create-kuckit-app 0.3.5 → 0.4.0

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as createProject } from "./create-project-CP-h4Ygi.js";
+import { t as createProject } from "./create-project-geQBZ0Ru.js";
 import { program } from "commander";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{create-project-CP-h4Ygi.js → create-project-geQBZ0Ru.js}

@@ -73,6 +73,11 @@ Next steps:
   bun run db:migrate       # Run database migrations
   bun run dev              # Start development server
 
+Deploy to GCP:
+
+  bun add -D @kuckit/infra-gcp
+  bunx kuckit infra up     # One-command deploy
+
 Inside that directory, you can run:
 
   bun run dev        Start the development server

package/dist/index.js

@@ -1,3 +1,3 @@
-import { t as createProject } from "./create-project-CP-h4Ygi.js";
+import { t as createProject } from "./create-project-geQBZ0Ru.js";
 
 export { createProject };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "create-kuckit-app",
-	"version": "0.3.5",
+	"version": "0.4.0",
 	"description": "Create a new Kuckit application",
 	"type": "module",
 	"license": "MIT",

package/templates/base/.claude/skills/kuckit/SKILL.md

@@ -193,14 +193,34 @@ export const kuckitClientModule = defineKuckitClientModule({
 
 ### Module package.json Metadata
 
+Modules depend on `@kuckit/*` npm packages:
+
 ```json
 {
 	"name": "@acme/billing-module",
+	"version": "0.1.0",
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./client": "./src/client-module.ts"
+	},
+	"peerDependencies": {
+		"@kuckit/sdk": "^1.0.0",
+		"@kuckit/sdk-react": "^1.0.0",
+		"typescript": "^5"
+	},
+	"dependencies": {
+		"@kuckit/api": "^1.0.0",
+		"@orpc/server": "^1.10.0",
+		"@orpc/zod": "^1.10.0",
+		"drizzle-orm": "^0.44.0",
+		"zod": "^3.23.0",
+		"react": "^19.0.0"
+	},
 	"kuckit": {
 		"id": "acme.billing",
 		"server": "./dist/module.js",
-		"client": "./dist/client/module.js",
-		"schema": "./src/server/schema/index.ts"
+		"client": "./dist/client-module.js"
 	}
 }
 ```

package/templates/base/.claude/skills/kuckit/references/MODULE-DEVELOPMENT.md

@@ -6,50 +6,61 @@ Complete guide for developing Kuckit modules.
 
 ### Generated Module Layout
 
+Modules follow Clean Architecture internally with all layers self-contained:
+
 ```
 packages/billing-module/
 ├── src/
-│   ├── module.ts              # Server module definition
-│   ├── index.ts               # Public exports
-│   ├── client/
-│   │   ├── module.ts          # Client module definition
-│   │   └── index.ts           # Client exports
-│   └── server/
-│       ├── schema/
-│       │   └── index.ts       # Drizzle schema
-│       ├── repositories/
-│       │   └── invoice.ts     # Repository implementations
-│       └── use-cases/
-│           └── create-invoice.ts
-├── package.json
+│   ├── domain/
+│   │   └── billing.entity.ts       # Zod schema for entity
+│   ├── ports/
+│   │   └── billing.repository.ts   # Repository interface
+│   ├── adapters/
+│   │   └── billing.drizzle.ts      # Drizzle implementation
+│   ├── usecases/
+│   │   ├── list-billings.ts
+│   │   ├── get-billing.ts
+│   │   ├── create-billing.ts
+│   │   └── delete-billing.ts
+│   ├── api/
+│   │   └── billings.router.ts      # oRPC router
+│   ├── ui/
+│   │   └── BillingsPage.tsx        # React component
+│   ├── module.ts                   # Server module
+│   ├── client-module.ts            # Client module
+│   └── index.ts
+├── package.json                    # Uses @kuckit/* from npm
 └── tsconfig.json
 ```
 
 ### package.json Metadata
 
+Modules depend on `@kuckit/*` npm packages:
+
 ```json
 {
 	"name": "@acme/billing-module",
 	"version": "1.0.0",
 	"type": "module",
-	"kuckit": {
-		"id": "acme.billing",
-		"server": "./dist/module.js",
-		"client": "./dist/client/module.js",
-		"schema": "./src/server/schema/index.ts"
-	},
 	"exports": {
-		".": {
-			"import": "./dist/index.js",
-			"types": "./dist/index.d.ts"
-		},
-		"./client": {
-			"import": "./dist/client/index.js",
-			"types": "./dist/client/index.d.ts"
-		}
+		".": "./src/index.ts",
+		"./client": "./src/client-module.ts"
 	},
 	"peerDependencies": {
-		"@kuckit/sdk": ">=0.1.0"
+		"@kuckit/sdk": "^1.0.0",
+		"@kuckit/sdk-react": "^1.0.0",
+		"typescript": "^5"
+	},
+	"dependencies": {
+		"@kuckit/api": "^1.0.0",
+		"@orpc/server": "^1.10.0",
+		"drizzle-orm": "^0.44.0",
+		"zod": "^3.23.0"
+	},
+	"kuckit": {
+		"id": "acme.billing",
+		"server": "./dist/module.js",
+		"client": "./dist/client-module.js"
 	}
 }
 ```

package/templates/base/.claude/skills/kuckit/references/PACKAGES.md

@@ -1,67 +1,82 @@
 # Kuckit Package Reference
 
-Quick reference for all packages in the Kuckit monorepo.
-
-## Package Locations
-
-| Package                 | Path                                                                 | Description                          |
-| ----------------------- | -------------------------------------------------------------------- | ------------------------------------ |
-| @kuckit/sdk             | `/Users/themrb/Documents/personal/kuckit/packages/sdk`               | Backend DI container & module system |
-| @kuckit/sdk-react       | `/Users/themrb/Documents/personal/kuckit/packages/sdk-react`         | Frontend module system               |
-| @kuckit/cli             | `/Users/themrb/Documents/personal/kuckit/packages/kuckit-cli`        | CLI tooling                          |
-| create-kuckit-app       | `/Users/themrb/Documents/personal/kuckit/packages/create-kuckit-app` | Project scaffolding                  |
-| @kuckit/domain          | `/Users/themrb/Documents/personal/kuckit/packages/domain`            | Business entities                    |
-| @kuckit/application     | `/Users/themrb/Documents/personal/kuckit/packages/application`       | Use cases                            |
-| @kuckit/contracts       | `/Users/themrb/Documents/personal/kuckit/packages/contracts`         | DTOs & Zod schemas                   |
-| @kuckit/infrastructure  | `/Users/themrb/Documents/personal/kuckit/packages/infrastructure`    | Repository implementations           |
-| @kuckit/api             | `/Users/themrb/Documents/personal/kuckit/packages/api`               | oRPC procedures                      |
-| @kuckit/db              | `/Users/themrb/Documents/personal/kuckit/packages/db`                | Drizzle ORM schemas                  |
-| @kuckit/auth            | `/Users/themrb/Documents/personal/kuckit/packages/auth`              | Better-Auth config                   |
-| @kuckit/infra           | `/Users/themrb/Documents/personal/kuckit/packages/infra`             | Pulumi infrastructure                |
-| @kuckit/users-module    | `/Users/themrb/Documents/personal/kuckit/packages/users-module`      | Reference module                     |
-| @kuckit/landing-module  | `/Users/themrb/Documents/personal/kuckit/packages/landing-module`    | Landing page module                  |
-| @kuckit/cli-auth-module | `/Users/themrb/Documents/personal/kuckit/packages/cli-auth-module`   | CLI auth module                      |
-
-## Key Files Per Package
+Quick reference for all `@kuckit/*` packages from npm.
+
+## Framework Packages
+
+These are installed from npm as dependencies, not copied into your project:
+
+| Package             | Description                                            |
+| ------------------- | ------------------------------------------------------ |
+| `@kuckit/sdk`       | Server-side module system, DI container, core services |
+| `@kuckit/sdk-react` | Client-side module system, hooks, providers            |
+| `@kuckit/api`       | oRPC procedures (publicProcedure, protectedProcedure)  |
+| `@kuckit/db`        | Drizzle ORM utilities and connection                   |
+| `@kuckit/auth`      | Better-Auth configuration                              |
+| `@kuckit/domain`    | Base types, Logger, Clock interfaces                   |
+| `@kuckit/contracts` | Shared DTOs and Zod schemas                            |
+
+## Your Project Structure
+
+```
+your-app/
+├── apps/
+│   ├── server/              # Express bootstrap (imports @kuckit/* from npm)
+│   └── web/                 # React bootstrap (imports @kuckit/* from npm)
+├── packages/
+│   └── your-module/         # Your modules with Clean Architecture
+├── node_modules/
+│   └── @kuckit/             # Framework packages from npm
+├── package.json             # Lists @kuckit/* deps
+└── drizzle.config.ts        # Points to @kuckit/db + module schemas
+```
+
+## Key Files Per Framework Package
 
 ### @kuckit/sdk
 
-| File                           | Purpose                       |
-| ------------------------------ | ----------------------------- |
-| `src/index.ts`                 | Public exports                |
-| `src/core/container.ts`        | DI container creation         |
-| `src/core/core.module.ts`      | Core services registration    |
-| `src/modules/define-module.ts` | `defineKuckitModule()` helper |
-| `src/modules/loader.ts`        | Module loading logic          |
-| `src/modules/types.ts`         | Module type definitions       |
-| `src/config/loader.ts`         | Configuration loading         |
-| `src/schema/registry.ts`       | Schema registry               |
-
-### @kuckit/cli
-
-| File                              | Purpose                        |
-| --------------------------------- | ------------------------------ |
-| `src/bin.ts`                      | CLI entry point (Commander.js) |
-| `src/commands/generate-module.ts` | Module scaffolding             |
-| `src/commands/add-module.ts`      | Module installation            |
-| `src/commands/discover-module.ts` | Module discovery               |
-| `src/commands/doctor.ts`          | Project validation             |
-| `src/commands/auth.ts`            | Authentication commands        |
-| `src/commands/db.ts`              | Database commands              |
-| `src/commands/infra/*.ts`         | Infrastructure commands        |
-| `src/lib/credentials.ts`          | Token storage                  |
-| `src/lib/sdk-loader.ts`           | Dynamic SDK loading            |
+| Export                  | Purpose                  |
+| ----------------------- | ------------------------ |
+| `createKuckitContainer` | DI container creation    |
+| `loadKuckitModules`     | Module loading           |
+| `defineKuckitModule`    | Server module definition |
+| `disposeContainer`      | Container cleanup        |
+| `asClass`, `asFunction` | DI registration helpers  |
+| `asValue`               | DI value registration    |
 
 ### @kuckit/sdk-react
 
-| File                                  | Purpose                  |
-| ------------------------------------- | ------------------------ |
-| `src/modules/define-client-module.ts` | Client module definition |
-| `src/modules/loader.ts`               | Client module loading    |
-| `src/registries/route-registry.ts`    | Route management         |
-| `src/registries/nav-registry.ts`      | Navigation management    |
-| `src/registries/slot-registry.ts`     | UI slot management       |
-| `src/context/*.ts`                    | React context providers  |
+| Export                     | Purpose                  |
+| -------------------------- | ------------------------ |
+| `defineKuckitClientModule` | Client module definition |
+| `loadKuckitClientModules`  | Client module loading    |
+| `KuckitNavProvider`        | Navigation provider      |
+| `useKuckitNav`             | Navigation hook          |
+| `useRpc`                   | RPC client hook          |
+
+### @kuckit/api
+
+| Export               | Purpose                 |
+| -------------------- | ----------------------- |
+| `publicProcedure`    | Public oRPC procedure   |
+| `protectedProcedure` | Auth-required procedure |
+| `createContext`      | oRPC context factory    |
+| `appRouter`          | Base app router         |
+
+### @kuckit/db
+
+| Export       | Purpose                    |
+| ------------ | -------------------------- |
+| `createDb`   | Drizzle instance factory   |
+| `createPool` | PostgreSQL pool factory    |
+| `authSchema` | Better-Auth schema exports |
+
+### @kuckit/auth
+
+| Export       | Purpose               |
+| ------------ | --------------------- |
+| `auth`       | Better-Auth instance  |
+| `authClient` | Client auth utilities |
 
 ## Import Patterns
 
@@ -83,30 +98,35 @@ import {
 	loadKuckitClientModules,
 	KuckitNavProvider,
 	useKuckitNav,
+	useRpc,
 } from '@kuckit/sdk-react'
 
-// CLI programmatic usage
-import { generateModule, addModule, discoverModules } from '@kuckit/cli'
+// API imports (for modules)
+import { protectedProcedure, publicProcedure } from '@kuckit/api'
 
-// Domain imports (from within the monorepo)
-import { User, type UserPort } from '@kuckit/domain'
-
-// Contracts imports
-import { CreateUserInput, UserDTO, createUserSchema } from '@kuckit/contracts'
+// Database imports
+import { createDb, createPool } from '@kuckit/db/connection'
 ```
 
 ## Package Dependencies
 
 ### What Each Package Can Import
 
-| Package        | Allowed Imports                |
-| -------------- | ------------------------------ |
-| domain         | (none - pure business logic)   |
-| contracts      | zod                            |
-| application    | domain                         |
-| infrastructure | domain, external libs          |
-| api            | domain, application, contracts |
-| sdk            | all core packages, awilix      |
-| sdk-react      | sdk types                      |
-| server         | ALL packages                   |
-| web            | sdk-react, contracts           |
+| Package      | Allowed Imports                 |
+| ------------ | ------------------------------- |
+| Your modules | @kuckit/\* packages, zod        |
+| apps/server  | @kuckit/\*, your modules        |
+| apps/web     | @kuckit/sdk-react, your modules |
+
+### Module Internal Layers
+
+Within your modules, follow Clean Architecture:
+
+| Layer    | Can Import                    |
+| -------- | ----------------------------- |
+| domain   | (none - pure Zod schemas)     |
+| ports    | domain                        |
+| usecases | domain, ports                 |
+| adapters | domain, drizzle-orm           |
+| api      | domain, usecases, @kuckit/api |
+| ui       | @kuckit/sdk-react, react      |

package/templates/base/AGENTS.md

@@ -5,7 +5,7 @@
 ```bash
 bun install              # Install dependencies
 docker compose up -d     # Start PostgreSQL
-bun run db:migrate       # Run database migrations
+bun run db:push          # Sync schema to database (dev) or db:migrate (prod)
 bun run dev              # Start dev servers (web + server)
 ```
 
@@ -17,15 +17,15 @@ __APP_NAME_KEBAB__/
 │   ├── server/              # Express + oRPC backend (port 3000)
 │   └── web/                 # React + TanStack Router frontend (port 3001)
 ├── packages/
-│   ├── api/                 # Shared API context and types
-│   ├── auth/                # Better-Auth configuration
-│   ├── db/                  # Drizzle ORM, migrations, schema
 │   └── items-module/        # Example Kuckit module (reference implementation)
 ├── .env.example             # Environment template
 ├── docker-compose.yml       # PostgreSQL container
+├── drizzle.config.ts        # Drizzle pointing to @kuckit/db + module schemas
 └── turbo.json               # Turborepo configuration
 ```
 
+**Note:** Core packages (`api`, `auth`, `db`, `domain`, `contracts`) are installed from npm as `@kuckit/*` dependencies, not copied into your project.
+
 ## Module Development
 
 Kuckit uses a **module-based architecture** where each module contains its own Clean Architecture layers internally.
@@ -47,15 +47,21 @@ packages/your-module/
 
 ### Creating a New Module
 
-1. Copy `packages/items-module` as a template
-2. Rename and update `package.json`
-3. Implement your domain entities in `domain/`
-4. Define repository interfaces in `ports/`
-5. Implement adapters in `adapters/`
-6. Create use cases in `usecases/`
-7. Expose API in `api/` via oRPC router
-8. Register module in `apps/server/src/config/modules.ts`
-9. Add client module to `apps/web/src/modules.client.ts`
+```bash
+bunx kuckit generate module your-module
+```
+
+This scaffolds a full Clean Architecture module. Then:
+
+1. Implement your domain entities in `domain/`
+2. Define repository interfaces in `ports/`
+3. Implement adapters in `adapters/`
+4. Create use cases in `usecases/`
+5. Expose API in `api/` via oRPC router
+6. Register module in `apps/server/src/config/modules.ts`
+7. Add client module to `apps/web/src/modules.client.ts`
+8. Add schema path to `drizzle.config.ts` in project root
+9. Run `bun run db:push` to create the table
 
 ### Dependency Rules
 
@@ -256,6 +262,26 @@ export const wireModuleRpcRouters = (registrations: ApiRegistration[]) => {
 }
 ```
 
+### REST Router Pattern
+
+For modules that need direct Express response access (e.g., AI streaming with `pipeUIMessageStreamToResponse`), use REST routers instead of oRPC:
+
+```typescript
+// In your module's registerApi()
+ctx.addApiRegistration({
+	type: 'rest-router',
+	name: 'ai',
+	router: createAiRouter(),
+	prefix: '/ai', // Optional, defaults to /<name>
+})
+```
+
+REST routers are mounted at `/api<prefix>` (e.g., `/api/ai/chat`). They receive:
+
+- Per-request scoped container via `req.scope`
+- Session via `req.scope.cradle.session`
+- Full Express `Request` and `Response` objects
+
 ### Typing DI in Routers
 
 Use a module-local interface to type `context.di.cradle`:
@@ -284,14 +310,14 @@ export const invoicesRouter = {
 
 ### Add a new database table
 
-1. Define schema in your module's `adapters/` or `packages/db/src/schema/`
+1. Define schema in your module's `adapters/` directory
 2. Run `bun run db:generate`
 3. Run `bun run db:migrate`
 
 ### Add authentication to an endpoint
 
 ```typescript
-import { protectedProcedure } from '@__APP_NAME_KEBAB__/api'
+import { protectedProcedure } from '@kuckit/api'
 
 export const myRouter = {
 	protectedRoute: protectedProcedure.input(mySchema).handler(async ({ input, context }) => {
@@ -363,12 +389,12 @@ See `.env.example` for required variables:
 
 **Cause**: Module schema not registered in `drizzle.config.ts`.
 
-**Fix**: Add the module's schema path to `packages/db/drizzle.config.ts`:
+**Fix**: Add the module's schema path to `drizzle.config.ts` (in project root):
 
 ```typescript
 schema: [
-	resolve(currentDirPath, './src/schema'),
-	resolve(currentDirPath, '../your-module/src/adapters/schema.drizzle.ts'),
+	'./node_modules/@kuckit/db/dist/schema/auth.js',
+	'./packages/your-module/src/adapters',
 ],
 ```
 

package/templates/base/apps/server/AGENTS.md

@@ -8,14 +8,16 @@ Express backend hosting oRPC API, Better-Auth authentication, and the Kuckit mod
 
 ## Key Files
 
-| File                     | Purpose                    |
-| ------------------------ | -------------------------- |
-| `server.ts`              | Entry point, bootstrap     |
-| `container.ts`           | DI container setup         |
-| `config/modules.ts`      | Module registration        |
-| `rpc.ts`                 | oRPC handler setup         |
-| `rpc-router-registry.ts` | Mutable router for modules |
-| `auth.ts`                | Better-Auth configuration  |
+| File                      | Purpose                    |
+| ------------------------- | -------------------------- |
+| `server.ts`               | Entry point, bootstrap     |
+| `container.ts`            | DI container setup         |
+| `config/modules.ts`       | Module registration        |
+| `rpc.ts`                  | oRPC handler setup         |
+| `rpc-router-registry.ts`  | Mutable router for modules |
+| `rest-router-registry.ts` | REST router collection     |
+| `module-rest-routes.ts`   | REST router wiring         |
+| `auth.ts`                 | Better-Auth configuration  |
 
 ## Module Loading Sequence
 
@@ -26,10 +28,11 @@ The server bootstraps in this order:
 2. loadKuckitModules() with onApiRegistrations callback:
    ├─► register() hooks run (DI bindings)
    ├─► registerApi() hooks run (routers collected)
-   ├─► onApiRegistrations() - Wire routers to rootRpcRouter
+   ├─► onApiRegistrations() - Wire RPC and REST routers
    └─► onBootstrap() hooks run (startup logic)
 3. setupRPC() - Create RPCHandler AFTER modules loaded
-4. Express listens
+4. setupModuleRestRouters() - Mount REST routers to Express
+5. Express listens
 ```
 
 ## Router Registry Pattern
@@ -56,12 +59,34 @@ await loadKuckitModules({
 	modules: getModuleSpecs(),
 	onApiRegistrations: (registrations) => {
 		wireModuleRpcRouters(registrations) // Wire BEFORE setupRPC()
+		collectModuleRestRouters(registrations) // Collect REST routers
 	},
 })
 
 setupRPC(app) // Now create handler with fully-wired router
+setupModuleRestRouters(app) // Mount REST routers at /api/<name>
 ```
 
+## REST Router Pattern
+
+For modules that need direct Express response access (e.g., AI streaming), use REST routers:
+
+```typescript
+// In your module's registerApi()
+ctx.addApiRegistration({
+	type: 'rest-router',
+	name: 'ai',
+	router: createAiRouter(),
+	prefix: '/ai', // Optional, defaults to /<name>
+})
+```
+
+REST routers are mounted at `/api<prefix>` (e.g., `/api/ai/chat`). They receive:
+
+- Per-request scoped container via `req.scope`
+- Session via `req.scope.cradle.session`
+- Full Express `Request` and `Response` objects
+
 ## Per-Request Scoping
 
 Each HTTP request gets a scoped container with:

package/templates/base/apps/server/package.json

@@ -10,17 +10,17 @@
 	"dependencies": {
 		"express": "^5.1.0",
 		"cors": "^2.8.5",
-		"dotenv": "^17.2.2",
+		"dotenv": "^17.0.0",
 		"awilix": "^12.0.5",
 		"pg": "^8.14.1",
 		"@orpc/server": "^1.10.0",
 		"@orpc/zod": "^1.10.0",
-		"better-auth": "^1.3.28",
-		"zod": "^4.1.11",
-		"@kuckit/sdk": "^1.0.0",
-		"@__APP_NAME_KEBAB__/api": "workspace:*",
-		"@__APP_NAME_KEBAB__/auth": "workspace:*",
-		"@__APP_NAME_KEBAB__/db": "workspace:*"
+		"better-auth": "^1.3.0",
+		"zod": "^3.23.0",
+		"@kuckit/sdk": "^2.0.0",
+		"@kuckit/api": "^2.0.0",
+		"@kuckit/auth": "^2.0.0",
+		"@kuckit/db": "^2.0.0"
 	},
 	"devDependencies": {
 		"@types/express": "^5.0.1",

package/templates/base/apps/server/src/auth.ts

@@ -1,4 +1,4 @@
-import { auth } from '@__APP_NAME_KEBAB__/auth'
+import { auth } from '@kuckit/auth'
 import { toNodeHandler } from 'better-auth/node'
 import type { Express } from 'express'
 

package/templates/base/apps/server/src/container.ts

@@ -6,9 +6,10 @@ import {
 	type CoreCradle,
 } from '@kuckit/sdk'
 import type { Pool } from 'pg'
-import { ensureDatabaseUrl } from '@__APP_NAME_KEBAB__/db/connection'
+import { ensureDatabaseUrl } from '@kuckit/db/connection'
 import { getModuleSpecs } from './config/modules'
 import { wireModuleRpcRouters } from './rpc-router-registry'
+import { collectModuleRestRouters } from './rest-router-registry'
 
 /**
  * Server configuration
@@ -60,6 +61,7 @@ export const buildRootContainer = async (): Promise<AppContainer> => {
 		modules: getModuleSpecs(),
 		onApiRegistrations: (registrations) => {
 			wireModuleRpcRouters(registrations)
+			collectModuleRestRouters(registrations)
 			console.log(`Loaded ${registrations.length} API registrations from modules`)
 		},
 		onComplete: () => {

package/templates/base/apps/server/src/module-rest-routes.ts

@@ -0,0 +1,47 @@
+import type { Express, Request, Response, NextFunction } from 'express'
+import express from 'express'
+import { asValue } from 'awilix'
+import { fromNodeHeaders } from 'better-auth/node'
+import { auth } from '@kuckit/auth'
+import { getRestRouters } from './rest-router-registry'
+
+/**
+ * Middleware to add session to request scope for REST routes.
+ * Similar to createContext for RPC, but for Express routes.
+ */
+const sessionMiddleware = async (req: Request, _res: Response, next: NextFunction) => {
+	if (!req.scope) {
+		return next(new Error('Request scope not initialized'))
+	}
+
+	try {
+		const session = await auth.api.getSession({
+			headers: fromNodeHeaders(req.headers),
+		})
+
+		req.scope.register({
+			session: asValue(session),
+		})
+
+		next()
+	} catch (error) {
+		console.error('[REST Auth] Failed to get session:', error)
+		req.scope.register({
+			session: asValue(null),
+		})
+		next()
+	}
+}
+
+/**
+ * Setup REST routers from modules.
+ * Must be called after container middleware is initialized.
+ */
+export const setupModuleRestRouters = (app: Express): void => {
+	const routers = getRestRouters()
+
+	for (const { name, router, basePath } of routers) {
+		app.use(`/api${basePath}`, express.json(), sessionMiddleware, router)
+		console.log(`[REST] Mounted module router: /api${basePath} (${name})`)
+	}
+}