\n\t${options.auth === "firebase" ? "configureHttp(pinia);\n\t" : ""}app.mount("#app");\n}\n`);
 add(`${ui}/src/main.ts`, `import { startApplication } from "@/app/startApplication";\nstartApplication();\n`);
 add(`${ui}/src/app/styles.css`, `@import "tailwindcss";\n:root { font-family: Inter, ui-sans-serif, system-ui; color: #17221c; background: #f5f3ec; }\nbody { margin: 0; }`);
-add(`${ui}/src/app/__tests__/App.spec.ts`, `import { mount } from "@vue/test-utils";\nimport App from "@/app/App.vue";\ndescribe("App", () => { it("renders a router view", () => { expect(mount(App, { global: { stubs: ["RouterView"] } }).exists()).toBe(true); }); });`);
+add(`${ui}/src/app/__tests__/App.spec.ts`, `import { mount } from "@vue/test-utils";\nimport App from "@/app/App.vue";\ndescribe("App", () => { it("renders a router view", () => { expect(mount(App, { global: { stubs: ["RouterView", "NotificationHost"] } }).exists()).toBe(true); }); });`);
 add(`${ui}/AGENTS.md`, `# ${title} UI guidance
 
 ## Scope
 These conventions apply to \`${ui}/src\`. Inspect the nearest working module before adding files.
 
 ## Architecture vocabulary
-- Use \`src/app\` for Vue bootstrap, the application shell, routing, global styles, and the closed Tailframe auth/theme catalog.
+- Use \`src/app\` for Vue bootstrap, the application shell, routing, global styles, and the closed Tailframe auth/notification/theme catalog.
 - Use \`src/core\` only for small technology-neutral client contracts.
 - Use \`src/platform\` for Axios, Firebase, browser APIs, and other technical adapters.
 - Use \`src/modules/<module>\` for every product capability. Never substitute \`src/features\` or global \`apis\`, \`views\`, \`services\`, \`stores\`, or \`types\` directories.
-- These are the only UI architecture roots. Keep \`src/core\` flat. Shared capability code belongs to the module that owns it. \`src/app/stores\` is closed to generated \`auth.store.ts\` and \`theme.store.ts\`; \`src/app/public\` is closed to generated \`ThemeToggle.vue\`. Do not edit their implementations; only the generated theme storage key varies. Internal shell components remain private under \`src/app/components\`.
-- Never create \`src/modules/theme\` or \`src/modules/auth\`. Product records, current-user domain records, selections, filters, workflows, and module API calls always belong to the owning product module.
+- These are the only UI architecture roots. Keep \`src/core\` flat. Shared capability code belongs to the module that owns it. \`src/app/stores\` is closed to generated \`auth.store.ts\`, \`notification.store.ts\`, and \`theme.store.ts\`; \`src/app/public\` is closed to generated \`ThemeToggle.vue\`. Do not edit their implementations; only the generated theme storage key varies. Internal shell components remain private under \`src/app/components\`.
+- Never create \`src/modules/theme\`, \`src/modules/auth\`, or \`src/modules/notification\`. Product records, current-user domain records, selections, filters, workflows, and module API calls always belong to the owning product module.
 
 ## Change placement
 | Change | Canonical owner |
@@ -560,14 +660,14 @@ These conventions apply to \`${ui}/src\`. Inspect the nearest working module bef
 | Capability API, component, composable, state, type, or view | \`src/modules/<module>\` |
 | Capability intentionally consumed by another module | Named file directly under provider \`src/modules/<module>/public\` |
 | Axios, Firebase, browser, or vendor mechanism | \`src/platform\` |
-| Firebase identity/readiness or theme preference | Generated \`src/app/stores/auth.store.ts\` or \`theme.store.ts\` |
+| Firebase identity/readiness, notification queue, or theme preference | Generated \`src/app/stores/auth.store.ts\`, \`notification.store.ts\`, or \`theme.store.ts\` |
 | Canonical theme control consumed by modules | Generated \`src/app/public/ThemeToggle.vue\` |
 | Any other state or reusable presentation | Owning \`src/modules/<module>\` |
 | Shell, router, global styles, or cross-capability composition | \`src/app\` |
 | Technology-neutral client contract | Flat \`src/core\` |
 | Root executable | Bootstrap of \`src/app\` only |
 
-UI modules may import a sibling only through a named file directly under the provider's \`public/\` directory; keep the graph acyclic. From app, modules may import only generated \`auth.store.ts\`, \`theme.store.ts\`, and \`ThemeToggle.vue\`; every other app path is private. App views and shell components consume modules only through named module \`public/\` entries; route module views directly from \`app/router.ts\`. Use \`@/\` or relative internal imports; do not add another source alias. Platform imports neither app nor modules.
+UI modules may import a sibling only through a named file directly under the provider's \`public/\` directory; keep the graph acyclic. From app, modules may import only generated \`auth.store.ts\`, \`notification.store.ts\`, \`theme.store.ts\`, and \`ThemeToggle.vue\`; every other app path is private. App views and shell components consume modules only through named module \`public/\` entries; route module views directly from \`app/router.ts\`. Use \`@/\` or relative internal imports; do not add another source alias. Platform imports neither app nor modules.
 
 ## Module shape
 Under \`src/modules/<module>\`, add only needed \`api/\`, \`components/\`, \`composables/\`, \`public/\`, \`routes/\`, \`stores/\`, \`types/\`, \`views/\`, and \`__tests__/\` directories. Public entries are named direct files, never nested directories or barrels. Do not invent alternative layer names or generate speculative CRUD. Create module and public shell files only with \`tailframe generate\`.
@@ -582,7 +682,7 @@ Use named routes.${options.auth === "firebase" ? " Preserve Firebase authenticat
 
 ## State management
 Keep local state local. Use Pinia only for state shared across routes or unrelated components.
-Keep all product state in the owning module. The auth/theme stores and ThemeToggle are Tailframe-owned generated sources shared byte-for-byte across projects apart from the explicit theme storage key.
+Keep all product state in the owning module. The auth/notification/theme stores, NotificationHost, and ThemeToggle are Tailframe-owned generated sources shared byte-for-byte across projects apart from the explicit theme storage key.
 
 ## UI behavior
 Reuse Vue, PrimeVue, Tailwind, loading, error, and accessibility conventions. Provide explicit loading, empty, error, and authorization states.
@@ -610,6 +710,11 @@ RUN npm ci
 COPY ${svc}/ ./
 RUN npm run build
 
+FROM node:22.13-bookworm AS service-production-dependencies
+WORKDIR /app/service
+COPY ${svc}/package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
 FROM node:22.13-bookworm AS ui-build
 WORKDIR /app/ui
 COPY ${ui}/package*.json ./
@@ -622,8 +727,9 @@ WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=service-build /app/service/dist ./dist
 COPY --from=service-build /app/service/package*.json ./
-COPY --from=service-build /app/service/node_modules ./node_modules
+COPY --from=service-production-dependencies /app/service/node_modules ./node_modules
 COPY --from=ui-build /app/ui/dist ./dist/public
+USER node
 EXPOSE 3000
 CMD ["node", "dist/server.js"]
 ` : `FROM node:22.13-bookworm AS build
@@ -633,12 +739,18 @@ RUN npm ci
 COPY . .
 RUN npm run build
 
+FROM node:22.13-bookworm AS production-dependencies
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
 FROM node:22.13-bookworm-slim
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=build /app/dist ./dist
 COPY --from=build /app/package*.json ./
-COPY --from=build /app/node_modules ./node_modules
+COPY --from=production-dependencies /app/node_modules ./node_modules
+USER node
 EXPOSE 3000
 CMD ["node", "dist/server.js"]
 `);
@@ -678,75 +790,443 @@ docker push "\${IMAGE}"
 echo "Pushed \${IMAGE}"
 `);
 
+const workflowUiCheckout = options.ui ? `
+      - name: Checkout UI dependency
+        uses: actions/checkout@v6
+        with:
+          repository: \${{ github.repository_owner }}/${ui}
+          ref: main
+          ssh-key: \${{ secrets.UI_REPO_SSH_KEY }}
+          path: ${ui}
+` : "";
+const workflowUiEnvironment = options.ui && options.auth === "firebase" ? `
+      - name: Write UI production environment
+        env:
+          UI_ENV_PRODUCTION: \${{ secrets.UI_ENV_PRODUCTION }}
+        run: |
+          printf '%s\\n' "$UI_ENV_PRODUCTION" > ${ui}/.env.production
+` : "";
+const workflowTagResolution = options.ui ? `
+          ui_sha="$(git -C ${ui} rev-parse --short HEAD)"
+          echo "tag=\${svc_sha}_\${ui_sha}" >> "$GITHUB_OUTPUT"` : `
+          echo "tag=\${svc_sha}" >> "$GITHUB_OUTPUT"`;
+add(`${svc}/.github/workflows/deploy.yml`, `name: Build and deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: ${options.name}-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy production
+    if: \${{ vars.DEPLOY_HOST != '' && vars.DEPLOY_USER != '' }}
+    runs-on: ubuntu-latest
+    environment: production
+    env:
+      AWS_ACCOUNT_ID: \${{ vars.AWS_ACCOUNT_ID }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      ECR_REPOSITORY: \${{ vars.ECR_REPOSITORY || '${options.name}' }}
+      DEPLOY_HOST: \${{ vars.DEPLOY_HOST }}
+      DEPLOY_USER: \${{ vars.DEPLOY_USER }}
+
+    steps:
+      - name: Checkout service
+        uses: actions/checkout@v6
+        with:
+          path: ${svc}
+${workflowUiCheckout}${workflowUiEnvironment}
+      - name: Resolve immutable image
+        id: image
+        run: |
+          svc_sha="$(git -C ${svc} rev-parse --short HEAD)"${workflowTagResolution}
+          echo "registry=\${AWS_ACCOUNT_ID}.dkr.ecr.\${AWS_REGION}.amazonaws.com" >> "$GITHUB_OUTPUT"
+          echo "image=\${AWS_ACCOUNT_ID}.dkr.ecr.\${AWS_REGION}.amazonaws.com/\${ECR_REPOSITORY}" >> "$GITHUB_OUTPUT"
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: \${{ vars.AWS_ROLE_ARN }}
+          aws-region: \${{ vars.AWS_REGION }}
+
+      - name: Build and push image
+        working-directory: ${svc}
+        env:
+          IMAGE_TAG: \${{ steps.image.outputs.tag }}
+        run: ./scripts/build_and_push.sh
+
+      - name: Configure deployment SSH
+        env:
+          DEPLOY_SSH_PRIVATE_KEY: \${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          DEPLOY_SSH_KNOWN_HOSTS: \${{ secrets.DEPLOY_SSH_KNOWN_HOSTS }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\\n' "$DEPLOY_SSH_PRIVATE_KEY" > ~/.ssh/${options.name}-deploy
+          chmod 600 ~/.ssh/${options.name}-deploy
+          printf '%s\\n' "$DEPLOY_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
+
+      - name: Authenticate server with ECR
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" |
+            ssh -i ~/.ssh/${options.name}-deploy "\${DEPLOY_USER}@\${DEPLOY_HOST}" \\
+              "docker login --username AWS --password-stdin '\${{ steps.image.outputs.registry }}'"
+
+      - name: Install deployment files
+        run: |
+          ssh -i ~/.ssh/${options.name}-deploy "\${DEPLOY_USER}@\${DEPLOY_HOST}" \\
+            "install -m 755 -d /opt/${options.name}/current/deploy/mongo"
+          scp -i ~/.ssh/${options.name}-deploy \\
+            ${svc}/docker-compose.yml \\
+            ${svc}/scripts/deploy_remote.sh \\
+            "\${DEPLOY_USER}@\${DEPLOY_HOST}:/opt/${options.name}/current/"
+          scp -i ~/.ssh/${options.name}-deploy \\
+            ${svc}/deploy/mongo/10-create-users.js \\
+            "\${DEPLOY_USER}@\${DEPLOY_HOST}:/opt/${options.name}/current/deploy/mongo/"
+          ssh -i ~/.ssh/${options.name}-deploy "\${DEPLOY_USER}@\${DEPLOY_HOST}" \\
+            "chmod 755 /opt/${options.name}/current/deploy_remote.sh"
+
+      - name: Deploy image
+        run: |
+          ssh -i ~/.ssh/${options.name}-deploy "\${DEPLOY_USER}@\${DEPLOY_HOST}" \\
+            "/opt/${options.name}/current/deploy_remote.sh '\${{ steps.image.outputs.tag }}' '\${{ steps.image.outputs.image }}'"
+`);
+
+add(`${svc}/scripts/deploy_remote.sh`, `#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_TAG="\${1:?Usage: deploy_remote.sh IMAGE_TAG ECR_IMAGE}"
+ECR_IMAGE="\${2:?Usage: deploy_remote.sh IMAGE_TAG ECR_IMAGE}"
+DEPLOY_DIR="\${DEPLOY_DIR:-/opt/${options.name}/current}"
+SHARED_DIR="\${SHARED_DIR:-/opt/${options.name}/shared}"
+COMPOSE_FILE="\${DEPLOY_DIR}/docker-compose.yml"
+INFRA_ENV="\${SHARED_DIR}/.env.infrastructure"
+
+if [[ ! -f "\${INFRA_ENV}" ]]; then
+	echo "Missing provisioned infrastructure environment: \${INFRA_ENV}" >&2
+	exit 1
+fi
+
+NEXT_ENV="$(mktemp "\${SHARED_DIR}/.env.infrastructure.XXXXXX")"
+cleanup() {
+	rm -f "\${NEXT_ENV}"
+}
+trap cleanup EXIT
+
+grep -Ev '^(ECR_IMAGE|IMAGE_TAG)=' "\${INFRA_ENV}" > "\${NEXT_ENV}" || true
+printf 'ECR_IMAGE=%s\\nIMAGE_TAG=%s\\n' "\${ECR_IMAGE}" "\${IMAGE_TAG}" >> "\${NEXT_ENV}"
+chmod 600 "\${NEXT_ENV}"
+mv "\${NEXT_ENV}" "\${INFRA_ENV}"
+trap - EXIT
+
+docker compose --env-file "\${INFRA_ENV}" --file "\${COMPOSE_FILE}" config --quiet
+docker compose --env-file "\${INFRA_ENV}" --file "\${COMPOSE_FILE}" pull
+docker compose --env-file "\${INFRA_ENV}" --file "\${COMPOSE_FILE}" up -d --wait
+`);
+
+if (postgres) add(`${svc}/deploy/postgres/10-create-application-user.sh`, `#!/usr/bin/env bash
+set -euo pipefail
+
+psql --set ON_ERROR_STOP=1 --username postgres --dbname "${databaseName}" --set app_password="\${POSTGRES_APP_PASSWORD}" <<'SQL'
+SELECT 'CREATE ROLE "${options.name}-app" LOGIN PASSWORD ' || quote_literal(:'app_password')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${options.name}-app')\gexec
+GRANT CONNECT ON DATABASE "${databaseName}" TO "${options.name}-app";
+GRANT USAGE ON SCHEMA public TO "${options.name}-app";
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "${options.name}-app";
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO "${options.name}-app";
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "${options.name}-app";
+ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO "${options.name}-app";
+SQL
+`);
+
+add(`${svc}/docs/production-deployment.md`, `# Production deployment
+
+## Delivery model
+
+GitHub Actions checks out ${svc}${options.ui ? ` and ${ui}` : ""}${options.ui ? " as sibling build inputs" : ""}, builds one
+non-root production image, tags it ${options.ui ? "`<service-sha>_<ui-sha>`" : "`<service-sha>`"}, pushes it to ECR, and installs only deployment artifacts on the host.
+Only service \`main\` pushes and manual dispatch trigger this workflow; UI pushes never deploy.
+
+The host separates replaceable artifacts from persistent state:
+
+\`\`\`text
+/opt/${options.name}/
+├── current/
+│   ├── docker-compose.yml
+│   ├── deploy_remote.sh
+│   └── deploy/mongo/10-create-users.js
+└── shared/
+    ├── .env.production
+    ├── .env.infrastructure
+${options.auth === "firebase" ? `    ├── secrets/firebase-service-account.json
+` : ""}    ├── mongo/config/keyfile
+    ├── mongo/data/
+${options.redis ? `    └── redis/data/
+` : ""}\`\`\`
+
+Actions may replace \`current/\` and must never replace \`shared/\`. The server never needs a source checkout.
+
+## Configuration ownership
+
+- \`.env.production\` contains Node application behavior and provider credentials.
+- \`.env.infrastructure\` contains Compose paths, image identity, and infrastructure passwords. Start from
+  \`.env.infrastructure.example\` and replace every placeholder.
+- Compose \`environment:\` owns fixed production wiring: \`NODE_ENV\`, internal database/cache URLs, and mounted
+  credential paths.
+${options.ui && options.auth === "firebase" ? `- The UI repository's build-time \`.env.production\` comes from the GitHub \`UI_ENV_PRODUCTION\` secret and is unrelated to the service runtime file above.
+` : ""}
+Do not inject \`.env.infrastructure\` into Node. Make both host environment files root-owned and mode \`0600\`.
+
+## One-time host bootstrap
+
+1. Install Docker Engine and Docker Compose.
+2. Create \`/opt/${options.name}/current/deploy/mongo\`, \`/opt/${options.name}/shared/mongo/config\`, and
+   \`/opt/${options.name}/shared/mongo/data\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.
+3. Install \`.env.production\` and a completed \`.env.infrastructure\` under \`shared/\`.
+4. Generate the MongoDB replica key with \`openssl rand -base64 756\`, make it owned by UID/GID \`999:999\`, and
+   mode \`0400\`.
+${options.auth === "firebase" ? `5. Install the Firebase service account at \`shared/secrets/firebase-service-account.json\`, owned by \`root:1000\` and mode \`0640\`.
+6. ` : "5. "}Give the deployment user Docker access and write access to \`current/\`; keep \`shared/\` and its files protected.
+${options.auth === "firebase" ? "7" : "6"}. Authorize the dedicated deployment SSH key and record the host key for GitHub Actions.
+
+Use a fresh Mongo data directory. Migrating an existing unauthenticated database requires a separately reviewed plan.
+
+## GitHub production environment
+
+Configure these variables:
+
+- \`AWS_ACCOUNT_ID\`, \`AWS_REGION\`, and \`AWS_ROLE_ARN\` for the repository-restricted OIDC role.
+- \`DEPLOY_HOST\` and \`DEPLOY_USER\`; the deployment job remains skipped until both exist.
+- Optional \`ECR_REPOSITORY\`; the default is \`${options.name}\`.
+
+Configure these secrets:
+
+${options.ui ? `- \`UI_REPO_SSH_KEY\`: read-only deploy key for \`${ui}\`.
+` : ""}${options.ui && options.auth === "firebase" ? `- \`UI_ENV_PRODUCTION\`: Vite/Firebase build-time environment.
+` : ""}- \`DEPLOY_SSH_PRIVATE_KEY\`: dedicated host deployment key.
+- \`DEPLOY_SSH_KNOWN_HOSTS\`: pinned host key.
+
+The ECR repository and AWS OIDC provider/role are provisioned separately. The workflow never stores long-lived AWS
+keys or creates cloud infrastructure.
+
+## Deploy and rollback
+
+The remote script requires the provisioned infrastructure file, atomically replaces only \`ECR_IMAGE\` and
+\`IMAGE_TAG\`, validates Compose, pulls, and starts with health waiting. Roll back by selecting a previous immutable
+tag and running the same script. Never use \`docker compose down -v\` in production; image rollback does not restore
+database state.
+
+MongoDB and optional Redis expose no host ports and require authentication. Verify API readiness, container health,
+database/cache authentication, file permissions, and off-host backup/restore before treating the deployment as
+production-ready. Product-specific TLS, capacity limits, migrations, and scheduled-work grace periods must be added
+from measured application requirements rather than copied from another product.
+`);
+
 const serviceVolumes = [
-	...(options.auth === "firebase" ? ["      - ./firebase-service-account.production.json:/app/firebase-service-account.production.json:ro"] : [])
+	...(options.auth === "firebase" ? ["      - ${SECRETS_DIR:?Set SECRETS_DIR}/firebase-service-account.json:/app/secrets/firebase-service-account.json:ro"] : [])
 ];
 const devVolumes = [
 	"      - .:/app",
 	"      - /app/node_modules",
 	...(options.auth === "firebase" ? ["      - ./firebase-service-account.development.json:/app/firebase-service-account.development.json:ro"] : [])
 ];
-const dependencies = [
-	["mongo-init", "service_completed_successfully"],
+const productionDependencies = [
+	["schema-init", "service_completed_successfully"],
+	...(options.redis ? [["redis", "service_healthy"]] : [])
+];
+const developmentDependencies = [
+	["schema-init", "service_completed_successfully"],
 	...(options.redis ? [["redis", "service_started"]] : [])
 ];
-const dependsBlock = `\n    depends_on:\n${dependencies.map(([dependency, condition]) => `      ${dependency}:\n        condition: ${condition}`).join("\n")}`;
-const databaseEnvironmentBlock = `\n    environment:\n      MONGODB_URI: "mongodb://mongodb:27017/?replicaSet=rs0&directConnection=true"`;
+const dependsBlock = `\n    depends_on:\n${productionDependencies.map(([dependency, condition]) => `      ${dependency}:\n        condition: ${condition}`).join("\n")}`;
+const devDependsBlock = `\n    depends_on:\n${developmentDependencies.map(([dependency, condition]) => `      ${dependency}:\n        condition: ${condition}`).join("\n")}`;
+const productionEnvironment = [
+	"      NODE_ENV: production",
+	...(postgres
+		? [`      POSTGRES_URI: "postgresql://${options.name}-app:\${POSTGRES_APP_PASSWORD:?Set POSTGRES_APP_PASSWORD}@postgres:5432/${databaseName}"`]
+		: [
+			`      MONGODB_URI: "mongodb://${mongoApplicationUser}:\${MONGODB_APP_PASSWORD:?Set MONGODB_APP_PASSWORD}@mongodb:27017/${databaseName}?replicaSet=rs0&directConnection=true&authSource=${databaseName}"`,
+			`      MONGODB_DB_NAME: "${databaseName}"`
+		]),
+	...(options.auth === "firebase" ? ["      GOOGLE_APPLICATION_CREDENTIALS: /app/secrets/firebase-service-account.json"] : []),
+	...(options.redis ? ["      REDIS_URL: \"redis://:\${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379\""] : [])
+];
+const productionEnvironmentBlock = `\n    environment:\n${productionEnvironment.join("\n")}`;
+const databaseEnvironmentBlock = postgres
+	? `\n    environment:\n      POSTGRES_URI: "postgresql://${options.name}-app:development@postgres:5432/${databaseName}"`
+	: `\n    environment:\n      MONGODB_URI: "mongodb://mongodb:27017/?replicaSet=rs0&directConnection=true"`;
 const volumeBlock = serviceVolumes.length ? `\n    volumes:\n${serviceVolumes.join("\n")}` : "";
 const workerService = options.worker ? `\n  worker:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
-      - .env.production
-    command: ["node", "dist/worker.js"]${databaseEnvironmentBlock}${volumeBlock}${dependsBlock}
+      - \${APP_ENV_FILE:-.env.production}
+    command: ["node", "dist/worker.js"]${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
+    healthcheck:
+      test: ["CMD", "node", "-e", "process.kill(1, 0)"]
+      interval: 60s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    stop_grace_period: 2m
+    networks:
+      - backend
     restart: unless-stopped` : "";
-const databaseService = `\n  mongodb:
+const databaseService = postgres ? `\n  postgres:
+    image: postgres:17
+    environment:
+      POSTGRES_DB: "${databaseName}"
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: \${POSTGRES_ROOT_PASSWORD:?Set POSTGRES_ROOT_PASSWORD}
+      POSTGRES_APP_PASSWORD: \${POSTGRES_APP_PASSWORD:?Set POSTGRES_APP_PASSWORD}
+    volumes:
+      - \${POSTGRES_DATA_DIR:?Set POSTGRES_DATA_DIR}:/var/lib/postgresql/data
+      - ./deploy/postgres/10-create-application-user.sh:/docker-entrypoint-initdb.d/10-create-application-user.sh:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d ${databaseName}"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 20s
+    networks:
+      - backend
+    restart: unless-stopped` : `\n  mongodb:
     image: mongo:8
-    command: mongod --replSet rs0 --bind_ip_all
+    command:
+      - mongod
+      - --replSet
+      - rs0
+      - --bind_ip_all
+      - --keyFile
+      - /etc/mongo-keyfile/keyfile
+    environment:
+      MONGO_INITDB_DATABASE: "${databaseName}"
+      MONGO_INITDB_ROOT_USERNAME: "${options.name}-root"
+      MONGO_INITDB_ROOT_PASSWORD: \${MONGODB_ROOT_PASSWORD:?Set MONGODB_ROOT_PASSWORD}
+      MONGODB_DB_NAME: "${databaseName}"
+      MONGODB_APP_USERNAME: "${mongoApplicationUser}"
+      MONGODB_APP_PASSWORD: \${MONGODB_APP_PASSWORD:?Set MONGODB_APP_PASSWORD}
+      MONGODB_BACKUP_USERNAME: "${mongoBackupUser}"
+      MONGODB_BACKUP_PASSWORD: \${MONGODB_BACKUP_PASSWORD:?Set MONGODB_BACKUP_PASSWORD}
+      MONGODB_APP_COLLECTIONS: "_tailframe_reserved"
     volumes:
-      - mongodb-data:/data/db
+      - \${MONGO_DATA_DIR:?Set MONGO_DATA_DIR}:/data/db
+      - \${MONGO_KEYFILE:?Set MONGO_KEYFILE}:/etc/mongo-keyfile/keyfile:ro
+      - \${MONGO_INIT_SCRIPT:?Set MONGO_INIT_SCRIPT}:/docker-entrypoint-initdb.d/10-create-users.js:ro
     healthcheck:
-      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-      interval: 2s
-      timeout: 2s
+      test:
+        - CMD-SHELL
+        - >-
+          mongosh --quiet --host localhost
+          --username "$\${MONGO_INITDB_ROOT_USERNAME}"
+          --password "$\${MONGO_INITDB_ROOT_PASSWORD}"
+          --authenticationDatabase admin
+          --eval "quit(db.adminCommand({ping:1}).ok ? 0 : 1)"
+      interval: 5s
+      timeout: 5s
       retries: 30
+      start_period: 20s
+    networks:
+      - backend
     restart: unless-stopped
   mongo-init:
     image: mongo:8
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: "${options.name}-root"
+      MONGO_INITDB_ROOT_PASSWORD: \${MONGODB_ROOT_PASSWORD:?Set MONGODB_ROOT_PASSWORD}
     depends_on:
       mongodb:
         condition: service_healthy
     restart: "no"
-    entrypoint:
-      - bash
-      - -c
-      - |
-        mongosh --host mongodb --quiet --eval '
-          try {
-            rs.status().ok
-          } catch (error) {
-            rs.initiate({ _id: "rs0", members: [{ _id: 0, host: "localhost:27017" }] })
+    entrypoint: ["bash", "-ec"]
+    command:
+      - >-
+        mongosh --quiet --host mongodb:27017
+        --username "$\${MONGO_INITDB_ROOT_USERNAME}"
+        --password "$\${MONGO_INITDB_ROOT_PASSWORD}"
+        --authenticationDatabase admin
+        --eval "try { const status = rs.status(); quit(status.ok === 1 ? 0 : 1); }
+        catch (error) {
+          if (error.code === 94 || error.codeName === 'NotYetInitialized') {
+            const result = rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]});
+            quit(result.ok === 1 ? 0 : 1);
           }
-        '`;
+          throw error;
+        }"
+    networks:
+      - backend`;
+const schemaInitDependencies = postgres ? [["postgres", "service_healthy"]] : [["mongo-init", "service_completed_successfully"]];
+const schemaInitDependsBlock = `\n    depends_on:\n${schemaInitDependencies.map(([dependency, condition]) => `      ${dependency}:\n        condition: ${condition}`).join("\n")}`;
+const schemaInitEnvironment = postgres
+	? `\n    environment:\n      POSTGRES_URI: "postgresql://postgres:\${POSTGRES_ROOT_PASSWORD:?Set POSTGRES_ROOT_PASSWORD}@postgres:5432/${databaseName}"`
+	: `\n    environment:\n      MONGODB_URI: "mongodb://${options.name}-root:\${MONGODB_ROOT_PASSWORD:?Set MONGODB_ROOT_PASSWORD}@mongodb:27017/${databaseName}?replicaSet=rs0&directConnection=true&authSource=admin"\n      MONGODB_DB_NAME: "${databaseName}"`;
+const schemaInitService = `\n  schema-init:
+    image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
+    command: ["node", "dist/app/cli/applySchema.js"]${schemaInitEnvironment}${schemaInitDependsBlock}
+    networks:
+      - backend
+    restart: "no"`;
 const redisService = options.redis ? `\n  redis:
     image: redis:7-alpine
+    command:
+      - redis-server
+      - --appendonly
+      - "yes"
+      - --appendfsync
+      - everysec
+      - --maxmemory-policy
+      - noeviction
+      - --requirepass
+      - \${REDIS_PASSWORD:?Set REDIS_PASSWORD}
+    environment:
+      REDIS_PASSWORD: \${REDIS_PASSWORD:?Set REDIS_PASSWORD}
     volumes:
-      - redis-data:/data
+      - \${REDIS_DATA_DIR:?Set REDIS_DATA_DIR}:/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - REDISCLI_AUTH="$\${REDIS_PASSWORD}" redis-cli ping | grep -q PONG
+      interval: 10s
+      timeout: 3s
+      retries: 10
+      start_period: 10s
+    networks:
+      - backend
     restart: unless-stopped` : "";
-const namedVolumes = [
-	"  mongodb-data:",
-	...(options.redis ? ["  redis-data:"] : [])
-];
 add(`${svc}/docker-compose.yml`, `name: ${options.name}-prod
 services:
   ${options.name}:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
-      - .env.production
+      - \${APP_ENV_FILE:-.env.production}
     ports:
-      - "3000:3000"${databaseEnvironmentBlock}${volumeBlock}${dependsBlock}
-    restart: unless-stopped${workerService}${databaseService}${redisService}
-volumes:
-${namedVolumes.join("\n")}
+      - "3000:3000"${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          node -e
+          "fetch('http://127.0.0.1:3000/api/v1/health.readiness',
+          {method:'POST',headers:{'Content-Type':'application/json','X-Requested-With':'XMLHttpRequest'},body:'{}'})
+          .then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    stop_grace_period: 2m
+    networks:
+      - backend
+    restart: unless-stopped${workerService}${schemaInitService}${databaseService}${redisService}
+networks:
+  backend:
+    driver: bridge
 `);
 
 const devWorker = options.worker ? `\n  worker:
@@ -757,8 +1237,22 @@ const devWorker = options.worker ? `\n  worker:
       - .env.development
     command: ["npm", "run", "dev:worker"]${databaseEnvironmentBlock}
     volumes:
-${devVolumes.join("\n")}${dependsBlock}` : "";
-const devDatabase = `\n  mongodb:
+${devVolumes.join("\n")}${devDependsBlock}` : "";
+const devDatabase = postgres ? `\n  postgres:
+    image: postgres:17
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: ${databaseName}
+      POSTGRES_USER: ${options.name}-app
+      POSTGRES_PASSWORD: development
+    volumes:
+      - postgres-dev-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${options.name}-app -d ${databaseName}"]
+      interval: 2s
+      timeout: 2s
+      retries: 30` : `\n  mongodb:
     image: mongo:8
     command: mongod --replSet rs0 --bind_ip_all
     ports:
@@ -794,11 +1288,23 @@ const devRedis = options.redis ? `\n  redis:
     volumes:
       - redis-dev-data:/data` : "";
 const devNamedVolumes = [
-	"  mongodb-dev-data:",
+	postgres ? "  postgres-dev-data:" : "  mongodb-dev-data:",
 	...(options.redis ? ["  redis-dev-data:"] : [])
 ];
 add(`${svc}/docker-compose.dev.yml`, `name: ${options.name}-dev
 services:
+  schema-init:
+    build:
+      context: .
+      dockerfile: Dockerfile.dev
+    env_file:
+      - .env.development
+    command: ["npm", "run", "schema:apply:dev"]${databaseEnvironmentBlock}
+    volumes:
+${devVolumes.join("\n")}
+    depends_on:
+      ${postgres ? "postgres" : "mongo-init"}:
+        condition: ${postgres ? "service_healthy" : "service_completed_successfully"}
   ${options.name}:
     build:
       context: .
@@ -808,11 +1314,21 @@ services:
     ports:
       - "3000:3000"${databaseEnvironmentBlock}
     volumes:
-${devVolumes.join("\n")}${dependsBlock}${devWorker}${devDatabase}${devRedis}
+${devVolumes.join("\n")}${devDependsBlock}${devWorker}${devDatabase}${devRedis}
 volumes:
 ${devNamedVolumes.join("\n")}
 `);
 
+for (const [relative, content] of Object.entries(ownedSources({ kind: "service", profiles: serviceProfiles }))) {
+	add(`${svc}/${relative}`, content);
+}
+if (options.ui) {
+	const uiProfiles = [...(options.auth === "firebase" ? ["firebase"] : []), "notifications"];
+	for (const [relative, content] of Object.entries(ownedSources({ kind: "ui", profiles: uiProfiles }))) {
+		add(`${ui}/${relative}`, content);
+	}
+}
+
 for (const [relative, content] of Object.entries(files)) {
 	const destination = path.join(root, relative);
 	fs.mkdirSync(path.dirname(destination), { recursive: true });
@@ -820,5 +1336,10 @@ for (const [relative, content] of Object.entries(files)) {
 	if (relative.endsWith(".sh")) fs.chmodSync(destination, 0o755);
 }
 
-return { root, name: options.name, database: "mongo", authentication: options.auth, ui: options.ui, redis: options.redis, worker: options.worker, repositories: [svc, ...(options.ui ? [ui] : [])], files: Object.keys(files).length };
+for (const repository of [svc, ...(options.ui ? [ui] : [])]) {
+	const result = runSync(path.join(root, repository), "write", contractVersion);
+	if (result.errors.length) fail(result.errors.join("\n"));
+}
+
+return { root, name: options.name, database: options.db, authentication: options.auth, ui: options.ui, redis: options.redis, worker: options.worker, repositories: [svc, ...(options.ui ? [ui] : [])], files: Object.keys(files).length };
 }