create-mithaq 0.0.0-stage → 0.2.0

package/template/templates/asas/mithaq.hints.json

@@ -0,0 +1,25 @@
+[
+  { "type": "rename", "kind": "column", "from": ["public", "tags", "name"], "to": ["public", "tags", "name_en"] },
+  { "type": "create", "kind": "column", "entity": ["public", "tags", "name_ar"] },
+  { "type": "rename", "kind": "index", "from": ["public", "tags", "tags_name_index"], "to": ["public", "tags", "tags_name_en_index"] },
+  { "type": "create", "kind": "index", "entity": ["public", "tags", "tags_name_ar_index"] },
+  { "type": "rename", "kind": "column", "from": ["public", "audit_log", "tenant_id"], "to": ["public", "audit_log", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "courses", "tenant_id"], "to": ["public", "courses", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "enrollments", "tenant_id"], "to": ["public", "enrollments", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "media", "tenant_id"], "to": ["public", "media", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "member_roles", "tenant_id"], "to": ["public", "member_roles", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "roles", "tenant_id"], "to": ["public", "roles", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "course_sessions", "tenant_id"], "to": ["public", "course_sessions", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "settings", "tenant_id"], "to": ["public", "settings", "organization_id"] },
+  { "type": "rename", "kind": "column", "from": ["public", "tags", "tenant_id"], "to": ["public", "tags", "organization_id"] },
+  { "type": "rename", "kind": "unique", "from": ["public", "settings", "settings_tenant_id_key"], "to": ["public", "settings", "settings_organization_id_key"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "audit_log", "audit_log_tenant_id_organization_id_fkey"], "to": ["public", "audit_log", "audit_log_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "courses", "courses_tenant_id_organization_id_fkey"], "to": ["public", "courses", "courses_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "enrollments", "enrollments_tenant_id_organization_id_fkey"], "to": ["public", "enrollments", "enrollments_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "media", "media_tenant_id_organization_id_fkey"], "to": ["public", "media", "media_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "member_roles", "member_roles_tenant_id_organization_id_fkey"], "to": ["public", "member_roles", "member_roles_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "roles", "roles_tenant_id_organization_id_fkey"], "to": ["public", "roles", "roles_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "course_sessions", "course_sessions_tenant_id_organization_id_fkey"], "to": ["public", "course_sessions", "course_sessions_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "settings", "settings_tenant_id_organization_id_fkey"], "to": ["public", "settings", "settings_organization_id_organization_id_fkey"] },
+  { "type": "rename", "kind": "foreign key", "from": ["public", "tags", "tags_tenant_id_organization_id_fkey"], "to": ["public", "tags", "tags_organization_id_organization_id_fkey"] }
+]

package/template/templates/asas/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "asas",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev:setup": "node --env-file-if-exists=.env src/dev-setup.ts",
+    "seed": "node --env-file-if-exists=.env src/seed.ts"
+  },
+  "exports": {
+    ".": "./src/asas.ts",
+    "./ui-dashboard/*": "./src/ui-dashboard/*",
+    "./messages/*": "./src/messages/*",
+    "./organizations": "./src/organizations.ts",
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@asas/audit-log": "*",
+    "@asas/auth": "*",
+    "@asas/courses": "*",
+    "@asas/media": "*",
+    "@asas/mithaq": "*",
+    "@asas/roles": "*",
+    "@asas/settings": "*",
+    "@asas/tags": "*",
+    "@lexical/extension": "0.52.0",
+    "@lexical/link": "0.52.0",
+    "@lexical/list": "0.52.0",
+    "@lexical/rich-text": "0.52.0",
+    "@orpc/openapi": "1.15.1",
+    "@orpc/server": "1.15.1",
+    "aws4fetch": "1.0.20",
+    "better-auth": "1.7.4",
+    "drizzle-orm": "1.0.0-rc.4",
+    "file-type": "22.0.1",
+    "image-dimensions": "2.5.1",
+    "jose": "6.2.12",
+    "lexical": "0.52.0",
+    "mithaq": "*",
+    "mithaq-admin": "*",
+    "pg-connection-string": "2.14.0",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@tanstack/react-query": "^5.104.0",
+    "@types/pg": "^8.15.6",
+    "@types/react": "^19.3.0",
+    "lucide-react": "^1.16.0",
+    "react": "^19.3.0",
+    "recharts": "3.8.0",
+    "typescript": "^7.0.2"
+  }
+}

package/template/templates/asas/src/asas.ts

@@ -0,0 +1,118 @@
+import { providerStatements } from '@asas/mithaq/auth'
+// Each feature is read through its index alone, as a namespace, so its list
+// (`courses.kayan`) never collides with a kayan of the same name.
+// add-on: audit-log
+import * as auditLog from '@asas/audit-log'
+// end add-on: audit-log
+import * as auth from '@asas/auth'
+// add-on: courses
+import * as courses from '@asas/courses'
+// end add-on: courses
+// add-on: media
+import * as media from '@asas/media'
+// end add-on: media
+// add-on: roles
+import * as roles from '@asas/roles'
+// end add-on: roles
+// add-on: settings
+import * as settings from '@asas/settings'
+// end add-on: settings
+import * as tags from '@asas/tags'
+import { defaultMaxBodyBytes, fetchHttp, Notice } from 'mithaq'
+import { orpcHttp } from 'mithaq/orpc'
+import { buildAsas, requestContext } from '@asas/mithaq'
+import { backofficeHttp } from './backoffice-http.ts'
+import { projectStatements } from '@asas/mithaq/roles/statements.ts'
+import { superAdmin } from '@asas/mithaq/roles/tenant-access.ts'
+
+/**
+ * Where a fault the build answers 500 to, or a strategy that threw, is reported: this project's
+ * log, the console. A project with an error tracker names it here. A `Notice` is expected, such
+ * as the build of a local auth kayan with no mailer, and prints as its one line; anything else
+ * prints with its stack.
+ */
+const report = (error: unknown) => console.error(error instanceof Notice ? error.message : error)
+
+export const asas = buildAsas({
+  kayan: [
+    ...auth.kayan,
+    // add-on: roles
+    ...roles.kayan,
+    // end add-on: roles
+    ...tags.kayan,
+    // add-on: media
+    // An image is read by a holder of `media.create`, and otherwise through
+    // what the features pointing at images say of it.
+    ...media.kayan({
+      // add-on: courses
+      reads: [courses.coverReads],
+      // end add-on: courses
+      // without add-on: courses
+      // reads: [],
+      // end without add-on: courses
+    }),
+    // end add-on: media
+    // add-on: courses
+    ...courses.kayan,
+    // end add-on: courses
+    // add-on: audit-log
+    ...auditLog.kayan,
+    // end add-on: audit-log
+  ],
+  global: [
+    // add-on: settings
+    ...settings.global,
+    // end add-on: settings
+  ],
+  // The HTTP layer, a list the handler asks in order. `orpcHttp` is first
+  // because it owns `/api/rpc`, where a typed client would reach the build, and
+  // because `asas.router` is the first plug's. It also claims `/api`, so the
+  // plain plug behind it answers only what oRPC's own OpenAPI arm matched
+  // nothing for; it is listed so a build that drops the typed client keeps plain
+  // HTTP by deleting one line. Core picks no plug of its own, so a build that
+  // leaves `http` out is refused.
+  // Each plug is handed the same context function, so a step reads the same
+  // bag whichever plug served it.
+  // The backoffice's rename of an organization sits between them, before the
+  // plain plug would read `/api/backoffice/*` as a kayan's route.
+  // A fault either plug answers 500 is handed to `report`; core reports none of its own.
+  // A body past `maxBodyBytes` is answered 413 before it is read whole.
+  http: [
+    orpcHttp({ context: (request, actor) => ({ actor, ...requestContext(request) }), onError: report, maxBodyBytes: defaultMaxBodyBytes }),
+    backofficeHttp(),
+    fetchHttp({ context: requestContext, onError: report, maxBodyBytes: defaultMaxBodyBytes }),
+  ],
+  // Better Auth's own actions, which no declaration of this project derives.
+  // They join the catalog under the resources they name, so a role holds
+  // `invitation.cancel` or `user.impersonate` exactly as it holds
+  // `tags.find`, and the hooks in @asas/mithaq/auth ask for them under whichever
+  // store this project turned on. `organization.rename` is this project's own,
+  // the key the backoffice's rename route asks, which is neither the
+  // provider's `organization.update` nor the managed kayan's, both of which
+  // share that name. The project's own keys beside a kayan's operations are
+  // listed with the role form that offers them.
+  statements: { ...providerStatements, organization: [...providerStatements.organization, 'rename'], ...projectStatements },
+  // `onError` hears a strategy that threw and an access target that could not
+  // answer, which the build reports nowhere of its own.
+  //
+  // `admin.access` is the answer `/api/access` reports as `canAccessAdmin`:
+  // `true` for a super admin in the backoffice app, `false` for every other
+  // actor. The local `unlock` endpoint asks the same answer of the caller local
+  // auth alone resolves, which is never a Better Auth super admin, so it stays
+  // closed.
+  //
+  // The administrator is a super admin in the backoffice app and nobody else: the
+  // one who verifies a local sign-up. A kayan with no callback of its own falls
+  // to this answer, so every table Better Auth alone writes closes itself.
+  auth: { admin: { kayan: auth.user, access: superAdmin }, onError: report, maxBodyBytes: defaultMaxBodyBytes },
+})
+
+// The backoffice slug, the screen the backoffice app serves, the reader that
+// answers the backoffice roles, and the tenant app's link to the backoffice, for a
+// host.
+export { BACKOFFICE, BACKOFFICE_SCREEN, assignedRoles, backofficeEntry } from '@asas/mithaq/roles/tenant-access.ts'
+// What the backoffice app wraps every request it serves in, whether a request is
+// one of those, and where each app is served: re-exported here so a host reaches
+// the one instance of the store behind it through the same module the build reads.
+export { asBackoffice, onBackoffice, backofficeURL, tenantURL } from '@asas/mithaq/auth'
+export type { Language } from '@asas/mithaq'

package/template/templates/asas/src/backoffice-http.ts

@@ -0,0 +1,117 @@
+// The backoffice screen's one action no managed operation carries: renaming an
+// organization and its slug. An organization has no admin route for staff:
+// every route of Better Auth's organization plugin acts as a member of that
+// organization, which staff are not, and the managed `organization` kayan
+// writes nothing, because Better Auth owns the table and the tenant's `'*'`
+// row, which every backoffice role takes too, names no update. So the rename is
+// this one route of the project's own, refused without `organization.rename`,
+// a key of the project's own that only `super_admin` holds, and audited in the
+// line every admin route of the backoffice writes.
+//
+// Deleting an organization, removing a member and changing a member's
+// governance role stay out: each is irreversible or passes the plugin's own
+// owner rules by, and staff do each by impersonating a member, which is
+// audited under the real person's name.
+import { AsasError, actorPermissions, conflict, denied, invalid, missing, retryConflict, type HttpPlug } from 'mithaq'
+import { namesOf, oneLine, backofficeRoles } from '@asas/mithaq/auth'
+import { organizations as mode } from '@asas/mithaq/auth/organizations'
+import { targets } from '@asas/mithaq'
+import { assignedRoles, type OrganizationActor } from '@asas/mithaq/roles/tenant-access.ts'
+
+const path = '/api/backoffice/organizations/update'
+/**
+ * The project's own key, not `organization.update`: that name is both the
+ * provider's action and the managed kayan's update, which the rows refuse to
+ * everyone.
+ */
+const key = 'organization.rename'
+
+const slugShape = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+
+/**
+ * The longest name and slug a rename writes. The columns are unbounded `text`,
+ * so the caps are this route's own: a name as long as the auth setup lets a
+ * founder write one, and a slug that fits in a URL segment.
+ */
+const most = { name: 100, slug: 64 }
+
+/** The names `written` holds as the auth setup keeps them, or `null` where it refuses them. */
+const namedOrNull = (written: unknown) => {
+  try {
+    return namesOf(written)
+  } catch {
+    return null
+  }
+}
+
+/** The body the shipped plain plug answers every refusal with. */
+const codes: Record<number, string> = { 400: 'BAD_REQUEST', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 409: 'CONFLICT' }
+const refusal = (thrown: AsasError) =>
+  Response.json({ code: codes[thrown.status], data: { key: thrown.key, params: thrown.params }, message: thrown.message }, { status: thrown.status })
+
+/**
+ * Answers the route only for an actor the template's reader gave a backoffice
+ * role holding `organization.rename`, which it does in the backoffice app alone:
+ * `'*'` inside a tenant is a tenant's and renames nothing here. The body is
+ * `{ id, names, slug }`, a name per locale with the default locale's required,
+ * or `{ id, name, slug }`, the default locale's alone; a slug another
+ * organization holds is the store's own 409. With one organization its name
+ * lives in code, so the route renames nothing: `organizations` is the project's
+ * mode, which a test sets.
+ */
+export const backofficeHttp = ({ organizations }: { organizations: 'one' | 'many' } = { organizations: mode }) => (): HttpPlug => ({
+  name: 'backoffice',
+  router: undefined,
+  handle: async (request, who) => {
+    if (request.method !== 'POST' || new URL(request.url).pathname !== path) return null
+    try {
+      const actor = (await who()) as (OrganizationActor & { id?: string }) | null
+      const held = actorPermissions(actor)
+      const staff = !!actor && assignedRoles(actor).some((slug) => Object.hasOwn(backofficeRoles, slug))
+      if (!staff || !(held === true || held?.has(key))) {
+        throw denied({ message: `Forbidden: renaming an organization is the backoffice's, and it asks "${key}".`, key: 'error.forbidden.permission', params: { permission: key } })
+      }
+      // JSON alone, so a form another site posts, which a browser sends with
+      // no preflight, is never read as one.
+      const body = request.headers.get('content-type')?.startsWith('application/json') ? ((await request.json().catch(() => null)) as Record<string, unknown> | null) : null
+      if (organizations === 'one') {
+        throw conflict({ message: 'With one organization its name lives in code: organizationName in src/mithaq/auth/organizations.ts. Change it there and deploy.', key: 'error.conflict.organization_name_in_code' })
+      }
+      const id = body?.id
+      const slug = typeof body?.slug === 'string' ? body.slug.trim() : ''
+      // Each locale's name is the auth setup's own rule, so a rename keeps what a founder may write and no more.
+      const names = body?.names === undefined ? undefined : namedOrNull(body.names)
+      const name = names ? names.name : typeof body?.name === 'string' ? body.name.trim() : ''
+      // A name is one line: mail bodies carry it, where a break would be a line of the writer's own.
+      if (typeof id !== 'string' || !id || names === null || !name || name.length > most.name || new RegExp(oneLine.source, 'u').test(name) || !slugShape.test(slug) || slug.length > most.slug) {
+        throw invalid({
+          message: `An organization is renamed with its id, a name of one line and at most ${most.name} characters, and a slug of at most ${most.slug} lowercase letters, digits and hyphens.`,
+          key: 'error.invalid.value',
+        })
+      }
+      const store = targets.drizzle
+      // The row is found and written under one lock, so a delete between the
+      // two answers 404 rather than failing the write. `FOR UPDATE`, not `FOR NO
+      // KEY UPDATE`: the slug is unique, and the lock is taken before we know whether it changes.
+      await store.transaction(async (tx) => {
+        const found = await store.find({ kayan: 'organization', args: { limit: 1, lock: 'update', page: 1, sort: { field: 'id', direction: 'asc' }, where: { id: { equals: id } } }, tx })
+        if (!found.docs.length) throw missing({ message: `No organization "${id}".`, key: 'error.not_found.row', params: { kayan: 'organization' } })
+        await store.update({ tx, kayan: 'organization', id, data: { name, ...(names && { names: names.names }), slug, updatedAt: new Date() } })
+      })
+      // The line `backofficeAudit` writes for an admin route, under this route's own name.
+      console.log(JSON.stringify({
+        audit: 'backoffice',
+        action: '/backoffice/organizations/update',
+        actor: actor.id ?? null,
+        impersonatedBy: actor.impersonatedBy ?? null,
+        target: id,
+        at: new Date().toISOString(),
+      }))
+      return Response.json({ id, name, slug })
+    } catch (thrown) {
+      thrown = retryConflict(thrown)
+      if (thrown instanceof AsasError) return refusal(thrown)
+      throw thrown
+    }
+  },
+})

package/template/templates/asas/src/dev-setup.ts

@@ -0,0 +1,112 @@
+// Makes a fresh development database usable in one command: pushes the schema,
+// makes the dev admin that DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD name, and
+// with --seed fills its organization.
+//
+//   bun run dev:setup [--seed]
+//
+// The dev admin owns an organization and, where the project serves the backoffice
+// console, is its super_admin, with a proved address, so it signs in to both
+// apps at once. A development tool only: it refuses production, a database on
+// another machine, and a database that already holds a user.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import { getTableConfig, type PgTable } from 'drizzle-orm/pg-core'
+import { organizations as mode } from '@asas/mithaq/auth/organizations'
+import { databaseOf } from './local-database.ts'
+
+function refuse(reason: string): never {
+  console.error(`Refusing dev:setup: ${reason}`)
+  process.exit(1)
+}
+
+const { values } = parseArgs({ options: { seed: { type: 'boolean' } } })
+// Checked before the build is imported, since the import is what reads them.
+if (!process.env.DATABASE_URL) refuse('set DATABASE_URL to the development database to set up.')
+if (process.env.NODE_ENV && process.env.NODE_ENV !== 'development') refuse(`NODE_ENV is ${process.env.NODE_ENV}, and it sets up a development database only.`)
+// The account it makes signs in with a password every project's .env.example
+// holds, so it is made on this machine's database alone.
+const at = databaseOf(process.env.DATABASE_URL)
+if (!at) refuse('DATABASE_URL is not a connection string pg reads.')
+const { database, local } = at
+if (!local) refuse(`DATABASE_URL names ${database}, which is not this machine.`)
+const { DEV_ADMIN_EMAIL: email, DEV_ADMIN_PASSWORD: password } = process.env
+if (!email || !password) refuse('set DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD in .env, as .env.example does.')
+// Unset is development here, and the auth setup reads it: on this machine
+// first-run then asks no setup code, as it does under `vite dev`.
+Object.assign(process.env, { NODE_ENV: 'development' })
+
+const { asas } = await import('./asas.ts')
+const { isLocalHost, backofficeApp, backofficeURL, tenantURL } = await import('@asas/mithaq/auth')
+// A deploy run with plain `node` sets no NODE_ENV and may hold its database on this machine; its address is what
+// tells it apart, as the auth setup reads it, so an app served elsewhere gets no dev admin.
+for (const [variable, url] of [['BETTER_AUTH_URL', tenantURL], ...(backofficeApp ? [['BACKOFFICE_URL', backofficeURL]] : [])] as const) {
+  if (!isLocalHost(url)) refuse(`${variable} names ${url}, which is not this machine.`)
+}
+const signIn = `Sign in at ${tenantURL}${backofficeApp ? ` or ${backofficeURL}` : ''}`
+type Row = Record<string, unknown> & { id: string }
+const { db, tables } = asas.targets.drizzle as unknown as { db: { $client: { query(text: string, values?: unknown[]): Promise<{ rows: Record<string, unknown>[] }> } }; tables: Record<'user' | 'organization', PgTable> }
+const client = db.$client
+/** A table of the build's own, as SQL names it. */
+const named = (table: PgTable) => {
+  const { schema = 'public', name } = getTableConfig(table)
+  return [schema, name].map((part) => `"${part.replaceAll('"', '""')}"`).join('.')
+}
+// The provider's own routes and adapter: the generated auth kayan answer no
+// operation to anyone.
+const server = (asas.auth.strategies.find((strategy) => strategy.name === 'user') as unknown as {
+  server: {
+    $context: Promise<{
+      password: { hash(password: string): Promise<string>; config: { minPasswordLength: number; maxPasswordLength: number } }
+      internalAdapter: {
+        createUser(user: Record<string, unknown>): Promise<Row>
+        linkAccount(account: { userId: string; providerId: string; accountId: string; password: string }): Promise<unknown>
+      }
+    }>
+    api: {
+      firstRun(input: { body: Record<string, string> }): Promise<{ organization: { id: string } }>
+      createOrganization(input: { body: { name: string; slug: string; userId: string } }): Promise<{ id: string }>
+    }
+  }
+}).server
+const name = 'Dev admin'
+const workspace = `${name}'s workspace`
+try {
+  // Asked before the push, so a database someone already uses is never changed by it.
+  const users = named(tables.user)
+  const [table] = (await client.query('select to_regclass($1) is not null as held', [users])).rows
+  if (table!.held && (await client.query(`select exists (select 1 from ${users}) as held`)).rows[0]!.held) {
+    refuse(`the database already holds a user. ${signIn} as DEV_ADMIN_EMAIL with DEV_ADMIN_PASSWORD from .env, or as the account you made.`)
+  }
+  const auth = await server.$context
+  // First-run asks the same of its owner; the path with many makes the account itself, so it asks here.
+  const { minPasswordLength: min, maxPasswordLength: max } = auth.password.config
+  if (password.length < min || password.length > max) refuse(`DEV_ADMIN_PASSWORD holds ${min} to ${max} characters.`)
+  await asas.connect()
+  let organization: string
+  if (mode === 'one') {
+    // First-run's own path: the owner, the one organization and, with the backoffice console, its super_admin.
+    organization = (await server.api.firstRun({ body: { name, email, password } })).organization.id
+  } else {
+    // With many, an account proves its address by a mailed link and then founds its organization; the dev admin is
+    // made proved, as first-run makes its owner, and its workspace made for it, as the page of someone in none would.
+    const user = await auth.internalAdapter.createUser({ name, email, emailVerified: true, ...(backofficeApp && { role: 'super_admin' }) })
+    await auth.internalAdapter.linkAccount({ userId: user.id, providerId: 'credential', accountId: user.id, password: await auth.password.hash(password) })
+    organization = (await server.api.createOrganization({ body: { name: workspace, slug: 'dev-admin-workspace', userId: user.id } })).id
+  }
+  // Read back, since first-run names the organization from code (`organizationName`).
+  const [made] = (await client.query(`select name from ${named(tables.organization)} where id = $1`, [organization])).rows
+  console.log(`Made the dev admin, owner of "${String(made!.name)}"${backofficeApp ? ' and backoffice super_admin' : ''}. ${signIn} with DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD from .env.`)
+} finally {
+  await asas.destroy()
+}
+
+if (values.seed) {
+  // The seed names whose organization it fills by address, which stays in .env, in any case: the provider stores it
+  // lowercased.
+  const seeded = spawnSync(process.execPath, [fileURLToPath(new URL('./seed.ts', import.meta.url))], { env: { ...process.env, SEED_EMAIL: email }, stdio: ['inherit', 'pipe', 'pipe'], encoding: 'utf8' })
+  const address = new RegExp(email.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi')
+  process.stdout.write(seeded.stdout.replace(address, 'DEV_ADMIN_EMAIL'))
+  process.stderr.write(seeded.stderr.replace(address, 'DEV_ADMIN_EMAIL'))
+  process.exitCode = seeded.status ?? 1
+}

package/template/templates/asas/src/local-database.ts

@@ -0,0 +1,22 @@
+import { parse } from 'pg-connection-string'
+
+/**
+ * The database `url` names, as `host:port/name`, and whether it is on this machine, for the scripts that write to a
+ * development database; nothing when pg cannot read it. Read by pg's own parser, so the guard and the connection never
+ * disagree on the host, and a host left out is pg's default. Nothing of the URL is repeated on a failure, since it
+ * holds the password.
+ */
+export const databaseOf = (url: string) => {
+  let config: ReturnType<typeof parse>
+  try {
+    config = parse(url)
+  } catch {
+    return undefined
+  }
+  const host = config.host || process.env.PGHOST || 'localhost'
+  return {
+    database: `${host}:${config.port || process.env.PGPORT || '5432'}/${config.database ?? ''}`,
+    // A path is a socket on this machine.
+    local: host.startsWith('/') || ['localhost', '127.0.0.1', '::1', '[::1]'].includes(host),
+  }
+}

package/template/templates/asas/src/messages/account.json

@@ -0,0 +1,132 @@
+{
+  "accessToken": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "accessTokenExpiresAt": {
+    "invalid": {
+      "ar": "هذا ليس تاريخا ووقتا.",
+      "en": "This is not a date and time."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "accountId": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "createdAt": {
+    "invalid": {
+      "ar": "هذا ليس تاريخا ووقتا.",
+      "en": "This is not a date and time."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "id": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "idToken": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "password": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "providerId": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "refreshToken": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "refreshTokenExpiresAt": {
+    "invalid": {
+      "ar": "هذا ليس تاريخا ووقتا.",
+      "en": "This is not a date and time."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "scope": {
+    "invalid": {
+      "ar": "هذا ليس نصا.",
+      "en": "This is not text."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "updatedAt": {
+    "invalid": {
+      "ar": "هذا ليس تاريخا ووقتا.",
+      "en": "This is not a date and time."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  },
+  "userId": {
+    "invalid": {
+      "ar": "اختر عنصرًا من القائمة.",
+      "en": "Pick one of the listed entries."
+    },
+    "required": {
+      "ar": "هذا الحقل مطلوب.",
+      "en": "This field is required."
+    }
+  }
+}