create-mithaq 0.0.0-stage → 0.1.1

package/template/apps/asas-tanstack/src/server.ts

@@ -0,0 +1,16 @@
+import handler, { createServerEntry } from '@tanstack/react-start/server-entry'
+import { withQuietAbort } from './quiet-abort.ts'
+
+// A production start connects once before handing on any request, and `connect()` refuses to
+// start while a migration is unapplied; a refused start exits 1. NODE_ENV is read off `process`
+// so Vite cannot replace it at build time, and a built server started without
+// `NODE_ENV=production` never connects, which would push into the deploy's database.
+const { env } = process
+if (env.NODE_ENV === 'production') {
+  await (await import('asas')).asas.connect().catch((error: unknown) => {
+    console.error(error)
+    process.exit(1)
+  })
+}
+
+export default createServerEntry({ fetch: (request: Request) => handler.fetch(withQuietAbort(request)) })

package/template/apps/asas-tanstack/src/slide.ts

@@ -0,0 +1,22 @@
+/**
+ * The provider's own session read, which refreshes a session past its `updateAge` and forwards the cookie.
+ * Run it before the actor is resolved: a read that refreshes the row first leaves this one nothing due.
+ */
+export const slide = async ({
+  strategies,
+  headers,
+  setResponseHeader,
+}: {
+  strategies: readonly unknown[]
+  headers: Headers
+  setResponseHeader: (name: 'set-cookie', value: string[]) => void
+}) => {
+  const cookies: string[] = []
+  for (const strategy of strategies) {
+    const read = (strategy as { server?: { api?: { getSession?: (args: object) => Promise<{ headers: Headers }> } } }).server?.api?.getSession
+    if (read) cookies.push(...(await read({ headers, returnHeaders: true })).headers.getSetCookie())
+  }
+  // Set once with every strategy's cookies: a second set replaces the first.
+  if (cookies.length) setResponseHeader('set-cookie', cookies)
+}
+// mithaq-admin b06d8d335d306c07556f8f2b81fba20ba7ded198 bc0221e1088103f8638e0333b84aafb6b326e3991a187ced198bce2d090ecbe9

package/template/apps/asas-tanstack/src/start.ts

@@ -0,0 +1,57 @@
+import { createCsrfMiddleware, createMiddleware, createStart } from '@tanstack/react-start'
+import { dirOf, localeCookie, localeOf } from './copy.ts'
+
+// The locale is resolved once per request, before any route runs, because the document's `lang`
+// and `dir` are written before a loader exists. Nothing here imports
+// `@tanstack/react-start/server`: both builds reach this entry, so it would put server code in the client.
+
+/** No `decodeURIComponent`: the only caller refuses every value but two ASCII names. */
+const cookieOf = (header: string | null, name: string): string | undefined =>
+  header
+    ?.split(';')
+    .map((one) => one.trim().split('='))
+    .find(([key]) => key === name)
+    ?.slice(1)
+    .join('=')
+
+/**
+ * The request's locale and direction, off the `locale` cookie alone: `Accept-Language` is not a
+ * choice the viewer made.
+ */
+const locale = createMiddleware({ type: 'request' }).server(({ request, next }) => {
+  const asked = localeOf(cookieOf(request.headers.get('cookie'), localeCookie))
+  return next({ context: { locale: asked, dir: dirOf(asked) } })
+})
+
+/** Refuses a server function reached from outside the page; page renders and `/api` are untouched. */
+const csrf = createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === 'serverFn' })
+
+/**
+ * `/admin` answers a 308 to the same path under `/dashboard`, so a saved link still lands with its
+ * method and body. The location is a path, never a URL, so the request's host header never reaches it.
+ */
+const moved = createMiddleware({ type: 'request' }).server(({ request, next }) => {
+  const url = new URL(request.url)
+  if (!/^\/admin(\/|$)/.test(url.pathname)) return next()
+  return new Response(null, { status: 308, headers: { location: `/dashboard${url.pathname.slice('/admin'.length)}${url.search}` } })
+})
+
+/**
+ * Only this origin may frame this app's pages, so no other site can lay it under its own page and
+ * steer a click. First, so it covers every other middleware's answer; rebuilt, since a redirect's
+ * headers are immutable.
+ */
+const framing = createMiddleware({ type: 'request' }).server(async ({ next }) => {
+  const result = await next()
+  const answer = result.response
+  const html = answer.headers.get('content-type')?.startsWith('text/html') === true
+  if (answer.headers.has('content-security-policy') && !html) return result
+  const headers = new Headers(answer.headers)
+  if (!headers.has('content-security-policy')) headers.set('content-security-policy', "frame-ancestors 'self'")
+  // No HTML answer is cached: each is drawn for one request's session and locale, so a page
+  // someone signed out of must not come back from the cache on Back.
+  if (html) headers.set('cache-control', 'no-store')
+  return { ...result, response: new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers }) }
+})
+
+export const startInstance = createStart(() => ({ requestMiddleware: [framing, moved, csrf, locale] }))

package/template/apps/asas-tanstack/src/styles.css

@@ -0,0 +1,159 @@
+/* Theme copied wholesale from tanstack-business:apps/web/src/styles.css:
+   imports, custom-variant, :root and .dark variables, the @theme inline
+   block and the @layer base rules, unchanged. Only the @source line below
+   differs, pointing at this project's template instead of TB's monorepo.
+   Tailwind finds this app's own files, the copied `src/components/mithaq`
+   among them, without one. */
+@import 'tailwindcss';
+@import 'tw-animate-css';
+@import 'shadcn/tailwind.css';
+@import '@fontsource-variable/raleway';
+@import '@fontsource/ibm-plex-sans-arabic';
+
+/* The project's own shells, pages and components, which the screens load
+   through the same linked package (`templates/asas/src/ui/app-shell.tsx`). */
+@source '../node_modules/asas/src';
+
+@custom-variant dark (&:is(.dark *));
+
+:root {
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.147 0.004 49.25);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.147 0.004 49.25);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.147 0.004 49.25);
+  --primary: oklch(0.216 0.006 56.043);
+  --primary-foreground: oklch(0.985 0.001 106.423);
+  --secondary: oklch(0.97 0.001 106.424);
+  --secondary-foreground: oklch(0.216 0.006 56.043);
+  --muted: oklch(0.97 0.001 106.424);
+  --muted-foreground: oklch(0.553 0.013 58.071);
+  --accent: oklch(0.97 0.001 106.424);
+  --accent-foreground: oklch(0.216 0.006 56.043);
+  /* Darker than the preset's red 600, which is 4.0:1 on the pale red fill the destructive button and menu item draw it on and 3.3:1 on its hover; this is 5.9:1 on the fill and 4.9:1 on the hover. */
+  --destructive: oklch(0.48 0.2 27.5);
+  --border: oklch(0.923 0.003 48.717);
+  --input: oklch(0.923 0.003 48.717);
+  --ring: oklch(0.709 0.01 56.259);
+  --chart-1: oklch(0.646 0.222 41.116);
+  --chart-2: oklch(0.6 0.118 184.704);
+  --chart-3: oklch(0.398 0.07 227.392);
+  --chart-4: oklch(0.828 0.189 84.429);
+  --chart-5: oklch(0.769 0.188 70.08);
+  --radius: 0.625rem;
+  --sidebar: oklch(0.985 0.001 106.423);
+  --sidebar-foreground: oklch(0.147 0.004 49.25);
+  --sidebar-primary: oklch(0.216 0.006 56.043);
+  --sidebar-primary-foreground: oklch(0.985 0.001 106.423);
+  --sidebar-accent: oklch(0.97 0.001 106.424);
+  --sidebar-accent-foreground: oklch(0.216 0.006 56.043);
+  --sidebar-border: oklch(0.923 0.003 48.717);
+  --sidebar-ring: oklch(0.709 0.01 56.259);
+}
+
+.dark {
+  --background: oklch(0.147 0.004 49.25);
+  --foreground: oklch(0.985 0.001 106.423);
+  --card: oklch(0.216 0.006 56.043);
+  --card-foreground: oklch(0.985 0.001 106.423);
+  --popover: oklch(0.216 0.006 56.043);
+  --popover-foreground: oklch(0.985 0.001 106.423);
+  --primary: oklch(0.923 0.003 48.717);
+  --primary-foreground: oklch(0.216 0.006 56.043);
+  --secondary: oklch(0.268 0.007 34.298);
+  --secondary-foreground: oklch(0.985 0.001 106.423);
+  --muted: oklch(0.268 0.007 34.298);
+  --muted-foreground: oklch(0.709 0.01 56.259);
+  --accent: oklch(0.268 0.007 34.298);
+  --accent-foreground: oklch(0.985 0.001 106.423);
+  --destructive: oklch(0.704 0.191 22.216);
+  --border: oklch(1 0 0 / 10%);
+  --input: oklch(1 0 0 / 15%);
+  --ring: oklch(0.553 0.013 58.071);
+  --chart-1: oklch(0.488 0.243 264.376);
+  --chart-2: oklch(0.696 0.17 162.48);
+  --chart-3: oklch(0.769 0.188 70.08);
+  --chart-4: oklch(0.627 0.265 303.9);
+  --chart-5: oklch(0.645 0.246 16.439);
+  --sidebar: oklch(0.216 0.006 56.043);
+  --sidebar-foreground: oklch(0.985 0.001 106.423);
+  --sidebar-primary: oklch(0.488 0.243 264.376);
+  --sidebar-primary-foreground: oklch(0.985 0.001 106.423);
+  --sidebar-accent: oklch(0.268 0.007 34.298);
+  --sidebar-accent-foreground: oklch(0.985 0.001 106.423);
+  --sidebar-border: oklch(1 0 0 / 10%);
+  --sidebar-ring: oklch(0.553 0.013 58.071);
+}
+
+@theme inline {
+  --font-sans: 'IBM Plex Sans Arabic', 'Raleway', sans-serif;
+  --color-sidebar-ring: var(--sidebar-ring);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar: var(--sidebar);
+  --color-chart-5: var(--chart-5);
+  --color-chart-4: var(--chart-4);
+  --color-chart-3: var(--chart-3);
+  --color-chart-2: var(--chart-2);
+  --color-chart-1: var(--chart-1);
+  --color-ring: var(--ring);
+  --color-input: var(--input);
+  --color-border: var(--border);
+  --color-destructive: var(--destructive);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-accent: var(--accent);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-muted: var(--muted);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-secondary: var(--secondary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-primary: var(--primary);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-popover: var(--popover);
+  --color-card-foreground: var(--card-foreground);
+  --color-card: var(--card);
+  --color-foreground: var(--foreground);
+  --color-background: var(--background);
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
+  --radius-2xl: calc(var(--radius) + 8px);
+  --radius-3xl: calc(var(--radius) + 12px);
+  --radius-4xl: calc(var(--radius) + 16px);
+}
+
+@layer base {
+  * {
+    @apply border-border outline-ring/50;
+  }
+  body {
+    @apply font-sans bg-background text-foreground;
+  }
+  html {
+    @apply font-sans;
+  }
+}
+
+/* Fix: Make dropdown menu roots not affect layout */
+[data-slot='dropdown-menu'] {
+  display: contents;
+}
+
+/* Fix: Ensure sidebar menu action dropdowns don't affect layout */
+/* Fix: Ensure sidebar menu action dropdowns don't affect layout
+   Note: This was causing issues with SidebarMenuAction positioning. Removing display: contents from trigger.
+*/
+/* [data-sidebar='menu-item'] > [data-slot='dropdown-menu-trigger'] {
+  display: contents;
+} */
+
+/* Fix: Ensure sidebar footer content spans full width */
+[data-sidebar='footer'] [data-slot='dropdown-menu-trigger'] {
+  width: 100%;
+}

package/template/apps/asas-tanstack/src/theme.ts

@@ -0,0 +1,5 @@
+/**
+ * Where the chosen theme is remembered. The React provider and the blocking head script both
+ * read it, and disagreeing would flash the wrong theme on first paint.
+ */
+export const themeStorageKey = 'vite-ui-theme'

package/template/apps/asas-tanstack/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "es2024",
+    "lib": ["es2024", "dom", "dom.iterable"],
+    "module": "preserve",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "erasableSyntaxOnly": true,
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "types": ["node", "vite/client"],
+    "paths": { "@/*": ["./src/*"] }
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx", "vite.config.ts", "../../templates/asas/src/ui/*.tsx", "../../templates/asas/src/ui-*/*.tsx", "../../templates/asas/src/*/ui/*.tsx"]
+}

package/template/apps/asas-tanstack/vite.config.ts

@@ -0,0 +1,28 @@
+import tailwindcss from '@tailwindcss/vite'
+import { tanstackStart } from '@tanstack/react-start/plugin/vite'
+import viteReact from '@vitejs/plugin-react'
+import { defineConfig } from 'vite'
+import { fileURLToPath } from 'node:url'
+
+export default defineConfig({
+  // An alias rather than `resolve.tsconfigPaths`, which applies only to files the nearest
+  // tsconfig claims: the project's shells in `templates/asas/src` import `@/` too.
+  // `^@/` and not `@`, so `@tanstack/*` is left alone.
+  resolve: { alias: [{ find: /^@\//, replacement: fileURLToPath(new URL('./src/', import.meta.url)) }] },
+  plugins: [
+    tailwindcss(),
+    // `mithaq generate screens` writes `types.ts` and `files.ts` beside the route files, and neither is a route.
+    tanstackStart({ router: { routeFileIgnorePattern: '^(files|types)\\.ts$' } }),
+    viteReact(),
+  ],
+  environments: {
+    ssr: {
+      // `asas` and `mithaq` stay external: the drizzle adapter imports `drizzle-kit/api-postgres`
+      // behind a `webpackIgnore` comment Vite does not honour, and bundled, the build fails on
+      // drizzle's optional peers. The dev server reads `resolve.external`, the build reads
+      // `build.rollupOptions.external`, so both are set.
+      resolve: { external: ['asas', 'mithaq'] },
+      build: { rollupOptions: { external: [/^asas$/, /^mithaq(\/|$)/] } },
+    },
+  },
+})

package/template/package.json

@@ -0,0 +1,16 @@
+{
+  "private": true,
+  "type": "module",
+  "packageManager": "bun@1.3.14",
+  "engines": {
+    "node": ">=24"
+  },
+  "workspaces": [
+    "templates/*",
+    "apps/*"
+  ],
+  "devDependencies": {
+    "typescript": "^7.0.2",
+    "@types/node": "^24.12.3"
+  }
+}

package/template/templates/asas/.env.example

@@ -0,0 +1,16 @@
+# The settings a development machine runs with (`README.md` "Environment").
+# create-mithaq writes a copy as `.env` here, in `apps/asas-tanstack` and in
+# `apps/asas-platform`, with the same fresh secrets in each. `bun <file>` (and
+# so `bun run seed`), `bun -e` and the apps' Vite read it; the `mithaq` bin,
+# which runs under Node, does not. A variable the shell already sets wins.
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/mithaq
+# 32 characters at least. Unset, every POST under /api/auth/local answers 503.
+LOCAL_AUTH_SECRET=
+BETTER_AUTH_SECRET=
+BETTER_AUTH_URL=http://localhost:5173
+PLATFORM_URL=http://localhost:5174
+# Required in production; development defaults them, the secret to a new
+# random one on every start.
+# STORAGE_SECRET=
+# STORAGE_PREFIX=mithaq/asas
+# STORAGE_ADAPTER=local

package/template/templates/asas/components.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "base-maia",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "",
+    "baseColor": "stone",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "hugeicons",
+  "rtl": true,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  }
+}

package/template/templates/asas/mithaq.hints.json

@@ -0,0 +1,25 @@
+[
+  { "type": "rename", "kind": "column", "from": ["public", "tags", "name"], "to": ["public", "tags", "name_en"] },
+  { "type": "create", "kind": "column", "entity": ["public", "tags", "name_ar"] },
+  { "type": "rename", "kind": "index", "from": ["public", "tags", "tags_name_index"], "to": ["public", "tags", "tags_name_en_index"] },
+  { "type": "create", "kind": "index", "entity": ["public", "tags", "tags_name_ar_index"] },
+  { "type": "rename", "kind": "column", "from": ["public", "audit_log", "tenant_id"], "to": ["public", "audit_log", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "courses", "tenant_id"], "to": ["public", "courses", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "enrollments", "tenant_id"], "to": ["public", "enrollments", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "media", "tenant_id"], "to": ["public", "media", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "member_roles", "tenant_id"], "to": ["public", "member_roles", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "roles", "tenant_id"], "to": ["public", "roles", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "course_sessions", "tenant_id"], "to": ["public", "course_sessions", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "settings", "tenant_id"], "to": ["public", "settings", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "tags", "tenant_id"], "to": ["public", "tags", "organization_id"] },
+  { "type": "rename", "kind": "unique", "from": ["public", "settings", "settings_tenant_id_key"], "to": ["public", "settings", "settings_organization_id_key"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "audit_log", "audit_log_tenant_id_organization_id_fkey"], "to": ["public", "audit_log", "audit_log_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "courses", "courses_tenant_id_organization_id_fkey"], "to": ["public", "courses", "courses_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "enrollments", "enrollments_tenant_id_organization_id_fkey"], "to": ["public", "enrollments", "enrollments_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "media", "media_tenant_id_organization_id_fkey"], "to": ["public", "media", "media_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "member_roles", "member_roles_tenant_id_organization_id_fkey"], "to": ["public", "member_roles", "member_roles_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "roles", "roles_tenant_id_organization_id_fkey"], "to": ["public", "roles", "roles_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "course_sessions", "course_sessions_tenant_id_organization_id_fkey"], "to": ["public", "course_sessions", "course_sessions_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "settings", "settings_tenant_id_organization_id_fkey"], "to": ["public", "settings", "settings_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "tags", "tags_tenant_id_organization_id_fkey"], "to": ["public", "tags", "tags_organization_id_organization_id_fkey"] }
+]

package/template/templates/asas/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "asas",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "seed": "bun src/seed.ts"
+  },
+  "exports": {
+    ".": "./src/asas.ts",
+    "./ui-dashboard/*": "./src/ui-dashboard/*",
+    "./audit-log/*": "./src/audit-log/*",
+    "./messages/*": "./src/messages/*",
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@asas/auth": "*",
+    "@orpc/openapi": "1.15.1",
+    "@orpc/server": "1.15.1",
+    "aws4fetch": "1.0.20",
+    "better-auth": "1.7.4",
+    "drizzle-orm": "1.0.0-rc.4",
+    "file-type": "22.0.1",
+    "image-dimensions": "2.5.1",
+    "jose": "6.2.12",
+    "mithaq": "*",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@tanstack/react-query": "^5.104.0",
+    "@types/pg": "^8.15.6",
+    "@types/react": "^19.3.0",
+    "lucide-react": "^1.16.0",
+    "mithaq-admin": "*",
+    "react": "^19.3.0",
+    "recharts": "3.8.0"
+  }
+}

package/template/templates/asas/src/asas.ts

@@ -0,0 +1,93 @@
+import { providerStatements } from '@asas/auth'
+// Written by `mithaq generate auth`: one key per plugin the vocabulary names,
+// and `core` for the four Better Auth ships without one. Spreading the keys is
+// what keeps this list from naming eight files, and a project that drops the
+// organization plugin drops one spread.
+import { betterAuth } from './kayan/auth/user/index.ts'
+import { user } from './kayan/auth/user/user.ts'
+import { auditLog } from './audit-log/audit-log.ts'
+import { courses } from './courses/courses.ts'
+import { enrollments } from './enrollments/enrollments.ts'
+import { localUsers } from './local-users/local-users.ts'
+import { memberRoles } from './member-roles/member-roles.ts'
+import { roles } from './roles/roles.ts'
+import { sessions } from './sessions/sessions.ts'
+import { tags } from './tags/tags.ts'
+import { settings } from './settings/settings.ts'
+import { media } from './media/media.ts'
+import { fetchHttp, Notice } from 'mithaq'
+import { orpcHttp } from 'mithaq/orpc'
+import { buildAsas, requestContext } from './mithaq.ts'
+import { platformHttp } from './platform-http.ts'
+import { projectStatements } from './statements.ts'
+import { superAdmin } from './tenant-access.ts'
+
+export const asas = buildAsas({
+  kayan: [
+    ...betterAuth.core,
+    ...betterAuth.organization,
+    localUsers,
+    roles,
+    memberRoles,
+    tags,
+    media,
+    courses,
+    sessions,
+    enrollments,
+    auditLog,
+  ],
+  global: [settings],
+  // The HTTP layer, a list the handler asks in order. `orpcHttp()` is first
+  // because it owns `/api/rpc`, where a typed client would reach the build, and
+  // because `asas.router` is the first plug's. It also claims `/api`, so the
+  // plain plug behind it answers only what oRPC's own OpenAPI arm matched
+  // nothing for; it is listed so a build that drops the typed client keeps plain
+  // HTTP by deleting one line. Core picks no plug of its own, so a build that
+  // leaves `http` out is refused.
+  // Each plug is handed the same context function, so a step reads the same
+  // bag whichever plug served it.
+  // The platform's rename of an organization sits between them, before the
+  // plain plug would read `/api/platform/*` as a kayan's route.
+  // A fault either plug answers 500 is written to this project's log, the
+  // console, as `fetchHttp`'s default does; the oRPC plug takes no default.
+  http: [
+    orpcHttp({ context: (request, actor) => ({ actor, ...requestContext(request) }), onError: (error) => console.error(error) }),
+    platformHttp(),
+    fetchHttp({ context: requestContext }),
+  ],
+  // Better Auth's own actions, which no declaration of this project derives.
+  // They join the catalog under the resources they name, so a role holds
+  // `invitation.cancel` or `user.impersonate` exactly as it holds
+  // `courses.find`, and the hooks in @asas/auth ask for them under whichever
+  // store this project turned on. `organization.rename` is this project's own,
+  // the key the platform's rename route asks, which is neither the
+  // provider's `organization.update` nor the managed kayan's, both of which
+  // share that name. The project's own keys beside a kayan's operations are
+  // listed with the role form that offers them.
+  statements: { ...providerStatements, organization: [...providerStatements.organization, 'rename'], ...projectStatements },
+  // `onError` hears a strategy that threw and an access target that could not
+  // answer, which the build reports nowhere of its own. The console is this
+  // project's log; a project with an error tracker names it here. A `Notice`
+  // is expected, such as the build of a local auth kayan with no mailer, and
+  // prints as its one line; anything else prints with its stack.
+  //
+  // `admin.access` is the answer `/api/access` reports as `canAccessAdmin`:
+  // `true` for a super admin in the platform app, `false` for every other
+  // actor. The local `unlock` endpoint asks the same answer of the caller local
+  // auth alone resolves, which is never a Better Auth super admin, so it stays
+  // closed.
+  //
+  // The administrator is a super admin in the platform app and nobody else: the
+  // one who verifies a local sign-up. A kayan with no callback of its own falls
+  // to this answer, so every table Better Auth alone writes closes itself.
+  auth: { admin: { kayan: user, access: superAdmin }, onError: (error) => console.error(error instanceof Notice ? error.message : error) },
+})
+
+// The platform slug, the screen the platform app serves, the reader that
+// answers the platform roles, and the tenant app's link to the platform, for a
+// host.
+export { PLATFORM, PLATFORM_SCREEN, assignedRoles, platformEntry } from './tenant-access.ts'
+// What the platform app wraps every request it serves in, whether a request is
+// one of those, and where each app is served: re-exported here so a host reaches
+// the one instance of the store behind it through the same module the build reads.
+export { asPlatform, onPlatform, platformURL, tenantURL } from '@asas/auth'