corporateai 0.0.1

package/.dockerignore

@@ -0,0 +1,10 @@
+.git
+.github
+.paperclip
+.pnpm-store
+node_modules
+**/node_modules
+coverage
+data
+tmp
+*.log

package/.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=postgres://paperclip:paperclip@localhost:5432/paperclip
+PORT=3100
+SERVE_UI=false

package/.github/workflows/publish-cli.yml

@@ -0,0 +1,49 @@
+name: Publish CLI to npm
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch: {}
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Enable Corepack & setup pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.15.4 --activate
+
+      - name: Install workspace dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build CLI
+        run: |
+          cd cli
+          pnpm build
+
+      - name: Configure npm auth
+        if: secrets.NPM_TOKEN
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
+
+      - name: Publish CLI to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          cd cli
+          npm publish --access public

package/.mailmap

@@ -0,0 +1 @@
+Dotta <bippadotta@protonmail.com> Forgotten <forgottenrunes@protonmail.com>

package/AGENTS.md

@@ -0,0 +1,148 @@
+# AGENTS.md
+
+Guidance for human and AI contributors working in this repository.
+
+## 1. Purpose
+
+Corporate is a control plane for AI-agent companies.
+The current implementation target is V1 and is defined in `doc/SPEC-implementation.md`.
+
+## 2. Read This First
+
+Before making changes, read in this order:
+
+1. `doc/GOAL.md`
+2. `doc/PRODUCT.md`
+3. `doc/SPEC-implementation.md`
+4. `doc/DEVELOPING.md`
+5. `doc/DATABASE.md`
+
+`doc/SPEC.md` is long-horizon product context.
+`doc/SPEC-implementation.md` is the concrete V1 build contract.
+
+## 3. Repo Map
+
+- `server/`: Express REST API and orchestration services
+- `ui/`: React + Vite board UI
+- `packages/db/`: Drizzle schema, migrations, DB clients
+- `packages/shared/`: shared types, constants, validators, API path constants
+- `packages/adapters/`: agent adapter implementations (Claude, Codex, Cursor, etc.)
+- `packages/adapter-utils/`: shared adapter utilities
+- `packages/plugins/`: plugin system packages
+- `doc/`: operational and product docs
+
+## 4. Dev Setup (Auto DB)
+
+Use embedded PGlite in dev by leaving `DATABASE_URL` unset.
+
+```sh
+pnpm install
+pnpm dev
+```
+
+This starts:
+
+- API: `http://localhost:3100`
+- UI: `http://localhost:3100` (served by API server in dev middleware mode)
+
+Quick checks:
+
+```sh
+curl http://localhost:3100/api/health
+curl http://localhost:3100/api/companies
+```
+
+Reset local dev DB:
+
+```sh
+rm -rf data/pglite
+pnpm dev
+```
+
+## 5. Core Engineering Rules
+
+1. Keep changes company-scoped.
+Every domain entity should be scoped to a company and company boundaries must be enforced in routes/services.
+
+2. Keep contracts synchronized.
+If you change schema/API behavior, update all impacted layers:
+- `packages/db` schema and exports
+- `packages/shared` types/constants/validators
+- `server` routes/services
+- `ui` API clients and pages
+
+3. Preserve control-plane invariants.
+- Single-assignee task model
+- Atomic issue checkout semantics
+- Approval gates for governed actions
+- Budget hard-stop auto-pause behavior
+- Activity logging for mutating actions
+
+4. Do not replace strategic docs wholesale unless asked.
+Prefer additive updates. Keep `doc/SPEC.md` and `doc/SPEC-implementation.md` aligned.
+
+5. Keep plan docs dated and centralized.
+New plan documents belong in `doc/plans/` and should use `YYYY-MM-DD-slug.md` filenames.
+
+## 6. Database Change Workflow
+
+When changing data model:
+
+1. Edit `packages/db/src/schema/*.ts`
+2. Ensure new tables are exported from `packages/db/src/schema/index.ts`
+3. Generate migration:
+
+```sh
+pnpm db:generate
+```
+
+4. Validate compile:
+
+```sh
+pnpm -r typecheck
+```
+
+Notes:
+- `packages/db/drizzle.config.ts` reads compiled schema from `dist/schema/*.js`
+- `pnpm db:generate` compiles `packages/db` first
+
+## 7. Verification Before Hand-off
+
+Run this full check before claiming done:
+
+```sh
+pnpm -r typecheck
+pnpm test:run
+pnpm build
+```
+
+If anything cannot be run, explicitly report what was not run and why.
+
+## 8. API and Auth Expectations
+
+- Base path: `/api`
+- Board access is treated as full-control operator context
+- Agent access uses bearer API keys (`agent_api_keys`), hashed at rest
+- Agent keys must not access other companies
+
+When adding endpoints:
+
+- apply company access checks
+- enforce actor permissions (board vs agent)
+- write activity log entries for mutations
+- return consistent HTTP errors (`400/401/403/404/409/422/500`)
+
+## 9. UI Expectations
+
+- Keep routes and nav aligned with available API surface
+- Use company selection context for company-scoped pages
+- Surface failures clearly; do not silently ignore API errors
+
+## 10. Definition of Done
+
+A change is done when all are true:
+
+1. Behavior matches `doc/SPEC-implementation.md`
+2. Typecheck, tests, and build pass
+3. Contracts are synced across db/shared/server/ui
+4. Docs updated when behavior or commands change

package/CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# Contributing Guide
+
+Thanks for wanting to contribute!
+
+We really appreciate both small fixes and thoughtful larger changes.
+
+## Two Paths to Get Your Pull Request Accepted
+
+### Path 1: Small, Focused Changes (Fastest way to get merged)
+
+- Pick **one** clear thing to fix/improve
+- Touch the **smallest possible number of files**
+- Make sure the change is very targeted and easy to review
+- All automated checks pass (including Greptile comments)
+- No new lint/test failures
+
+These almost always get merged quickly when they're clean.
+
+### Path 2: Bigger or Impactful Changes
+
+- **First** talk about it in Discord → #dev channel  
+  → Describe what you're trying to solve  
+  → Share rough ideas / approach
+- Once there's rough agreement, build it
+- In your PR include:
+  - Before / After screenshots (or short video if UI/behavior change)
+  - Clear description of what & why
+  - Proof it works (manual testing notes)
+  - All tests passing
+  - All Greptile + other PR comments addressed
+
+PRs that follow this path are **much** more likely to be accepted, even when they're large.
+
+## General Rules (both paths)
+
+- Write clear commit messages
+- Keep PR title + description meaningful
+- One PR = one logical change (unless it's a small related group)
+- Run tests locally first
+- Be kind in discussions 😄
+
+## Writing a Good PR message
+
+Please include a "thinking path" at the top of your PR message that explains from the top of the project down to what you fixed. E.g.:
+
+### Thinking Path Example 1:
+
+> - Corporate orchestrates ai-agents for zero-human companies
+> - There are many types of adapters for each LLM model provider
+> - But LLM's have a context limit and not all agents can automatically compact their context
+> - So we need to have an adapter-specific configuration for which adapters can and cannot automatically compact their context
+> - This pull request adds per-adapter configuration of compaction, either auto or paperclip managed
+> - That way we can get optimal performance from any adapter/provider in Corporate
+
+### Thinking Path Example 2:
+
+> - Corporate orchestrates ai-agents for zero-human companies
+> - But humans want to watch the agents and oversee their work
+> - Human users also operate in teams and so they need their own logins, profiles, views etc.
+> - So we have a multi-user system for humans
+> - But humans want to be able to update their own profile picture and avatar
+> - But the avatar upload form wasn't saving the avatar to the file storage system
+> - So this PR fixes the avatar upload form to use the file storage service
+> - The benefit is we don't have a one-off file storage for just one aspect of the system, which would cause confusion and extra configuration
+
+Then have the rest of your normal PR message after the Thinking Path.
+
+This should include details about what you did, why you did it, why it matters & the benefits, how we can verify it works, and any risks.
+
+Please include screenshots if possible if you have a visible change. (use something like the [agent-browser skill](https://github.com/vercel-labs/agent-browser/blob/main/skills/agent-browser/SKILL.md) or similar to take screenshots). Ideally, you include before and after screenshots.
+
+Questions? Just ask in #dev — we're happy to help.
+
+Happy hacking!
+

package/Dockerfile

@@ -0,0 +1,59 @@
+FROM node:lts-trixie-slim AS base
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl git \
+  && rm -rf /var/lib/apt/lists/*
+RUN corepack enable
+
+FROM base AS deps
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
+COPY cli/package.json cli/
+COPY server/package.json server/
+COPY ui/package.json ui/
+COPY packages/shared/package.json packages/shared/
+COPY packages/db/package.json packages/db/
+COPY packages/adapter-utils/package.json packages/adapter-utils/
+COPY packages/adapters/claude-local/package.json packages/adapters/claude-local/
+COPY packages/adapters/codex-local/package.json packages/adapters/codex-local/
+COPY packages/adapters/cursor-local/package.json packages/adapters/cursor-local/
+COPY packages/adapters/gemini-local/package.json packages/adapters/gemini-local/
+COPY packages/adapters/openclaw-gateway/package.json packages/adapters/openclaw-gateway/
+COPY packages/adapters/opencode-local/package.json packages/adapters/opencode-local/
+COPY packages/adapters/pi-local/package.json packages/adapters/pi-local/
+COPY packages/plugins/sdk/package.json packages/plugins/sdk/
+COPY patches/ patches/
+
+RUN pnpm install --frozen-lockfile
+
+FROM base AS build
+WORKDIR /app
+COPY --from=deps /app /app
+COPY . .
+RUN pnpm --filter @paperclipai/ui build
+RUN pnpm --filter @paperclipai/plugin-sdk build
+RUN pnpm --filter @paperclipai/server build
+RUN test -f server/dist/index.js || (echo "ERROR: server build output missing" && exit 1)
+
+FROM base AS production
+WORKDIR /app
+COPY --chown=node:node --from=build /app /app
+RUN npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai \
+  && mkdir -p /paperclip \
+  && chown node:node /paperclip
+
+ENV NODE_ENV=production \
+  HOME=/paperclip \
+  HOST=0.0.0.0 \
+  PORT=3100 \
+  SERVE_UI=true \
+  PAPERCLIP_HOME=/paperclip \
+  PAPERCLIP_INSTANCE_ID=default \
+  PAPERCLIP_CONFIG=/paperclip/instances/default/config.json \
+  PAPERCLIP_DEPLOYMENT_MODE=authenticated \
+  PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+
+VOLUME ["/paperclip"]
+EXPOSE 3100
+
+USER node
+CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]

package/Dockerfile.onboard-smoke

@@ -0,0 +1,42 @@
+FROM ubuntu:24.04
+
+ARG NODE_MAJOR=20
+ARG CORPORATEAI_VERSION=latest
+ARG PAPERCLIPAI_VERSION=latest
+ARG HOST_UID=10001
+
+ENV DEBIAN_FRONTEND=noninteractive \
+  PAPERCLIP_HOME=/paperclip \
+  PAPERCLIP_OPEN_ON_LISTEN=false \
+  HOST=0.0.0.0 \
+  PORT=3100 \
+  HOME=/home/paperclip \
+  LANG=en_US.UTF-8 \
+  LC_ALL=en_US.UTF-8 \
+  NPM_CONFIG_UPDATE_NOTIFIER=false \
+  NODE_MAJOR=${NODE_MAJOR} \
+  CORPORATEAI_VERSION=${CORPORATEAI_VERSION} \
+  PAPERCLIPAI_VERSION=${PAPERCLIPAI_VERSION}
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl gnupg locales \
+  && mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+    | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+  && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
+    > /etc/apt/sources.list.d/nodesource.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends nodejs \
+  && locale-gen en_US.UTF-8 \
+  && groupadd --gid 10001 paperclip \
+  && useradd --create-home --shell /bin/bash --uid "${HOST_UID}" --gid 10001 paperclip \
+  && mkdir -p /paperclip /home/paperclip/workspace \
+  && chown -R paperclip:paperclip /paperclip /home/paperclip \
+  && rm -rf /var/lib/apt/lists/*
+
+VOLUME ["/paperclip"]
+WORKDIR /home/paperclip/workspace
+EXPOSE 3100
+USER paperclip
+
+CMD ["bash", "-lc", "set -euo pipefail; mkdir -p \"$PAPERCLIP_HOME\"; CLI_VERSION=\"${CORPORATEAI_VERSION:-${PAPERCLIPAI_VERSION:-latest}}\"; npx --yes \"corporateai@${CLI_VERSION}\" onboard --yes --data-dir \"$PAPERCLIP_HOME\""]

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Corporate AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# Corporate: Orchestrate Your AI-Agent Company
+
+Early release v0.0.1 — Open-source control plane for AI-agent companies.
+
+Corporate helps teams run AI-agent companies with predictable costs, clear governance, and full audit trails. Bring your agents, set goals, and let Corporate handle orchestration, budgeting, and approvals.
+
+---
+
+## Why Corporate?
+
+Corporate is built for businesses that want to scale AI-agent operations without the chaos. Unlike other tools, Corporate focuses on:
+
+- **Company-Wide Orchestration**: Manage multiple agents, teams, and goals from one dashboard.
+- **Cost Control**: Set budgets and auto-pause runaway processes.
+- **Governance**: Enforce approval gates and track every decision.
+- **Audit-Ready**: Immutable logs for every action.
+
+---
+
+## Features
+
+| Feature                | Benefit                              |
+|------------------------|--------------------------------------|
+| **Bring Your Own Agent** | Any agent, any runtime, one platform. |
+| **Budget Control**      | Hard-stop limits to prevent overspend. |
+| **Governance**          | Approvals, rollbacks, and revisions. |
+| **Audit Logs**          | Full traceability of every action.   |
+| **Multi-Company**       | One deployment, many companies.      |
+| **Mobile Ready**        | Manage your business from anywhere.  |
+
+---
+
+## Problems Corporate Solves
+
+| Problem                                | Solution                              |
+|----------------------------------------|---------------------------------------|
+| Unclear ownership and manual handoffs  | Single-assignee task model.           |
+| Runaway costs from agent loops         | Budget tracking and auto-pause.       |
+| Fragmented approvals                   | Centralized governance workflows.     |
+| No traceability                        | Immutable audit logs.                 |
+
+---
+
+## Quickstart
+
+Corporate is open-source and self-hosted. No account required.
+
+### One-Liner Setup
+```bash
+npx corporateai onboard --yes
+```
+This command:
+- Clones the repository.
+- Installs dependencies.
+- Sets up an embedded development database.
+- Starts the server and UI.
+
+### Manual Setup
+```bash
+git clone https://github.com/EvanGribar/corporate.git
+cd corporate
+pnpm install
+pnpm dev
+```
+Access the platform:
+- API: [http://localhost:3100/api](http://localhost:3100/api)
+- UI: [http://localhost:3100](http://localhost:3100)
+
+---
+
+## Why Corporate Over Paperclip?
+
+| Feature                | Corporate                          | Paperclip |
+|------------------------|------------------------------------|-----------|
+| **Company-Wide Scope** | Yes                                | No        |
+| **Budget Controls**    | Hard-stop limits                  | Limited   |
+| **Audit Logs**         | Comprehensive                     | Basic     |
+| **Ease of Use**        | 5-minute onboarding               | Moderate  |
+| **Governance**         | Built-in approval workflows       | Limited   |
+
+---
+
+## Community
+
+- [Discord](https://discord.gg/m4HZY7xNG3) — Join the conversation.
+- [GitHub Issues](https://github.com/EvanGribar/corporate/issues) — Report bugs and request features.
+- [GitHub Discussions](https://github.com/EvanGribar/corporate/discussions) — Share ideas and feedback.
+
+---
+
+## License
+
+MIT © 2026 Corporate

package/cli/esbuild.config.mjs

@@ -0,0 +1,11 @@
+import path from 'node:path';
+
+export default {
+  entryPoints: [path.resolve('src', 'index.ts')],
+  bundle: true,
+  platform: 'node',
+  format: 'esm',
+  target: 'node20',
+  outfile: path.resolve('dist', 'index.js'),
+  sourcemap: true,
+};

package/cli/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "corporateai",
+  "version": "0.3.1",
+  "description": "Corporate CLI wrapper for the Corporate control plane",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "corporateai": "dist/index.js"
+  },
+  "scripts": {
+    "build": "node ./scripts/build-cli.mjs"
+  },
+  "files": ["dist"],
+  "dependencies": {
+    "@corporateai/server": "workspace:*"
+  },
+  "devDependencies": {
+    "esbuild": "^0.27.3"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}
+

package/cli/scripts/build-cli.mjs

@@ -0,0 +1,5 @@
+import esbuild from 'esbuild';
+import config from '../esbuild.config.mjs';
+
+await esbuild.build(config);
+console.log('Built corporateai CLI bundle');

package/cli/src/index.ts

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+
+const cmd = process.argv[2] || 'help';
+const args = process.argv.slice(3);
+
+if (cmd === 'help' || ['-h', '--help'].includes(cmd)) {
+  console.log(`corporateai CLI (wrapper)
+
+Usage:
+  corporateai onboard [--yes] [--data-dir <dir>]
+  corporateai agent local-cli <agent-id> --company-id <company-id>
+  corporateai worktree init ...
+
+This binary is a minimal stub. For full experience, install the top-level package and run the CLI in the repo root.
+`);
+  process.exit(0);
+}
+
+if (cmd === 'onboard') {
+  const finalArgs = ['onboard', ...args];
+  const result = spawnSync('pnpm', finalArgs, { stdio: 'inherit' });
+  process.exit(result.status ?? 1);
+}
+
+const result = spawnSync('pnpm', [cmd, ...args], { stdio: 'inherit' });
+process.exit(result.status ?? 1);

package/docker-compose.quickstart.yml

@@ -0,0 +1,18 @@
+services:
+  paperclip:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "${PAPERCLIP_PORT:-3100}:3100"
+    environment:
+      HOST: "0.0.0.0"
+      PAPERCLIP_HOME: "/paperclip"
+      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+      PAPERCLIP_DEPLOYMENT_MODE: "authenticated"
+      PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
+      PAPERCLIP_PUBLIC_URL: "${PAPERCLIP_PUBLIC_URL:-http://localhost:3100}"
+      BETTER_AUTH_SECRET: "${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET must be set}"
+    volumes:
+      - "${PAPERCLIP_DATA_DIR:-./data/docker-paperclip}:/paperclip"

package/docker-compose.untrusted-review.yml

@@ -0,0 +1,33 @@
+services:
+  review:
+    build:
+      context: .
+      dockerfile: docker/untrusted-review/Dockerfile
+    init: true
+    tty: true
+    stdin_open: true
+    working_dir: /work
+    environment:
+      HOME: "/home/reviewer"
+      CODEX_HOME: "/home/reviewer/.codex"
+      CLAUDE_HOME: "/home/reviewer/.claude"
+      PAPERCLIP_HOME: "/home/reviewer/.paperclip-review"
+      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+      GITHUB_TOKEN: "${GITHUB_TOKEN:-}"
+    ports:
+      - "${REVIEW_PAPERCLIP_PORT:-3100}:3100"
+      - "${REVIEW_VITE_PORT:-5173}:5173"
+    volumes:
+      - review-home:/home/reviewer
+      - review-work:/work
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:mode=1777,size=1g
+
+volumes:
+  review-home:
+  review-work:

package/docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  db:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: paperclip
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+
+  server:
+    build: .
+    ports:
+      - "3100:3100"
+    environment:
+      DATABASE_URL: postgres://paperclip:paperclip@db:5432/paperclip
+      PORT: "3100"
+      SERVE_UI: "true"
+      PAPERCLIP_DEPLOYMENT_MODE: "authenticated"
+      PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
+      PAPERCLIP_PUBLIC_URL: "${PAPERCLIP_PUBLIC_URL:-http://localhost:3100}"
+      BETTER_AUTH_SECRET: "${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET must be set}"
+    volumes:
+      - paperclip-data:/paperclip
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  pgdata:
+  paperclip-data: