create-bw-app 0.19.0 → 0.20.0

package/README.md

@@ -39,7 +39,7 @@ bw admin create --email owner@example.com
 - `bw add <moduleKey>` resolves requirements, installs thin package mounts and module wiring, and appends migrations.
 - `bw upgrade [moduleKey]` includes the existing managed update flow plus forward-only module migrations.
 - `bw doctor` checks package, config, scaffold, environment-name, migration, configured function-region, and deployed function-region consistency. Pass `--deployment-url` to inspect the deployed `x-vercel-id`; add `--report` to stamp the result in the app manifest.
-- `bw admin create --email <email>` creates a passwordless Supabase Auth user, transactionally ensures its profile and `admin` assignment, then sends the Core Auth `/reset-password` flow. It refuses an existing admin unless `--force` is passed and never promotes an existing Auth user.
+- `bw admin create --email <email>` creates a passwordless Supabase Auth user, transactionally ensures its profile and `admin` assignment, then sends the Core Auth `/reset-password` flow. It always refuses when the project already has an admin (use the in-app admin role controls to add administrators) and never promotes an existing Auth user.
 - All mutating commands support `--dry-run`.
 
 ## Update existing apps

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/add.mjs

@@ -2,7 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { stdout as output } from "node:process";
 import { SELECTABLE_MODULES } from "./constants.mjs";
-import { TEMPLATE_ROOT, createAppContextFile, createDbInstallPlan, createNextConfig, createPlatformGlobalsCss, createPlatformModulesConfigFile, createShellConfig, getDbModuleRegistry, getVersionMap, pathExists, readJsonIfPresent } from "./generator.mjs";
+import { TEMPLATE_ROOT, createAppContextFile, createDbInstallPlan, createModuleToolbarControlsConfig, createNextConfig, createOptionalModuleRouteFiles, createPlatformGlobalsCss, createPlatformModulesConfigFile, createShellConfig, getDbModuleRegistry, getVersionMap, pathExists, readJsonIfPresent } from "./generator.mjs";
 import { collectScaffoldFiles, findWorkspaceRoot, loadModuleCatalog, MODULE_PACKAGES, readAppManifest, resolveModuleClosure, satisfiesVersion, writeAppManifest } from "./app-manifest.mjs";
 import { applyMigrationWrites, planMigrationAppends } from "./migrations.mjs";
 
@@ -66,9 +66,11 @@ export async function addBrightwebModule(moduleKey, argvOptions = {}, runtimeOpt
   const managedWrites = {
     "next.config.ts": createNextConfig({ template: "platform", selectedModules: installedModuleKeys }),
     "app/globals.css": await createPlatformGlobalsCss(installedModuleKeys),
+    "config/module-toolbar-controls.tsx": createModuleToolbarControlsConfig(installedModuleKeys),
     "config/modules.ts": createPlatformModulesConfigFile(installedModuleKeys),
     "config/shell.ts": createShellConfig(installedModuleKeys),
     "docs/ai/app-context.json": createAppContextFile({ slug: appManifest.app.slug, template: "platform", selectedModules: installedModuleKeys.filter((key) => key !== "orgs"), dbInstallPlan }),
+    ...createOptionalModuleRouteFiles(installedModuleKeys),
   };
 
   const summary = [
@@ -93,7 +95,13 @@ export async function addBrightwebModule(moduleKey, argvOptions = {}, runtimeOpt
   for (const key of newModules) appManifest.modules[key] = { version: catalog[key].version, installedAt: now, exposed: true };
   appManifest.migrationCursor = migrationPlan.nextCursor;
   const collectedScaffoldFiles = await collectScaffoldFiles(targetDir, installedModuleKeys);
-  appManifest.scaffoldFiles = { ...collectedScaffoldFiles, ...appManifest.scaffoldFiles };
+  const refreshedScaffoldFiles = Object.fromEntries(
+    Object.entries(collectedScaffoldFiles).map(([relativePath, record]) => {
+      const intent = appManifest.scaffoldFiles[relativePath]?.intent;
+      return [relativePath, intent ? { ...record, intent } : record];
+    }),
+  );
+  appManifest.scaffoldFiles = { ...appManifest.scaffoldFiles, ...refreshedScaffoldFiles };
   await writeAppManifest(targetDir, appManifest);
   output.write(`Installed ${newModules.length} module${newModules.length === 1 ? "" : "s"}. ${migrationPlan.writes.length > 0 ? "Run your Supabase migration apply command. " : ""}Run your package manager install command next.\n`);
   return { dryRun: false, newModules, migrationPlan };

package/src/admin.mjs

@@ -8,7 +8,6 @@ const HELP = `Usage: bw admin create --email <email> [options]
 Options:
   --email <email>          Email address for the first administrator
   --target-dir <path>      App directory (defaults to cwd)
-  --force                  Allow creation when the project already has an admin
   --dry-run                Validate and inspect without creating the user
   --help                   Show this help
 
@@ -94,7 +93,7 @@ async function deleteCreatedAuthUser(supabase, userId) {
 function bootstrapErrorMessage(error) {
   const message = error?.message || "Unknown database error";
   if (message.toLowerCase().includes("administrator already exists")) {
-    return "A project administrator already exists. Re-run with --force only when intentionally adding another new admin.";
+    return "A project administrator already exists. Use the in-app admin role controls to add administrators.";
   }
   return `Could not create the administrator profile and role: ${message}`;
 }
@@ -110,6 +109,9 @@ export async function createFirstAdmin(action, argvOptions = {}, runtimeOptions
   if ("password" in argvOptions) {
     throw new Error("Passwords are not accepted by bw admin create. The command sends a password-set email instead.");
   }
+  if ("force" in argvOptions) {
+    throw new Error("--force has been removed; use the in-app admin role controls to add administrators.");
+  }
 
   const email = normalizeEmail(argvOptions.email);
   if (!validateEmail(email)) {
@@ -129,9 +131,9 @@ export async function createFirstAdmin(action, argvOptions = {}, runtimeOptions
   });
 
   const hasAdmin = await projectHasAdmin(supabase);
-  if (hasAdmin && !argvOptions.force) {
+  if (hasAdmin) {
     throw new Error(
-      "A project administrator already exists. Refusing bootstrap; pass --force only when intentionally adding another new admin.",
+      "A project administrator already exists. Refusing bootstrap; use the in-app admin role controls to add administrators.",
     );
   }
 
@@ -144,9 +146,9 @@ export async function createFirstAdmin(action, argvOptions = {}, runtimeOptions
 
   if (argvOptions.dryRun) {
     (runtimeOptions.output || output).write(
-      `DRY RUN ${email} can be created${hasAdmin ? " with --force" : " as the first administrator"}.\n`,
+      `DRY RUN ${email} can be created as the first administrator.\n`,
     );
-    return { dryRun: true, email, forced: Boolean(argvOptions.force) };
+    return { dryRun: true, email };
   }
 
   const { data: created, error: createError } = await supabase.auth.admin.createUser({
@@ -165,7 +167,6 @@ export async function createFirstAdmin(action, argvOptions = {}, runtimeOptions
       {
         p_user_id: userId,
         p_email: email,
-        p_force: Boolean(argvOptions.force),
       },
     );
     if (bootstrapError) throw new Error(bootstrapErrorMessage(bootstrapError));
@@ -196,7 +197,6 @@ export async function createFirstAdmin(action, argvOptions = {}, runtimeOptions
     email,
     userId,
     profileId,
-    forced: Boolean(argvOptions.force),
     resetPasswordUrl,
   };
 }

package/src/app-manifest.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { APP_DEPENDENCY_DEFAULTS, MODULE_STARTER_FILES, PLATFORM_STARTER_FILES, SELECTABLE_MODULES } from "./constants.mjs";
+import { normalizeSafeRelativePath, resolveSafeRelativePath } from "./safe-path.mjs";
 
 const TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "template");
 
@@ -86,6 +87,10 @@ export async function readAppManifest(targetDir, { required = true } = {}) {
   if (!manifest && required) {
     throw new Error(`No BrightWeb app manifest found at ${APP_MANIFEST_PATH}. Pre-manifest apps must be adopted before using bw.`);
   }
+  if (manifest) {
+    const errors = validateAppManifest(manifest);
+    if (errors.length > 0) throw new Error(`Invalid BrightWeb app manifest: ${errors.join("; ")}`);
+  }
   return manifest;
 }
 
@@ -114,10 +119,14 @@ export function validateAppManifest(manifest) {
     if (!manifest[key] || typeof manifest[key] !== "object" || Array.isArray(manifest[key])) errors.push(`${key} must be an object`);
   }
   if (!Array.isArray(manifest.managedFiles) || manifest.managedFiles.some((entry) => typeof entry !== "string")) errors.push("managedFiles must be an array of paths");
+  else for (const [index, relativePath] of manifest.managedFiles.entries()) {
+    try { normalizeSafeRelativePath(relativePath, `managedFiles[${index}]`); } catch (error) { errors.push(error.message); }
+  }
   for (const [key, entry] of Object.entries(manifest.modules || {})) {
     if (!entry || !cleanVersion(entry.version) || typeof entry.installedAt !== "string" || typeof entry.exposed !== "boolean") errors.push(`modules.${key} is invalid`);
   }
   for (const [relativePath, entry] of Object.entries(manifest.scaffoldFiles || {})) {
+    try { normalizeSafeRelativePath(relativePath, `scaffoldFiles path`); } catch (error) { errors.push(error.message); }
     if (!entry || typeof entry.module !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry.hash || "") || !["current", "drifted", "missing"].includes(entry.status) || (entry.intent != null && !["managed", "owned", "skipped"].includes(entry.intent))) errors.push(`scaffoldFiles.${relativePath} is invalid`);
   }
   if (manifest.lastDoctor != null && (typeof manifest.lastDoctor.at !== "string" || typeof manifest.lastDoctor.ok !== "boolean")) errors.push("lastDoctor is invalid");
@@ -160,7 +169,7 @@ export async function collectScaffoldFiles(targetDir, selectedModules) {
   }
   const result = {};
   for (const [relativePath, moduleKey] of Array.from(files.entries()).sort()) {
-    const targetPath = path.join(targetDir, relativePath);
+    const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Scaffold file path");
     if (await pathExists(targetPath)) result[relativePath] = { module: moduleKey, hash: await hashFile(targetPath), status: "current" };
   }
   return result;

package/src/constants.mjs

@@ -154,6 +154,7 @@ export const PLATFORM_STARTER_FILES = [
   "app/(shell)/dashboard/dashboard-live-mount.tsx",
   "app/(shell)/dashboard/page.tsx",
   "app/api/account/route.ts",
+  "app/api/cron/keepalive/route.ts",
   "app/api/invitations/_dependencies.ts",
   "app/api/invitations/[invitationId]/route.ts",
   "app/api/invitations/[invitationId]/accept/route.ts",
@@ -170,16 +171,16 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.7.4",
-  "@brightweblabs/core-auth": "^0.7.2",
+  "@brightweblabs/app-shell": "^0.8.0",
+  "@brightweblabs/core-auth": "^0.7.3",
   "@brightweblabs/infra": "^0.4.0",
-  "@brightweblabs/module-admin": "^0.5.10",
-  "@brightweblabs/module-crm": "^0.10.0",
-  "@brightweblabs/module-marketing": "^0.2.9",
-  "@brightweblabs/module-orgs": "^0.3.10",
-  "@brightweblabs/module-projects": "^0.9.1",
-  "@brightweblabs/theme": "^0.5.0",
-  "@brightweblabs/ui": "^1.1.1",
+  "@brightweblabs/module-admin": "^0.5.11",
+  "@brightweblabs/module-crm": "^0.10.1",
+  "@brightweblabs/module-marketing": "^0.2.10",
+  "@brightweblabs/module-orgs": "^0.3.11",
+  "@brightweblabs/module-projects": "^0.9.2",
+  "@brightweblabs/theme": "^0.5.1",
+  "@brightweblabs/ui": "^1.2.0",
   "geist": "1.7.2",
   "lucide-react": "^1.8.0",
   "next": "^16.0.0",

package/src/diff.mjs

@@ -4,6 +4,7 @@ import { stdout as output } from "node:process";
 import { findWorkspaceRoot, readAppManifest } from "./app-manifest.mjs";
 import { pathExists } from "./generator.mjs";
 import { findTrackedTemplate, scaffoldDrift } from "./scaffold.mjs";
+import { normalizeSafeRelativePath, resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw diff <relpath> [options]\n       bw diff --list [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --list                    Print tracked scaffold drift status\n  --help                    Show this help`;
 
@@ -58,8 +59,7 @@ export async function diffBrightwebScaffold(relativePath, argvOptions = {}, runt
     return { list: true, drift };
   }
   if (!relativePath) throw new Error("bw diff requires a tracked scaffold <relpath>, or pass --list.");
-  const normalized = path.normalize(relativePath).replace(/^\.\//, "");
-  if (path.isAbsolute(relativePath) || normalized.startsWith(`..${path.sep}`)) throw new Error(`Scaffold path must be relative to the app: ${relativePath}`);
+  const normalized = normalizeSafeRelativePath(relativePath, "Scaffold path");
   const workspaceRoot = runtimeOptions.workspaceRoot || argvOptions.workspaceRoot || await findWorkspaceRoot(targetDir);
   const located = await findTrackedTemplate({ relativePath: normalized, manifest, targetDir, workspaceRoot });
   if (!located.record) throw new Error(`${normalized} is not a tracked scaffold file.`);
@@ -68,7 +68,7 @@ export async function diffBrightwebScaffold(relativePath, argvOptions = {}, runt
     output.write(`${warning}\n`);
     return { supported: false, warning };
   }
-  const appPath = path.join(targetDir, normalized);
+  const appPath = resolveSafeRelativePath(targetDir, normalized, "Scaffold path");
   const [templateContent, appContent] = await Promise.all([
     fs.readFile(located.templatePath, "utf8"),
     pathExists(appPath) ? fs.readFile(appPath, "utf8") : Promise.resolve(""),

package/src/generator.mjs

@@ -839,7 +839,7 @@ export function createPackageJson({
     version: "0.0.0",
     scripts: {
       dev: "next dev",
-      build: "next build",
+      build: "next build --webpack",
       start: "next start",
       lint: "tsc --noEmit",
     },
@@ -897,6 +897,7 @@ export async function createPlatformGlobalsCss(selectedModules) {
   const sourcePackages = [
     "@brightweblabs/ui",
     "@brightweblabs/app-shell",
+    "@brightweblabs/core-auth",
     ...SELECTABLE_MODULES
       .filter((moduleDefinition) => selectedModules.includes(moduleDefinition.key))
       .map((moduleDefinition) => moduleDefinition.packageName),
@@ -1018,6 +1019,211 @@ export function createShellConfig(selectedModules) {
   ].join("\n");
 }
 
+export function createModuleToolbarControlsConfig(selectedModules) {
+  const imports = [];
+  const branches = [];
+
+  if (selectedModules.includes("admin")) {
+    imports.push('import { AdminToolbarControls } from "@brightweblabs/module-admin/ui";');
+    branches.push('  if (pathname === "/admin/users") return <AdminToolbarControls />;');
+  }
+  if (selectedModules.includes("crm")) {
+    imports.push('import { CrmToolbarControls } from "@brightweblabs/module-crm/ui";');
+    branches.push('  if (pathname === "/crm") return <CrmToolbarControls />;');
+  }
+  if (selectedModules.includes("projects")) {
+    imports.push('import { ProjectsToolbarControls } from "@brightweblabs/module-projects/ui";');
+    branches.push('  if (pathname === projectsBaseHref) return <ProjectsToolbarControls />;');
+  }
+
+  return [
+    '"use client";',
+    "",
+    "// MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.",
+    ...imports,
+    imports.length > 0 ? "" : null,
+    "export function getModuleToolbarControls(pathname: string, projectsBaseHref: string) {",
+    ...branches,
+    "  return null;",
+    "}",
+    "",
+  ].filter((line) => line !== null).join("\n");
+}
+
+function createOrganizationRoute(methods, enabled) {
+  const lines = ['export const dynamic = "force-dynamic";', ""];
+  for (const { method, handler, context = false } of methods) {
+    if (enabled) {
+      lines.push(
+        `export async function ${method}(request: Request${context ? ', context: { params: Promise<{ id: string }> }' : ""}) {`,
+        `  const { ${handler} } = await import("@brightweblabs/module-orgs");`,
+        `  return ${handler}(request${context ? ", context" : ""});`,
+        "}",
+        "",
+      );
+    } else {
+      lines.push(
+        `export async function ${method}(_request: Request${context ? ', _context: { params: Promise<{ id: string }> }' : ""}) {`,
+        '  return new Response(null, { status: 404 });',
+        "}",
+        "",
+      );
+    }
+  }
+  return lines.join("\n");
+}
+
+export function createOptionalModuleRouteFiles(selectedModules) {
+  const adminEnabled = selectedModules.includes("admin");
+  const crmEnabled = selectedModules.includes("crm");
+  const orgsEnabled = selectedModules.includes("orgs")
+    || crmEnabled
+    || selectedModules.includes("marketing")
+    || selectedModules.includes("projects");
+  const dependencyImports = [
+    'import { requireServerUserAccess } from "@brightweblabs/core-auth/server";',
+    'import type { InvitationHttpDependencies } from "@brightweblabs/core-auth/routes";',
+    'import { requireServiceRoleClient } from "@brightweblabs/infra/server";',
+  ];
+
+  if (adminEnabled) {
+    dependencyImports.push(
+      'import { getAdminUserInvitationDetails, registerUserFromAdminInvitation } from "@brightweblabs/module-admin";',
+    );
+  }
+  if (orgsEnabled) {
+    dependencyImports.push(
+      'import { acceptOrganizationInvitation, getOrganizationInvitationDetails, registerUserFromOrganizationInvitation } from "@brightweblabs/module-orgs";',
+    );
+  }
+  if (crmEnabled) {
+    dependencyImports.push(
+      'import { ensureCrmContactForProfile } from "@brightweblabs/module-crm";',
+    );
+  }
+
+  const invitationDependencies = adminEnabled && orgsEnabled && crmEnabled
+    ? [
+      'import { requireServerUserAccess } from "@brightweblabs/core-auth/server";',
+      'import { requireServiceRoleClient } from "@brightweblabs/infra/server";',
+      "import {",
+      "  getAdminUserInvitationDetails,",
+      "  registerUserFromAdminInvitation,",
+      '} from "@brightweblabs/module-admin";',
+      'import { ensureCrmContactForProfile } from "@brightweblabs/module-crm";',
+      "import {",
+      "  acceptOrganizationInvitation,",
+      "  getOrganizationInvitationDetails,",
+      "  registerUserFromOrganizationInvitation,",
+      '} from "@brightweblabs/module-orgs";',
+      "",
+      "export const invitationHttpDependencies = {",
+      "  getServiceClient: requireServiceRoleClient,",
+      "  getAccess: requireServerUserAccess,",
+      "  getOrganizationInvitation: getOrganizationInvitationDetails,",
+      "  getAdminInvitation: getAdminUserInvitationDetails,",
+      "  registerOrganizationInvitation: (client: never, input: {",
+      "    invitationId: string;",
+      "    firstName: string;",
+      "    lastName: string;",
+      "    password: string;",
+      "  }) => registerUserFromOrganizationInvitation(client, {",
+      "    ...input,",
+      "    ensureCrmContactForProfile,",
+      "  }),",
+      "  registerAdminInvitation: registerUserFromAdminInvitation,",
+      "  acceptOrganizationInvitation: (client: never, input: {",
+      "    invitationId: string;",
+      "    profileId: string;",
+      "    userEmail: string;",
+      "  }) => acceptOrganizationInvitation(client, {",
+      "    ...input,",
+      "    ensureCrmContactForProfile,",
+      "  }),",
+      "};",
+      "",
+    ].join("\n")
+    : [
+    ...dependencyImports,
+    "",
+    ...(!adminEnabled ? [
+      "const getAdminUserInvitationDetails = async (_client: never, _invitationId: string) => null;",
+      'const registerUserFromAdminInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("INVITATION_NOT_FOUND"); };',
+    ] : []),
+    ...(!orgsEnabled ? [
+      "const getOrganizationInvitationDetails = async (_client: never, _invitationId: string) => null;",
+      'const registerUserFromOrganizationInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("INVITATION_NOT_FOUND"); };',
+      'const acceptOrganizationInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("Convite não encontrado."); };',
+    ] : []),
+    ...(!crmEnabled ? [
+      "const ensureCrmContactForProfile = async () => ({ success: true as const });",
+    ] : []),
+    (!adminEnabled || !orgsEnabled || !crmEnabled) ? "" : null,
+    "export const invitationHttpDependencies = {",
+    "  getServiceClient: requireServiceRoleClient,",
+    "  getAccess: requireServerUserAccess,",
+    "  getOrganizationInvitation: getOrganizationInvitationDetails,",
+    "  getAdminInvitation: getAdminUserInvitationDetails,",
+    "  registerOrganizationInvitation: (client: never, input: {",
+    "    invitationId: string;",
+    "    firstName: string;",
+    "    lastName: string;",
+    "    password: string;",
+    "  }) => registerUserFromOrganizationInvitation(client, {",
+    "    ...input,",
+    "    ensureCrmContactForProfile,",
+    "  }),",
+    "  registerAdminInvitation: registerUserFromAdminInvitation,",
+    "  acceptOrganizationInvitation: (client: never, input: {",
+    "    invitationId: string;",
+    "    profileId: string;",
+    "    userEmail: string;",
+    "  }) => acceptOrganizationInvitation(client, {",
+    "    ...input,",
+    "    ensureCrmContactForProfile,",
+    "  }),",
+    "} satisfies InvitationHttpDependencies;",
+    "",
+    ].filter((line) => line !== null).join("\n");
+
+  return {
+    "app/api/invitations/_dependencies.ts": invitationDependencies,
+    "app/api/organizations/route.ts": createOrganizationRoute([
+      { method: "POST", handler: "handleOrganizationsPostRequest" },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/route.ts": createOrganizationRoute([
+      { method: "PATCH", handler: "handleOrganizationPatchRequest", context: true },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/invitations/route.ts": createOrganizationRoute([
+      { method: "GET", handler: "handleOrganizationInvitationsGetRequest", context: true },
+      { method: "POST", handler: "handleOrganizationInvitationsPostRequest", context: true },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/invitations/[invitationId]/route.ts": orgsEnabled
+      ? [
+        'export const dynamic = "force-dynamic";',
+        "",
+        "export async function DELETE(",
+        "  request: Request,",
+        "  context: { params: Promise<{ id: string; invitationId: string }> },",
+        ") {",
+        '  const { handleOrganizationInvitationDeleteRequest } = await import("@brightweblabs/module-orgs");',
+        "  return handleOrganizationInvitationDeleteRequest(request, context);",
+        "}",
+        "",
+      ].join("\n")
+      : [
+        'export const dynamic = "force-dynamic";',
+        "",
+        'type RouteContext = { params: Promise<{ id: string; invitationId: string }> };',
+        "",
+        "export async function DELETE(_request: Request, _context: RouteContext) {",
+        "  return new Response(null, { status: 404 });",
+        "}",
+        "",
+      ].join("\n"),
+  };
+}
+
 function createSiteConfigFile(slug) {
   const siteName = titleizeSlug(slug);
 
@@ -1361,6 +1567,10 @@ async function scaffoldPlatformProject({
   await ensureDirectory(path.dirname(targetDir));
   await copyDirectory(baseTemplateDir, targetDir);
 
+  if (!workspaceMode && packageManager === "pnpm") {
+    await fs.writeFile(path.join(targetDir, "pnpm-workspace.yaml"), "allowBuilds:\n  sharp: true\n");
+  }
+
   for (const moduleDefinition of SELECTABLE_MODULES) {
     if (!selectedModules.includes(moduleDefinition.key)) continue;
     const moduleTemplateDir = path.join(TEMPLATE_ROOT, "modules", moduleDefinition.templateFolder);
@@ -1390,7 +1600,14 @@ async function scaffoldPlatformProject({
     createPlatformBrandConfigFile({ slug: answers.slug, brandValues }),
   );
   await fs.writeFile(path.join(targetDir, "config", "modules.ts"), createPlatformModulesConfigFile(selectedModules));
+  await fs.writeFile(
+    path.join(targetDir, "config", "module-toolbar-controls.tsx"),
+    createModuleToolbarControlsConfig(selectedModules),
+  );
   await fs.writeFile(path.join(targetDir, "config", "shell.ts"), createShellConfig(selectedModules));
+  for (const [relativePath, content] of Object.entries(createOptionalModuleRouteFiles(selectedModules))) {
+    await fs.writeFile(path.join(targetDir, relativePath), content);
+  }
   await fs.writeFile(
     path.join(targetDir, "docs", "ai", "app-context.json"),
     createAppContextFile({
@@ -1464,6 +1681,9 @@ async function scaffoldSiteProject({
 
   await ensureDirectory(path.dirname(targetDir));
   await copyDirectory(baseTemplateDir, targetDir);
+  if (!workspaceMode && packageManager === "pnpm") {
+    await fs.writeFile(path.join(targetDir, "pnpm-workspace.yaml"), "allowBuilds:\n  sharp: true\n");
+  }
   await ensureDirectory(path.join(targetDir, "config"));
   await ensureDirectory(path.join(targetDir, "docs", "ai"));
 

package/src/migrations.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 import { TEMPLATE_ROOT, pathExists } from "./generator.mjs";
 
 export async function findAppMigrationsDirectory(targetDir) {
@@ -16,7 +17,9 @@ export async function findAppMigrationsDirectory(targetDir) {
 export async function getModuleMigrations(moduleKey, catalogEntry = {}) {
   const candidates = [];
   const configuredPath = catalogEntry.manifest?.database?.migrations;
-  if (catalogEntry.packageRoot && configuredPath) candidates.push(path.resolve(catalogEntry.packageRoot, configuredPath));
+  if (catalogEntry.packageRoot && configuredPath) {
+    candidates.push(resolveSafeRelativePath(catalogEntry.packageRoot, configuredPath, `${catalogEntry.key || "Module"} migration manifest path`));
+  }
   if (catalogEntry.packageRoot) candidates.push(path.join(catalogEntry.packageRoot, "migrations"));
   candidates.push(path.join(TEMPLATE_ROOT, "supabase", "modules", moduleKey, "migrations"));
   for (const directory of candidates) {

package/src/remove.mjs

@@ -12,7 +12,9 @@ import {
 import {
   createAppContextFile,
   createDbInstallPlan,
+  createModuleToolbarControlsConfig,
   createNextConfig,
+  createOptionalModuleRouteFiles,
   createPlatformGlobalsCss,
   createPlatformModulesConfigFile,
   createShellConfig,
@@ -20,6 +22,7 @@ import {
   pathExists,
   readJsonIfPresent,
 } from "./generator.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw remove <moduleKey> [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --dry-run                 Print the removal plan without writing\n  --yes                     Apply the removal plan\n  --help                    Show this help`;
 
@@ -61,16 +64,18 @@ export async function removeBrightwebModule(moduleKey, argvOptions = {}, runtime
   const managedWrites = {
     "next.config.ts": createNextConfig({ template: "platform", selectedModules: remainingModules }),
     "app/globals.css": await createPlatformGlobalsCss(remainingModules),
+    "config/module-toolbar-controls.tsx": createModuleToolbarControlsConfig(remainingModules),
     "config/modules.ts": createPlatformModulesConfigFile(remainingModules),
     "config/shell.ts": createShellConfig(remainingModules),
     "docs/ai/app-context.json": createAppContextFile({ slug: appManifest.app.slug, template: "platform", selectedModules: remainingModules.filter((key) => key !== "orgs"), dbInstallPlan }),
+    ...createOptionalModuleRouteFiles(remainingModules),
   };
 
   const cleanFiles = [];
   const driftedFiles = [];
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles || {})) {
     if (record.module !== moduleKey) continue;
-    const filePath = path.join(targetDir, relativePath);
+    const filePath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     if (!(await pathExists(filePath))) continue;
     if ((record.intent || "managed") === "managed" && await hashFile(filePath) === record.hash) cleanFiles.push(relativePath);
     else driftedFiles.push(relativePath);
@@ -86,14 +91,25 @@ export async function removeBrightwebModule(moduleKey, argvOptions = {}, runtime
   if (!apply) return { dryRun: true, moduleKey, cleanFiles, driftedFiles, notice };
 
   await fs.writeFile(packagePath, `${JSON.stringify(nextPackageJson, null, 2)}\n`, "utf8");
-  for (const relativePath of cleanFiles) await fs.rm(path.join(targetDir, relativePath));
+  for (const relativePath of cleanFiles) await fs.rm(resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path"));
   for (const [relativePath, content] of Object.entries(managedWrites)) {
     const targetPath = path.join(targetDir, relativePath);
     await fs.mkdir(path.dirname(targetPath), { recursive: true });
     await fs.writeFile(targetPath, content, "utf8");
   }
   delete appManifest.modules[moduleKey];
+  if (appManifest.modules.orgs) {
+    appManifest.modules.orgs.exposed = remainingModules.some((key) => ["crm", "marketing", "projects"].includes(key));
+  }
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles || {})) if (record.module === moduleKey) delete appManifest.scaffoldFiles[relativePath];
+  for (const relativePath of Object.keys(managedWrites)) {
+    const record = appManifest.scaffoldFiles[relativePath];
+    if (!record) continue;
+    const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
+    if (!(await pathExists(targetPath))) continue;
+    record.hash = await hashFile(targetPath);
+    record.status = "current";
+  }
   await writeAppManifest(targetDir, appManifest);
   output.write(`Removed ${moduleKey} package wiring and ${cleanFiles.length} clean scaffold file${cleanFiles.length === 1 ? "" : "s"}. Install dependencies next.\n`);
   return { dryRun: false, moduleKey, cleanFiles, driftedFiles, notice };

package/src/safe-path.mjs

@@ -0,0 +1,46 @@
+import path from "node:path";
+
+const WINDOWS_DRIVE_PATH = /^[A-Za-z]:/;
+
+export function normalizeSafeRelativePath(relativePath, label = "Path") {
+  if (typeof relativePath !== "string" || relativePath.trim() === "") {
+    throw new Error(`${label} must be a non-empty relative path.`);
+  }
+
+  const value = relativePath.trim();
+  if (
+    path.posix.isAbsolute(value)
+    || path.win32.isAbsolute(value)
+    || WINDOWS_DRIVE_PATH.test(value)
+    || value.startsWith("\\\\")
+  ) {
+    throw new Error(`${label} must be relative to the target directory: ${relativePath}`);
+  }
+
+  const portablePath = value.replaceAll("\\", "/");
+  if (portablePath.split("/").includes("..")) {
+    throw new Error(`${label} must not contain parent-directory traversal: ${relativePath}`);
+  }
+
+  const normalized = path.posix.normalize(portablePath).replace(/^\.\//, "");
+  if (normalized === "." || normalized === "") {
+    throw new Error(`${label} must identify a path inside the target directory.`);
+  }
+  return normalized;
+}
+
+export function resolveSafeRelativePath(targetDir, relativePath, label = "Path") {
+  const root = path.resolve(targetDir);
+  const normalized = normalizeSafeRelativePath(relativePath, label);
+  const resolved = path.resolve(root, ...normalized.split("/"));
+  const relativeToRoot = path.relative(root, resolved);
+  if (
+    relativeToRoot === ""
+    || relativeToRoot === ".."
+    || relativeToRoot.startsWith(`..${path.sep}`)
+    || path.isAbsolute(relativeToRoot)
+  ) {
+    throw new Error(`${label} resolves outside the target directory: ${relativePath}`);
+  }
+  return resolved;
+}

package/src/scaffold-cmd.mjs

@@ -3,17 +3,10 @@ import { stdout as output } from "node:process";
 import { findWorkspaceRoot, hashFile, readAppManifest, writeAppManifest } from "./app-manifest.mjs";
 import { pathExists } from "./generator.mjs";
 import { findTrackedTemplate, scaffoldDrift } from "./scaffold.mjs";
+import { normalizeSafeRelativePath, resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw scaffold <action> [paths...] [options]\n\nActions:\n  list                List tracked files, live status, and intent\n  own <path>...       Mark existing tracked files as app-owned\n  skip <path>...      Mark missing tracked files as intentionally absent\n  manage <path>...    Return tracked files to BrightWeb management\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --help                    Show this help`;
 
-function normalizeTrackedPath(relativePath) {
-  const normalized = path.normalize(String(relativePath)).replace(/^\.\//, "");
-  if (path.isAbsolute(String(relativePath)) || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
-    throw new Error(`Scaffold path must be relative to the app: ${relativePath}`);
-  }
-  return normalized;
-}
-
 export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {}, runtimeOptions = {}) {
   if (argvOptions.help || !action) { output.write(`${HELP}\n`); return { help: true }; }
   if (!Array.isArray(paths)) paths = [paths];
@@ -30,7 +23,7 @@ export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {},
     return { action, entries: live.entries };
   }
 
-  const normalizedPaths = Array.from(new Set(paths.map(normalizeTrackedPath)));
+  const normalizedPaths = Array.from(new Set(paths.map((entry) => normalizeSafeRelativePath(entry, "Scaffold path"))));
   for (const relativePath of normalizedPaths) {
     if (!manifest.scaffoldFiles?.[relativePath]) throw new Error(`${relativePath} is not a tracked scaffold file.`);
   }
@@ -47,7 +40,7 @@ export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {},
     const record = manifest.scaffoldFiles[relativePath];
     const previousIntent = record.intent || "managed";
     const nextIntent = action === "manage" ? "managed" : action === "own" ? "owned" : "skipped";
-    const appPath = path.join(targetDir, relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     const exists = await pathExists(appPath);
     if (action === "manage") {
       const located = await findTrackedTemplate({ relativePath, manifest, targetDir, workspaceRoot });

package/src/scaffold.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { MODULE_STARTER_FILES, PLATFORM_STARTER_FILES, SELECTABLE_MODULES } from "./constants.mjs";
 import { hashFile } from "./app-manifest.mjs";
 import { pathExists } from "./generator.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const BUNDLED_TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "template");
 
@@ -42,7 +43,7 @@ export async function inventoryScaffoldFiles({ targetDir, moduleKeys, templateRo
       unsupported.push(definition.relativePath);
       continue;
     }
-    const appPath = path.join(targetDir, definition.relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, definition.relativePath, "Scaffold file path");
     const templateHash = await hashFile(templatePath);
     const exists = await pathExists(appPath);
     records[definition.relativePath] = {
@@ -60,7 +61,7 @@ export async function scaffoldDrift(targetDir, scaffoldFiles = {}) {
   const missing = [];
   const entries = [];
   for (const [relativePath, record] of Object.entries(scaffoldFiles)) {
-    const appPath = path.join(targetDir, relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     const intent = record.intent || "managed";
     let status = "missing";
     if (await pathExists(appPath)) {

package/src/update.mjs

@@ -13,7 +13,9 @@ import {
   TEMPLATE_ROOT,
   createAppContextFile,
   createDbInstallPlan,
+  createModuleToolbarControlsConfig,
   createNextConfig,
+  createOptionalModuleRouteFiles,
   createPackageJson,
   createPlatformGlobalsCss,
   createPlatformModulesConfigFile,
@@ -25,12 +27,19 @@ import {
   readJsonIfPresent,
   runInstall,
 } from "./generator.mjs";
+import { readAppManifest } from "./app-manifest.mjs";
 
 const MANAGED_PLATFORM_FILES = [
   "next.config.ts",
   path.join("app", "globals.css"),
+  path.join("config", "module-toolbar-controls.tsx"),
   path.join("config", "modules.ts"),
   path.join("config", "shell.ts"),
+  path.join("app", "api", "invitations", "_dependencies.ts"),
+  path.join("app", "api", "organizations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "[invitationId]", "route.ts"),
   path.join("docs", "ai", "app-context.json"),
 ];
 
@@ -38,6 +47,14 @@ const MANAGED_SITE_FILES = [
   path.join("docs", "ai", "app-context.json"),
 ];
 
+const MODULE_SELECTED_PLATFORM_FILES = new Set([
+  path.join("app", "api", "invitations", "_dependencies.ts"),
+  path.join("app", "api", "organizations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "[invitationId]", "route.ts"),
+]);
+
 function resolveUpdateTargetDirectory(runtimeOptions, argvOptions) {
   if (runtimeOptions.targetDir || argvOptions.targetDir) {
     return path.resolve(runtimeOptions.targetDir || argvOptions.targetDir);
@@ -264,6 +281,21 @@ async function getStarterFileStatus(targetDir, installedModules) {
       continue;
     }
 
+    // These base files are generated from the installed module set and are
+    // validated/repaired through MANAGED_PLATFORM_FILES, not raw template
+    // byte parity.
+    if (MODULE_SELECTED_PLATFORM_FILES.has(relativePath)) {
+      starterFiles.push({
+        moduleKey: "platform-base",
+        relativePath,
+        sourcePath,
+        targetPath,
+        status: "current",
+        refreshable: false,
+      });
+      continue;
+    }
+
     const [sourceContent, targetContent] = await Promise.all([
       fs.readFile(sourcePath, "utf8"),
       fs.readFile(targetPath, "utf8"),
@@ -424,6 +456,7 @@ function renderPlanSummary(plan, options = {}) {
 
 export async function buildBrightwebAppUpdatePlan(argvOptions = {}, runtimeOptions = {}) {
   const targetDir = resolveUpdateTargetDirectory(runtimeOptions, argvOptions);
+  await readAppManifest(targetDir, { required: false });
   const packageJsonPath = path.join(targetDir, "package.json");
   const manifest = await readJsonIfPresent(packageJsonPath);
 
@@ -493,8 +526,10 @@ export async function buildBrightwebAppUpdatePlan(argvOptions = {}, runtimeOptio
     const canonicalConfigFiles = {
       "next.config.ts": createNextConfig({ template: "platform", selectedModules: installedModules }),
       [path.join("app", "globals.css")]: await createPlatformGlobalsCss(installedModules),
+      [path.join("config", "module-toolbar-controls.tsx")]: createModuleToolbarControlsConfig(installedModules),
       [path.join("config", "modules.ts")]: createPlatformModulesConfigFile(installedModules),
       [path.join("config", "shell.ts")]: createShellConfig(installedModules),
+      ...createOptionalModuleRouteFiles(installedModules),
       [path.join("docs", "ai", "app-context.json")]: createAppContextFile({
         slug: manifest.name || path.basename(targetDir),
         template: "platform",

package/src/upgrade.mjs

@@ -5,6 +5,7 @@ import { hashFile, findWorkspaceRoot, loadModuleCatalog, readAppManifest, writeA
 import { pathExists, runInstall } from "./generator.mjs";
 import { applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
 import { buildBrightwebAppUpdatePlan } from "./update.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw upgrade [moduleKey] [options]\n\nOptions:\n  --target-dir <path>          App directory (defaults to cwd)\n  --workspace-root <path>      BrightWeb workspace root\n  --allow-stale-fallback       Use baked-in versions if npm lookup fails\n  --install                    Install changed dependencies\n  --refresh-starters           Refresh unchanged starter files\n  --dry-run                    Print the upgrade plan without writing\n  --help                       Show this help`;
 
@@ -21,7 +22,7 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
   const intentional = [];
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles)) {
     if (["owned", "skipped"].includes(record.intent)) intentional.push(relativePath);
-    const filePath = path.join(targetDir, relativePath);
+    const filePath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     if (!(await pathExists(filePath))) { missing.push(relativePath); continue; }
     if (await hashFile(filePath) !== record.hash) drifted.push(relativePath);
   }
@@ -60,8 +61,9 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
     if (key && appManifest.modules[key]) appManifest.modules[key].version = cleanVersion(update.to) || appManifest.modules[key].version;
   }
   for (const relativePath of plan.starterFilesToRefresh || []) {
-    if (!protectedPaths.has(relativePath) && appManifest.scaffoldFiles[relativePath] && await pathExists(path.join(targetDir, relativePath))) {
-      appManifest.scaffoldFiles[relativePath].hash = await hashFile(path.join(targetDir, relativePath));
+    const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
+    if (!protectedPaths.has(relativePath) && appManifest.scaffoldFiles[relativePath] && await pathExists(targetPath)) {
+      appManifest.scaffoldFiles[relativePath].hash = await hashFile(targetPath);
       appManifest.scaffoldFiles[relativePath].status = "current";
     }
   }

package/template/base/app/(auth)/login/page.tsx

@@ -1 +1,5 @@
-export { LoginPage as default } from "@brightweblabs/core-auth/ui";
+import { LoginPage } from "@brightweblabs/core-auth/ui";
+
+export default function Page() {
+  return <LoginPage />;
+}

package/template/base/app/(shell)/shell-layout-client.tsx

@@ -7,14 +7,18 @@ import {
   AppShellFrame,
   DesktopSidebar,
   MobileNav,
+  ShellActionsProvider,
   computeInitials,
   isShellNavItemActive,
+  useShellAction,
+  useShellActionDispatch,
   useShellNavState,
   type ShellContextualAction,
   type ShellNavStateGroup,
 } from "@brightweblabs/app-shell";
 import { createAuthUiClient } from "@brightweblabs/core-auth/ui";
 import { Toaster } from "@brightweblabs/ui";
+import { getModuleToolbarControls } from "../../config/module-toolbar-controls";
 import { getStarterShellConfig } from "../../config/shell";
 import "@brightweblabs/app-shell/dashboard.css";
 
@@ -36,6 +40,17 @@ const toolbarWindowEventByAction: Record<string, string> = {
 export function ShellLayoutClient({
   children,
   viewer,
+}: Readonly<{ children: ReactNode; viewer: ShellViewer }>) {
+  return (
+    <ShellActionsProvider aliases={toolbarWindowEventByAction}>
+      <ShellLayoutInner viewer={viewer}>{children}</ShellLayoutInner>
+    </ShellActionsProvider>
+  );
+}
+
+function ShellLayoutInner({
+  children,
+  viewer,
 }: Readonly<{ children: ReactNode; viewer: ShellViewer }>) {
   const pathname = usePathname() ?? "";
   const router = useRouter();
@@ -72,23 +87,21 @@ export function ShellLayoutClient({
     viewer.email ||
     "Conta";
   const projectsBaseHref = pathname.startsWith("/projects") ? "/projects" : "/projetos";
+  const toolbarControls = getModuleToolbarControls(pathname, projectsBaseHref);
 
-  const handleToolbarAction = (item: ShellContextualAction) => {
-    if (item.action === "projects-back-to-portfolio") {
-      router.push(projectsBaseHref);
-      return;
-    }
-    if (item.action === "projects-open-board") {
-      const projectId = pathname.split("/")[2];
-      if (projectId) {
-        router.push(`${projectsBaseHref}/${projectId}/${projectsBaseHref === "/projects" ? "tasks" : "tarefas"}`);
-      }
-      return;
+  const dispatchShellAction = useShellActionDispatch();
+  useShellAction("projects-back-to-portfolio", () => {
+    router.push(projectsBaseHref);
+  });
+  useShellAction("projects-open-board", () => {
+    const projectId = pathname.split("/")[2];
+    if (projectId) {
+      router.push(`${projectsBaseHref}/${projectId}/${projectsBaseHref === "/projects" ? "tasks" : "tarefas"}`);
     }
+  });
 
-    if (item.action) {
-      window.dispatchEvent(new Event(toolbarWindowEventByAction[item.action] ?? item.action));
-    }
+  const handleToolbarAction = (item: ShellContextualAction) => {
+    if (item.action) dispatchShellAction(item.action);
   };
 
   return (
@@ -143,8 +156,9 @@ export function ShellLayoutClient({
           toolbarRoutes={toolbarRoutes}
           toolbarActions={toolbarActions}
           onToolbarAction={handleToolbarAction}
+          notifications={{}}
         >
-          {null}
+          {toolbarControls}
         </AppHeader>
       }
       mobileNav={

package/template/base/app/layout.tsx

@@ -1,22 +1,30 @@
 import type { ReactNode } from "react";
+import type { Metadata, Viewport } from "next";
 import { starterBrandConfig } from "../config/brand";
 import { ThemeProvider, ThemeScript } from "@brightweblabs/app-shell";
 import { geistMono, geistSans } from "./fonts";
 import "./globals.css";
 
-export const metadata = {
+export const metadata: Metadata = {
   title: `${starterBrandConfig.companyName} Starter`,
   description: starterBrandConfig.tagline,
 };
 
+export const viewport: Viewport = {
+  themeColor: [
+    { media: "(prefers-color-scheme: light)", color: "white" },
+    { media: "(prefers-color-scheme: dark)", color: "black" },
+  ],
+};
+
 export default function RootLayout({ children }: { children: ReactNode }) {
   return (
-    <html lang="en" className={`${geistSans.variable} ${geistMono.variable}`} suppressHydrationWarning>
+    <html lang="pt-PT" className={`${geistSans.variable} ${geistMono.variable}`} suppressHydrationWarning>
       <head>
-        <ThemeScript defaultTheme="light" />
+        <ThemeScript defaultTheme="system" />
       </head>
       <body>
-        <ThemeProvider defaultTheme="light" disableTransitionOnChange>
+        <ThemeProvider defaultTheme="system" disableTransitionOnChange>
           {children}
         </ThemeProvider>
       </body>

package/template/base/config/module-toolbar-controls.tsx

@@ -0,0 +1,6 @@
+"use client";
+
+// MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.
+export function getModuleToolbarControls(_pathname: string, _projectsBaseHref: string) {
+  return null;
+}

package/template/supabase/modules/admin/migrations/20260729150000_bootstrap_first_admin_remove_force.sql

@@ -0,0 +1,116 @@
+-- Removes the p_force escape hatch from `bw admin create`.
+-- The 3-arg signature is already applied in production, so drop and recreate.
+
+DROP FUNCTION IF EXISTS public.bootstrap_first_admin(uuid, text, boolean);
+
+CREATE FUNCTION public.bootstrap_first_admin(
+  p_user_id uuid,
+  p_email text
+)
+RETURNS TABLE (
+  profile_id uuid,
+  previous_role_code text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, auth
+AS $$
+DECLARE
+  v_email text;
+  v_auth_email text;
+  v_profile_id uuid;
+  v_previous_role_code text;
+BEGIN
+  IF COALESCE(auth.jwt() ->> 'role', '') <> 'service_role' THEN
+    RAISE EXCEPTION 'bootstrap_first_admin requires service_role'
+      USING ERRCODE = '42501';
+  END IF;
+
+  v_email := NULLIF(lower(trim(COALESCE(p_email, ''))), '');
+  IF p_user_id IS NULL OR v_email IS NULL THEN
+    RAISE EXCEPTION 'A user id and email are required'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT lower(trim(u.email))
+  INTO v_auth_email
+  FROM auth.users u
+  WHERE u.id = p_user_id;
+
+  IF v_auth_email IS NULL OR v_auth_email <> v_email THEN
+    RAISE EXCEPTION 'Auth user and email do not match'
+      USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM pg_advisory_xact_lock(hashtextextended('brightweb:first-admin-bootstrap', 0));
+
+  IF EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments ura
+    WHERE ura.role_code = 'admin'
+  ) THEN
+    RAISE EXCEPTION 'A project administrator already exists'
+      USING ERRCODE = '42501';
+  END IF;
+
+  SELECT p.id
+  INTO v_profile_id
+  FROM public.profiles p
+  WHERE p.user_id = p_user_id
+  FOR UPDATE;
+
+  IF v_profile_id IS NULL THEN
+    IF EXISTS (
+      SELECT 1
+      FROM public.profiles p
+      WHERE lower(p.email) = v_email
+    ) THEN
+      RAISE EXCEPTION 'A profile already exists for this email'
+        USING ERRCODE = '23505';
+    END IF;
+
+    INSERT INTO public.profiles (user_id, email)
+    VALUES (p_user_id, v_email)
+    RETURNING id INTO v_profile_id;
+  ELSE
+    UPDATE public.profiles
+    SET email = v_email,
+        updated_at = now()
+    WHERE id = v_profile_id;
+  END IF;
+
+  SELECT ura.role_code
+  INTO v_previous_role_code
+  FROM public.user_role_assignments ura
+  WHERE ura.profile_id = v_profile_id
+  FOR UPDATE;
+
+  INSERT INTO public.user_role_assignments (
+    profile_id,
+    role_code,
+    assigned_by_profile_id,
+    assigned_at,
+    reason
+  )
+  VALUES (
+    v_profile_id,
+    'admin',
+    NULL,
+    now(),
+    'bw_admin_create_bootstrap'
+  )
+  ON CONFLICT (profile_id)
+  DO UPDATE SET
+    role_code = EXCLUDED.role_code,
+    assigned_by_profile_id = NULL,
+    assigned_at = EXCLUDED.assigned_at,
+    reason = EXCLUDED.reason;
+
+  RETURN QUERY SELECT v_profile_id, v_previous_role_code;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM anon;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.bootstrap_first_admin(uuid, text) TO service_role;

package/template/supabase/modules/marketing/migrations/20260729170000_marketing_webhook_transaction.sql

@@ -0,0 +1,106 @@
+create or replace function public.process_marketing_resend_webhook(
+  p_provider_event_id text,
+  p_event_type text,
+  p_provider_message_id text,
+  p_payload jsonb,
+  p_occurred_at timestamptz
+)
+returns table (duplicate boolean, event_type text, recipient_id uuid)
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  recipient public.marketing_campaign_recipients%rowtype;
+  inserted_event_id uuid;
+  suppression_reason text;
+  normalized_email text;
+begin
+  if nullif(trim(p_provider_message_id), '') is not null then
+    select * into recipient
+    from public.marketing_campaign_recipients
+    where provider_message_id = p_provider_message_id
+    order by id
+    limit 1;
+  end if;
+
+  insert into public.marketing_message_events (
+    campaign_id,
+    recipient_id,
+    contact_id,
+    provider,
+    event_type,
+    provider_event_id,
+    payload,
+    occurred_at
+  ) values (
+    recipient.campaign_id,
+    recipient.id,
+    recipient.contact_id,
+    'resend',
+    p_event_type,
+    nullif(trim(p_provider_event_id), ''),
+    p_payload,
+    coalesce(p_occurred_at, now())
+  )
+  on conflict (provider, provider_event_id) where provider_event_id is not null
+  do nothing
+  returning id into inserted_event_id;
+
+  if inserted_event_id is null then
+    return query select true, p_event_type, recipient.id;
+    return;
+  end if;
+
+  if recipient.id is not null and p_event_type in ('delivered', 'sent') then
+    update public.marketing_campaign_recipients
+    set status = 'sent',
+        sent_at = coalesce(p_occurred_at, now()),
+        error = null
+    where id = recipient.id;
+  elsif recipient.id is not null and p_event_type = 'failed' then
+    update public.marketing_campaign_recipients
+    set status = 'failed',
+        error = 'Resend reported delivery failure.'
+    where id = recipient.id;
+  elsif recipient.id is not null and p_event_type in ('bounced', 'complained', 'unsubscribed') then
+    suppression_reason := case p_event_type
+      when 'bounced' then 'bounced'
+      when 'complained' then 'complained'
+      else 'unsubscribed_all'
+    end;
+    normalized_email := lower(trim(recipient.email));
+
+    update public.marketing_campaign_recipients
+    set status = 'suppressed',
+        error = 'Resend reported ' || p_event_type || '.',
+        next_attempt_at = null
+    where id = recipient.id;
+
+    insert into public.marketing_suppressions (email, reason, source)
+    values (normalized_email, suppression_reason, 'resend_webhook')
+    on conflict (email) do update
+      set reason = excluded.reason,
+          source = excluded.source;
+
+    update public.marketing_campaign_recipients
+    set status = 'suppressed',
+        error = 'Email suppressed: ' || suppression_reason || '.',
+        next_attempt_at = null
+    where lower(trim(email)) = normalized_email
+      and status in ('queued', 'sending');
+
+    if recipient.contact_id is not null then
+      update public.marketing_subscriptions
+      set status = 'unsubscribed',
+          unsubscribed_at = coalesce(p_occurred_at, now())
+      where contact_id = recipient.contact_id;
+    end if;
+  end if;
+
+  return query select false, p_event_type, recipient.id;
+end;
+$$;
+
+revoke all on function public.process_marketing_resend_webhook(text, text, text, jsonb, timestamptz) from public;
+grant execute on function public.process_marketing_resend_webhook(text, text, text, jsonb, timestamptz) to service_role;