create-mithaq 0.1.1 → 0.2.1

package/template/templates/asas/package.json

@@ -4,17 +4,29 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "seed": "bun src/seed.ts"
+    "dev:setup": "node --env-file-if-exists=.env src/dev-setup.ts",
+    "seed": "node --env-file-if-exists=.env src/seed.ts"
   },
   "exports": {
     ".": "./src/asas.ts",
     "./ui-dashboard/*": "./src/ui-dashboard/*",
-    "./audit-log/*": "./src/audit-log/*",
     "./messages/*": "./src/messages/*",
+    "./organizations": "./src/organizations.ts",
     "./package.json": "./package.json"
   },
   "dependencies": {
+    "@asas/audit-log": "*",
     "@asas/auth": "*",
+    "@asas/courses": "*",
+    "@asas/media": "*",
+    "@asas/mithaq": "*",
+    "@asas/roles": "*",
+    "@asas/settings": "*",
+    "@asas/tags": "*",
+    "@lexical/extension": "0.52.0",
+    "@lexical/link": "0.52.0",
+    "@lexical/list": "0.52.0",
+    "@lexical/rich-text": "0.52.0",
     "@orpc/openapi": "1.15.1",
     "@orpc/server": "1.15.1",
     "aws4fetch": "1.0.20",
@@ -23,7 +35,10 @@
     "file-type": "22.0.1",
     "image-dimensions": "2.5.1",
     "jose": "6.2.12",
+    "lexical": "0.52.0",
     "mithaq": "*",
+    "mithaq-admin": "*",
+    "pg-connection-string": "2.14.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
@@ -31,8 +46,8 @@
     "@types/pg": "^8.15.6",
     "@types/react": "^19.3.0",
     "lucide-react": "^1.16.0",
-    "mithaq-admin": "*",
     "react": "^19.3.0",
-    "recharts": "3.8.0"
+    "recharts": "3.8.0",
+    "typescript": "^7.0.2"
   }
 }

package/template/templates/asas/src/asas.ts

@@ -1,43 +1,70 @@
-import { providerStatements } from '@asas/auth'
-// Written by `mithaq generate auth`: one key per plugin the vocabulary names,
-// and `core` for the four Better Auth ships without one. Spreading the keys is
-// what keeps this list from naming eight files, and a project that drops the
-// organization plugin drops one spread.
-import { betterAuth } from './kayan/auth/user/index.ts'
-import { user } from './kayan/auth/user/user.ts'
-import { auditLog } from './audit-log/audit-log.ts'
-import { courses } from './courses/courses.ts'
-import { enrollments } from './enrollments/enrollments.ts'
-import { localUsers } from './local-users/local-users.ts'
-import { memberRoles } from './member-roles/member-roles.ts'
-import { roles } from './roles/roles.ts'
-import { sessions } from './sessions/sessions.ts'
-import { tags } from './tags/tags.ts'
-import { settings } from './settings/settings.ts'
-import { media } from './media/media.ts'
-import { fetchHttp, Notice } from 'mithaq'
+import { providerStatements } from '@asas/mithaq/auth'
+// Each feature is read through its index alone, as a namespace, so its list
+// (`courses.kayan`) never collides with a kayan of the same name.
+// add-on: audit-log
+import * as auditLog from '@asas/audit-log'
+// end add-on: audit-log
+import * as auth from '@asas/auth'
+// add-on: courses
+import * as courses from '@asas/courses'
+// end add-on: courses
+// add-on: media
+import * as media from '@asas/media'
+// end add-on: media
+// add-on: roles
+import * as roles from '@asas/roles'
+// end add-on: roles
+// add-on: settings
+import * as settings from '@asas/settings'
+// end add-on: settings
+import * as tags from '@asas/tags'
+import { defaultMaxBodyBytes, fetchHttp, Notice } from 'mithaq'
 import { orpcHttp } from 'mithaq/orpc'
-import { buildAsas, requestContext } from './mithaq.ts'
-import { platformHttp } from './platform-http.ts'
-import { projectStatements } from './statements.ts'
-import { superAdmin } from './tenant-access.ts'
+import { buildAsas, requestContext } from '@asas/mithaq'
+import { backofficeHttp } from './backoffice-http.ts'
+import { projectStatements } from '@asas/mithaq/roles/statements.ts'
+import { superAdmin } from '@asas/mithaq/roles/tenant-access.ts'
+
+/**
+ * Where a fault the build answers 500 to, or a strategy that threw, is reported: this project's
+ * log, the console. A project with an error tracker names it here. A `Notice` is expected, such
+ * as the build of a local auth kayan with no mailer, and prints as its one line; anything else
+ * prints with its stack.
+ */
+const report = (error: unknown) => console.error(error instanceof Notice ? error.message : error)
 
 export const asas = buildAsas({
   kayan: [
-    ...betterAuth.core,
-    ...betterAuth.organization,
-    localUsers,
-    roles,
-    memberRoles,
-    tags,
-    media,
-    courses,
-    sessions,
-    enrollments,
-    auditLog,
+    ...auth.kayan,
+    // add-on: roles
+    ...roles.kayan,
+    // end add-on: roles
+    ...tags.kayan,
+    // add-on: media
+    // An image is read by a holder of `media.create`, and otherwise through
+    // what the features pointing at images say of it.
+    ...media.kayan({
+      // add-on: courses
+      reads: [courses.coverReads],
+      // end add-on: courses
+      // without add-on: courses
+      // reads: [],
+      // end without add-on: courses
+    }),
+    // end add-on: media
+    // add-on: courses
+    ...courses.kayan,
+    // end add-on: courses
+    // add-on: audit-log
+    ...auditLog.kayan,
+    // end add-on: audit-log
+  ],
+  global: [
+    // add-on: settings
+    ...settings.global,
+    // end add-on: settings
   ],
-  global: [settings],
-  // The HTTP layer, a list the handler asks in order. `orpcHttp()` is first
+  // The HTTP layer, a list the handler asks in order. `orpcHttp` is first
   // because it owns `/api/rpc`, where a typed client would reach the build, and
   // because `asas.router` is the first plug's. It also claims `/api`, so the
   // plain plug behind it answers only what oRPC's own OpenAPI arm matched
@@ -46,48 +73,46 @@ export const asas = buildAsas({
   // leaves `http` out is refused.
   // Each plug is handed the same context function, so a step reads the same
   // bag whichever plug served it.
-  // The platform's rename of an organization sits between them, before the
-  // plain plug would read `/api/platform/*` as a kayan's route.
-  // A fault either plug answers 500 is written to this project's log, the
-  // console, as `fetchHttp`'s default does; the oRPC plug takes no default.
+  // The backoffice's rename of an organization sits between them, before the
+  // plain plug would read `/api/backoffice/*` as a kayan's route.
+  // A fault either plug answers 500 is handed to `report`; core reports none of its own.
+  // A body past `maxBodyBytes` is answered 413 before it is read whole.
   http: [
-    orpcHttp({ context: (request, actor) => ({ actor, ...requestContext(request) }), onError: (error) => console.error(error) }),
-    platformHttp(),
-    fetchHttp({ context: requestContext }),
+    orpcHttp({ context: (request, actor) => ({ actor, ...requestContext(request) }), onError: report, maxBodyBytes: defaultMaxBodyBytes }),
+    backofficeHttp(),
+    fetchHttp({ context: requestContext, onError: report, maxBodyBytes: defaultMaxBodyBytes }),
   ],
   // Better Auth's own actions, which no declaration of this project derives.
   // They join the catalog under the resources they name, so a role holds
   // `invitation.cancel` or `user.impersonate` exactly as it holds
-  // `courses.find`, and the hooks in @asas/auth ask for them under whichever
+  // `tags.find`, and the hooks in @asas/mithaq/auth ask for them under whichever
   // store this project turned on. `organization.rename` is this project's own,
-  // the key the platform's rename route asks, which is neither the
+  // the key the backoffice's rename route asks, which is neither the
   // provider's `organization.update` nor the managed kayan's, both of which
   // share that name. The project's own keys beside a kayan's operations are
   // listed with the role form that offers them.
   statements: { ...providerStatements, organization: [...providerStatements.organization, 'rename'], ...projectStatements },
   // `onError` hears a strategy that threw and an access target that could not
-  // answer, which the build reports nowhere of its own. The console is this
-  // project's log; a project with an error tracker names it here. A `Notice`
-  // is expected, such as the build of a local auth kayan with no mailer, and
-  // prints as its one line; anything else prints with its stack.
+  // answer, which the build reports nowhere of its own.
   //
   // `admin.access` is the answer `/api/access` reports as `canAccessAdmin`:
-  // `true` for a super admin in the platform app, `false` for every other
+  // `true` for a super admin in the backoffice app, `false` for every other
   // actor. The local `unlock` endpoint asks the same answer of the caller local
   // auth alone resolves, which is never a Better Auth super admin, so it stays
   // closed.
   //
-  // The administrator is a super admin in the platform app and nobody else: the
+  // The administrator is a super admin in the backoffice app and nobody else: the
   // one who verifies a local sign-up. A kayan with no callback of its own falls
   // to this answer, so every table Better Auth alone writes closes itself.
-  auth: { admin: { kayan: user, access: superAdmin }, onError: (error) => console.error(error instanceof Notice ? error.message : error) },
+  auth: { admin: { kayan: auth.user, access: superAdmin }, onError: report, maxBodyBytes: defaultMaxBodyBytes },
 })
 
-// The platform slug, the screen the platform app serves, the reader that
-// answers the platform roles, and the tenant app's link to the platform, for a
+// The backoffice slug, the screen the backoffice app serves, the reader that
+// answers the backoffice roles, and the tenant app's link to the backoffice, for a
 // host.
-export { PLATFORM, PLATFORM_SCREEN, assignedRoles, platformEntry } from './tenant-access.ts'
-// What the platform app wraps every request it serves in, whether a request is
+export { BACKOFFICE, BACKOFFICE_SCREEN, assignedRoles, backofficeEntry } from '@asas/mithaq/roles/tenant-access.ts'
+// What the backoffice app wraps every request it serves in, whether a request is
 // one of those, and where each app is served: re-exported here so a host reaches
 // the one instance of the store behind it through the same module the build reads.
-export { asPlatform, onPlatform, platformURL, tenantURL } from '@asas/auth'
+export { asBackoffice, onBackoffice, backofficeURL, tenantURL } from '@asas/mithaq/auth'
+export type { Language } from '@asas/mithaq'

package/template/templates/asas/src/{platform-http.ts → backoffice-http.ts}

@@ -1,23 +1,24 @@
-// The platform screen's one action no managed operation carries: renaming an
+// The backoffice screen's one action no managed operation carries: renaming an
 // organization and its slug. An organization has no admin route for staff:
 // every route of Better Auth's organization plugin acts as a member of that
 // organization, which staff are not, and the managed `organization` kayan
 // writes nothing, because Better Auth owns the table and the tenant's `'*'`
-// row, which every platform role takes too, names no update. So the rename is
+// row, which every backoffice role takes too, names no update. So the rename is
 // this one route of the project's own, refused without `organization.rename`,
 // a key of the project's own that only `super_admin` holds, and audited in the
-// line every admin route of the platform writes.
+// line every admin route of the backoffice writes.
 //
 // Deleting an organization, removing a member and changing a member's
 // governance role stay out: each is irreversible or passes the plugin's own
 // owner rules by, and staff do each by impersonating a member, which is
 // audited under the real person's name.
-import { AsasError, actorPermissions, denied, invalid, missing, type HttpPlug } from 'mithaq'
-import { platformRoles } from '@asas/auth'
-import { targets } from './mithaq.ts'
-import { assignedRoles, type OrganizationActor } from './tenant-access.ts'
+import { AsasError, actorPermissions, conflict, denied, invalid, missing, retryConflict, type HttpPlug } from 'mithaq'
+import { namesOf, oneLine, backofficeRoles } from '@asas/mithaq/auth'
+import { organizations as mode } from '@asas/mithaq/auth/organizations'
+import { targets } from '@asas/mithaq'
+import { assignedRoles, type OrganizationActor } from '@asas/mithaq/roles/tenant-access.ts'
 
-const path = '/api/platform/organizations/update'
+const path = '/api/backoffice/organizations/update'
 /**
  * The project's own key, not `organization.update`: that name is both the
  * provider's action and the managed kayan's update, which the rows refuse to
@@ -29,10 +30,19 @@ const slugShape = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
 
 /**
  * The longest name and slug a rename writes. The columns are unbounded `text`,
- * so the caps are this route's own: a name as long as a course's title and a
- * slug that fits in a URL segment.
+ * so the caps are this route's own: a name as long as the auth setup lets a
+ * founder write one, and a slug that fits in a URL segment.
  */
-const most = { name: 120, slug: 64 }
+const most = { name: 100, slug: 64 }
+
+/** The names `written` holds as the auth setup keeps them, or `null` where it refuses them. */
+const namedOrNull = (written: unknown) => {
+  try {
+    return namesOf(written)
+  } catch {
+    return null
+  }
+}
 
 /** The body the shipped plain plug answers every refusal with. */
 const codes: Record<number, string> = { 400: 'BAD_REQUEST', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 409: 'CONFLICT' }
@@ -40,48 +50,58 @@ const refusal = (thrown: AsasError) =>
   Response.json({ code: codes[thrown.status], data: { key: thrown.key, params: thrown.params }, message: thrown.message }, { status: thrown.status })
 
 /**
- * Answers the route only for an actor the template's reader gave a platform
- * role holding `organization.rename`, which it does in the platform app alone:
+ * Answers the route only for an actor the template's reader gave a backoffice
+ * role holding `organization.rename`, which it does in the backoffice app alone:
  * `'*'` inside a tenant is a tenant's and renames nothing here. The body is
- * `{ id, name, slug }`, both words trimmed; a slug another organization holds
- * is the store's own 409.
+ * `{ id, names, slug }`, a name per locale with the default locale's required,
+ * or `{ id, name, slug }`, the default locale's alone; a slug another
+ * organization holds is the store's own 409. With one organization its name
+ * lives in code, so the route renames nothing: `organizations` is the project's
+ * mode, which a test sets.
  */
-export const platformHttp = () => (): HttpPlug => ({
-  name: 'platform',
+export const backofficeHttp = ({ organizations }: { organizations: 'one' | 'many' } = { organizations: mode }) => (): HttpPlug => ({
+  name: 'backoffice',
   router: undefined,
   handle: async (request, who) => {
     if (request.method !== 'POST' || new URL(request.url).pathname !== path) return null
     try {
       const actor = (await who()) as (OrganizationActor & { id?: string }) | null
       const held = actorPermissions(actor)
-      const staff = !!actor && assignedRoles(actor).some((slug) => Object.hasOwn(platformRoles, slug))
+      const staff = !!actor && assignedRoles(actor).some((slug) => Object.hasOwn(backofficeRoles, slug))
       if (!staff || !(held === true || held?.has(key))) {
-        throw denied({ message: `Forbidden: renaming an organization is the platform's, and it asks "${key}".`, key: 'error.forbidden.permission', params: { permission: key } })
+        throw denied({ message: `Forbidden: renaming an organization is the backoffice's, and it asks "${key}".`, key: 'error.forbidden.permission', params: { permission: key } })
       }
       // JSON alone, so a form another site posts, which a browser sends with
       // no preflight, is never read as one.
       const body = request.headers.get('content-type')?.startsWith('application/json') ? ((await request.json().catch(() => null)) as Record<string, unknown> | null) : null
+      if (organizations === 'one') {
+        throw conflict({ message: 'With one organization its name lives in code: organizationName in src/mithaq/auth/organizations.ts. Change it there and deploy.', key: 'error.conflict.organization_name_in_code' })
+      }
       const id = body?.id
-      const name = typeof body?.name === 'string' ? body.name.trim() : ''
       const slug = typeof body?.slug === 'string' ? body.slug.trim() : ''
-      if (typeof id !== 'string' || !id || !name || name.length > most.name || !slugShape.test(slug) || slug.length > most.slug) {
+      // Each locale's name is the auth setup's own rule, so a rename keeps what a founder may write and no more.
+      const names = body?.names === undefined ? undefined : namedOrNull(body.names)
+      const name = names ? names.name : typeof body?.name === 'string' ? body.name.trim() : ''
+      // A name is one line: mail bodies carry it, where a break would be a line of the writer's own.
+      if (typeof id !== 'string' || !id || names === null || !name || name.length > most.name || new RegExp(oneLine.source, 'u').test(name) || !slugShape.test(slug) || slug.length > most.slug) {
         throw invalid({
-          message: `An organization is renamed with its id, a name of at most ${most.name} characters, and a slug of at most ${most.slug} lowercase letters, digits and hyphens.`,
+          message: `An organization is renamed with its id, a name of one line and at most ${most.name} characters, and a slug of at most ${most.slug} lowercase letters, digits and hyphens.`,
           key: 'error.invalid.value',
         })
       }
       const store = targets.drizzle
       // The row is found and written under one lock, so a delete between the
-      // two answers 404 rather than failing the write.
+      // two answers 404 rather than failing the write. `FOR UPDATE`, not `FOR NO
+      // KEY UPDATE`: the slug is unique, and the lock is taken before we know whether it changes.
       await store.transaction(async (tx) => {
         const found = await store.find({ kayan: 'organization', args: { limit: 1, lock: 'update', page: 1, sort: { field: 'id', direction: 'asc' }, where: { id: { equals: id } } }, tx })
         if (!found.docs.length) throw missing({ message: `No organization "${id}".`, key: 'error.not_found.row', params: { kayan: 'organization' } })
-        await store.update({ tx, kayan: 'organization', id, data: { name, slug, updatedAt: new Date() } })
+        await store.update({ tx, kayan: 'organization', id, data: { name, ...(names && { names: names.names }), slug, updatedAt: new Date() } })
       })
-      // The line `platformAudit` writes for an admin route, under this route's own name.
+      // The line `backofficeAudit` writes for an admin route, under this route's own name.
       console.log(JSON.stringify({
-        audit: 'platform',
-        action: '/platform/organizations/update',
+        audit: 'backoffice',
+        action: '/backoffice/organizations/update',
         actor: actor.id ?? null,
         impersonatedBy: actor.impersonatedBy ?? null,
         target: id,
@@ -89,6 +109,7 @@ export const platformHttp = () => (): HttpPlug => ({
       }))
       return Response.json({ id, name, slug })
     } catch (thrown) {
+      thrown = retryConflict(thrown)
       if (thrown instanceof AsasError) return refusal(thrown)
       throw thrown
     }

package/template/templates/asas/src/dev-setup.ts

@@ -0,0 +1,112 @@
+// Makes a fresh development database usable in one command: pushes the schema,
+// makes the dev admin that DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD name, and
+// with --seed fills its organization.
+//
+//   bun run dev:setup [--seed]
+//
+// The dev admin owns an organization and, where the project serves the backoffice
+// console, is its super_admin, with a proved address, so it signs in to both
+// apps at once. A development tool only: it refuses production, a database on
+// another machine, and a database that already holds a user.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import { getTableConfig, type PgTable } from 'drizzle-orm/pg-core'
+import { organizations as mode } from '@asas/mithaq/auth/organizations'
+import { databaseOf } from './local-database.ts'
+
+function refuse(reason: string): never {
+  console.error(`Refusing dev:setup: ${reason}`)
+  process.exit(1)
+}
+
+const { values } = parseArgs({ options: { seed: { type: 'boolean' } } })
+// Checked before the build is imported, since the import is what reads them.
+if (!process.env.DATABASE_URL) refuse('set DATABASE_URL to the development database to set up.')
+if (process.env.NODE_ENV && process.env.NODE_ENV !== 'development') refuse(`NODE_ENV is ${process.env.NODE_ENV}, and it sets up a development database only.`)
+// The account it makes signs in with a password every project's .env.example
+// holds, so it is made on this machine's database alone.
+const at = databaseOf(process.env.DATABASE_URL)
+if (!at) refuse('DATABASE_URL is not a connection string pg reads.')
+const { database, local } = at
+if (!local) refuse(`DATABASE_URL names ${database}, which is not this machine.`)
+const { DEV_ADMIN_EMAIL: email, DEV_ADMIN_PASSWORD: password } = process.env
+if (!email || !password) refuse('set DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD in .env, as .env.example does.')
+// Unset is development here, and the auth setup reads it: on this machine
+// first-run then asks no setup code, as it does under `vite dev`.
+Object.assign(process.env, { NODE_ENV: 'development' })
+
+const { asas } = await import('./asas.ts')
+const { isLocalHost, backofficeApp, backofficeURL, tenantURL } = await import('@asas/mithaq/auth')
+// A deploy run with plain `node` sets no NODE_ENV and may hold its database on this machine; its address is what
+// tells it apart, as the auth setup reads it, so an app served elsewhere gets no dev admin.
+for (const [variable, url] of [['BETTER_AUTH_URL', tenantURL], ...(backofficeApp ? [['BACKOFFICE_URL', backofficeURL]] : [])] as const) {
+  if (!isLocalHost(url)) refuse(`${variable} names ${url}, which is not this machine.`)
+}
+const signIn = `Sign in at ${tenantURL}${backofficeApp ? ` or ${backofficeURL}` : ''}`
+type Row = Record<string, unknown> & { id: string }
+const { db, tables } = asas.targets.drizzle as unknown as { db: { $client: { query(text: string, values?: unknown[]): Promise<{ rows: Record<string, unknown>[] }> } }; tables: Record<'user' | 'organization', PgTable> }
+const client = db.$client
+/** A table of the build's own, as SQL names it. */
+const named = (table: PgTable) => {
+  const { schema = 'public', name } = getTableConfig(table)
+  return [schema, name].map((part) => `"${part.replaceAll('"', '""')}"`).join('.')
+}
+// The provider's own routes and adapter: the generated auth kayan answer no
+// operation to anyone.
+const server = (asas.auth.strategies.find((strategy) => strategy.name === 'user') as unknown as {
+  server: {
+    $context: Promise<{
+      password: { hash(password: string): Promise<string>; config: { minPasswordLength: number; maxPasswordLength: number } }
+      internalAdapter: {
+        createUser(user: Record<string, unknown>): Promise<Row>
+        linkAccount(account: { userId: string; providerId: string; accountId: string; password: string }): Promise<unknown>
+      }
+    }>
+    api: {
+      firstRun(input: { body: Record<string, string> }): Promise<{ organization: { id: string } }>
+      createOrganization(input: { body: { name: string; slug: string; userId: string } }): Promise<{ id: string }>
+    }
+  }
+}).server
+const name = 'Dev admin'
+const workspace = `${name}'s workspace`
+try {
+  // Asked before the push, so a database someone already uses is never changed by it.
+  const users = named(tables.user)
+  const [table] = (await client.query('select to_regclass($1) is not null as held', [users])).rows
+  if (table!.held && (await client.query(`select exists (select 1 from ${users}) as held`)).rows[0]!.held) {
+    refuse(`the database already holds a user. ${signIn} as DEV_ADMIN_EMAIL with DEV_ADMIN_PASSWORD from .env, or as the account you made.`)
+  }
+  const auth = await server.$context
+  // First-run asks the same of its owner; the path with many makes the account itself, so it asks here.
+  const { minPasswordLength: min, maxPasswordLength: max } = auth.password.config
+  if (password.length < min || password.length > max) refuse(`DEV_ADMIN_PASSWORD holds ${min} to ${max} characters.`)
+  await asas.connect()
+  let organization: string
+  if (mode === 'one') {
+    // First-run's own path: the owner, the one organization and, with the backoffice console, its super_admin.
+    organization = (await server.api.firstRun({ body: { name, email, password } })).organization.id
+  } else {
+    // With many, an account proves its address by a mailed link and then founds its organization; the dev admin is
+    // made proved, as first-run makes its owner, and its workspace made for it, as the page of someone in none would.
+    const user = await auth.internalAdapter.createUser({ name, email, emailVerified: true, ...(backofficeApp && { role: 'super_admin' }) })
+    await auth.internalAdapter.linkAccount({ userId: user.id, providerId: 'credential', accountId: user.id, password: await auth.password.hash(password) })
+    organization = (await server.api.createOrganization({ body: { name: workspace, slug: 'dev-admin-workspace', userId: user.id } })).id
+  }
+  // Read back, since first-run names the organization from code (`organizationName`).
+  const [made] = (await client.query(`select name from ${named(tables.organization)} where id = $1`, [organization])).rows
+  console.log(`Made the dev admin, owner of "${String(made!.name)}"${backofficeApp ? ' and backoffice super_admin' : ''}. ${signIn} with DEV_ADMIN_EMAIL and DEV_ADMIN_PASSWORD from .env.`)
+} finally {
+  await asas.destroy()
+}
+
+if (values.seed) {
+  // The seed names whose organization it fills by address, which stays in .env, in any case: the provider stores it
+  // lowercased.
+  const seeded = spawnSync(process.execPath, [fileURLToPath(new URL('./seed.ts', import.meta.url))], { env: { ...process.env, SEED_EMAIL: email }, stdio: ['inherit', 'pipe', 'pipe'], encoding: 'utf8' })
+  const address = new RegExp(email.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi')
+  process.stdout.write(seeded.stdout.replace(address, 'DEV_ADMIN_EMAIL'))
+  process.stderr.write(seeded.stderr.replace(address, 'DEV_ADMIN_EMAIL'))
+  process.exitCode = seeded.status ?? 1
+}

package/template/templates/asas/src/local-database.ts

@@ -0,0 +1,22 @@
+import { parse } from 'pg-connection-string'
+
+/**
+ * The database `url` names, as `host:port/name`, and whether it is on this machine, for the scripts that write to a
+ * development database; nothing when pg cannot read it. Read by pg's own parser, so the guard and the connection never
+ * disagree on the host, and a host left out is pg's default. Nothing of the URL is repeated on a failure, since it
+ * holds the password.
+ */
+export const databaseOf = (url: string) => {
+  let config: ReturnType<typeof parse>
+  try {
+    config = parse(url)
+  } catch {
+    return undefined
+  }
+  const host = config.host || process.env.PGHOST || 'localhost'
+  return {
+    database: `${host}:${config.port || process.env.PGPORT || '5432'}/${config.database ?? ''}`,
+    // A path is a socket on this machine.
+    local: host.startsWith('/') || ['localhost', '127.0.0.1', '::1', '[::1]'].includes(host),
+  }
+}