create-tilcayo-app 0.0.1 → 0.0.3

package/README.md

@@ -1,49 +1,294 @@
-# create-tilcayo-app
-
-Create a Tilcayo API with an interactive setup wizard:
-
-```sh
-create-tilcayo-app
-```
-
-Once published to your registry, bootstrap without a global install:
-
-```sh
-npm create tilcayo-app@latest
-pnpm create tilcayo-app
-yarn create tilcayo-app
-```
-
-For local development in the Tilcayo repository, build the workspace and run
-`node packages/create-tilcayo-app/dist/bin.js my-api`, or link this package to expose
-`create-tilcayo-app` on PATH.
-
-```sh
-create-tilcayo-app my-api --type api --auth --package-manager npm --yes
-create-tilcayo-app tiny-api --type minimal --no-auth --no-install --yes
-```
-
-The wizard offers project name, package manager (npm, pnpm, or Yarn), application
-type, and authentication. Use the arrow keys and Enter to choose from colored
-menus; project name remains a text field. Ctrl+C cancels before files are created.
-`api` includes MongoDB-backed note CRUD; `minimal`
-includes a health endpoint. Enabling authentication adds MongoDB to either type.
-Noninteractive runs use defaults for omitted options. Existing paths are refused.
-
-Generated projects contain controllers, routes, models, services, validators,
-separate app and startup modules, TypeScript configuration, `.gitignore`,
-`.env.example`, and a private `.env`. Authentication gets independent random
-secrets in `.env`; the example file leaves secrets blank.
-
-Setup installs dependencies and builds unless `--no-install` is supplied. The
-selected package manager must be installed. Running the creator from a built
-Tilcayo source checkout automatically links the local framework packages and
-their shared Zod and Mongoose dependencies. Keep that checkout available while
-developing the generated app. The published creator uses registry versions of
-`@tilcayo/core`, `@tilcayo/auth`, and `@tilcayo/cli` instead.
-Installation failures retain the generated project and report recovery steps.
-MongoDB must be running before starting an API that uses it.
-
-Inside the generated project, use `tilcayo dev`, `tilcayo build`, `tilcayo start`,
-and `tilcayo routes:list`. If the CLI is installed only in the project, invoke
-it through `npx tilcayo`, `pnpm exec tilcayo`, or `yarn exec tilcayo`.
+# create-tilcayo-app
+
+Create a Tilcayo API or React client with an interactive setup wizard:
+
+```sh
+create-tilcayo-app
+```
+
+Use Node.js 22.9+. Create your app outside the framework checkout, without a global install:
+
+```sh
+npm create tilcayo-app@latest
+pnpm create tilcayo-app
+yarn create tilcayo-app
+```
+
+For local development in the Tilcayo repository, build the workspace and run
+`node packages/create-tilcayo-app/dist/bin.js my-api`, or link this package to expose
+`create-tilcayo-app` on PATH.
+
+```sh
+create-tilcayo-app my-api --type api --auth --package-manager npm --yes
+create-tilcayo-app tiny-api --type minimal --no-auth --no-install --yes
+```
+
+The wizard offers project name, package manager (npm, pnpm, or Yarn), application
+type, and authentication. Use the arrow keys and Enter to choose from colored
+menus; project name remains a text field. Ctrl+C cancels before files are created.
+`api` includes MongoDB-backed note CRUD; `minimal`
+includes a health endpoint. Enabling authentication adds MongoDB to either type.
+Noninteractive runs use defaults for omitted options. Existing paths are refused.
+
+Generated projects contain controllers, routes, models, services, validators,
+separate app and startup modules, TypeScript configuration, `.gitignore`,
+`.env.example`, and a private `.env`. Authentication gets independent random
+secrets in `.env`; the example file leaves secrets blank.
+
+## Start your API
+
+For a MongoDB API with authentication:
+
+```sh
+npm create tilcayo-app@latest my-api -- --type api --auth --yes
+cd my-api
+```
+
+In your new app's `.env`, configure the database:
+
+```dotenv
+PORT=9149
+MONGODB_URI=mongodb://127.0.0.1:27017/my_api
+```
+
+Keep the generated authentication secret entries. Start MongoDB locally or replace
+the URI with your Atlas connection string. Then run:
+
+```sh
+npm run dev
+```
+
+Open `http://localhost:9149/health`:
+
+```json
+{"success":true,"message":"Success","data":{"status":"ok"}}
+```
+
+The `api` and `minimal` starters are backend APIs. On PowerShell, use
+`npm.cmd` / `npx.cmd` if script execution is blocked.
+
+## Options
+
+With `npm create`, place creator flags after `--`.
+
+| Option | Purpose |
+| --- | --- |
+| `[project-name]` | New directory and package name |
+| `--type api\|minimal\|react` | MongoDB API, minimal API, or React client |
+| `--auth` / `--no-auth` | Include or omit authentication |
+| `--package-manager npm\|pnpm\|yarn` | Installation tool |
+| `--no-install` | Write files without installation or compilation |
+| `--yes` | Use defaults for unanswered choices |
+| `--help` | Command help |
+
+Defaults are `my-api`, npm, `api`, and no authentication. A minimal app needs no
+database unless authentication is enabled:
+
+```sh
+npm create tilcayo-app@latest tiny-api -- --type minimal --no-auth --yes
+```
+
+## Continue building
+
+For a React client, select React in the wizard or pass `--type react --yes`.
+Use Node.js 22.12+ or 24+. The client includes the current Tilcayo starter pages,
+responsive hamburger menu, TypeScript, Vite, React Router, and `@tilcayo/styles`.
+Run `npm run dev`, `npm run build`, `npm run preview`, or `npm run lint` in the
+generated client. Add `--auth` for login/register pages, a protected dashboard,
+guest/auth route guards, auth bootstrap and logout navigation. This frontend connects
+to a separate Tilcayo auth API; its Vite proxy targets port 9149.
+
+To test from the repository root:
+
+```sh
+npm run build
+cd examples
+node ../packages/create-tilcayo-app/dist/bin.js my-react-app --type react --yes
+cd my-react-app
+npm run dev
+```
+
+The build bundles the `client` source into `dist/react-starter.json`, so the packed
+creator does not need the checkout to generate a React app. Local generation
+links the checkout styles package; published generation uses `@tilcayo/styles`
+from npm. Publish the styles package and this updated creator before testing
+`npm create tilcayo-app@latest my-react-app -- --type react --yes`.
+
+For backend starters:
+
+| Location | Purpose |
+| --- | --- |
+| `src/app.ts` | Register routes and middleware |
+| `src/index.ts` | Database connection and server lifecycle |
+| `src/config.ts` | Configuration |
+| `src/models/` | Database schemas |
+| `src/controllers/` | Request handlers |
+| `src/validators/` | Zod validation |
+| `src/routes/` | URLs and middleware |
+| `src/services/` | Business logic |
+
+In another terminal inside the app, generate a feature:
+
+```sh
+npx tilcayo make:resource Product name:string price:number "description:string?"
+```
+
+Add the import and registration to `src/app.ts`, before its default export:
+
+```ts
+import productsRoutes from "./routes/products.routes.js";
+
+app.routes(productsRoutes);
+```
+
+Send `POST http://localhost:9149/products` with `Content-Type: application/json`
+and body `{"name":"Notebook","price":250}` using Postman or Thunder Client.
+Use `GET /products` to list records and `GET`, `PUT`, or `DELETE /products/:id`
+to read, update, or delete one. Replace `:id` with the returned `data._id`.
+
+Edit the generated files as your feature grows. Dev rebuilds and restarts on
+source changes. Generators refuse to overwrite files and do not register routes
+automatically.
+
+## Authentication
+
+For backend starters with `--auth`, these endpoints are registered:
+
+| Endpoint | Input |
+| --- | --- |
+| `POST /api/auth/register` | JSON `name`, `email`, `password` |
+| `POST /api/auth/login` | JSON `email`, `password` |
+| `POST /api/auth/refresh` | JSON `refreshToken` |
+| `POST /api/auth/logout` | JSON `refreshToken` |
+| `GET /api/auth/me` | Bearer access token |
+
+Registration and login return tokens under `data.tokens`. Send the access token
+in `Authorization: Bearer <accessToken>`. Generated notes and other CRUD routes
+remain public until you add auth middleware. See the
+[authentication guide](https://www.npmjs.com/package/@tilcayo/auth).
+
+## Build and run
+
+| Command | Purpose |
+| --- | --- |
+| `npm run dev` | Develop with rebuilds and restarts |
+| `npm run build` | Compile into dist |
+| `npm run routes` | List routes from compiled code |
+| `npm start` | Start compiled code with .env |
+
+Build before listing changed routes or starting compiled code. Stop dev before
+starting another server on the same port. Deploy the application as a Node.js
+service with its runtime dependencies, environment, and database connection.
+Application feature changes do not require publishing to npm.
+
+## Installation and local development
+
+Setup installs dependencies and builds unless `--no-install` is supplied. The
+selected package manager must be installed. Running the creator from a built
+Tilcayo source checkout automatically links the local framework packages and
+their shared Zod and Mongoose dependencies. Keep that checkout available while
+developing the generated app. The published creator uses registry versions of
+`@tilcayo/core`, `@tilcayo/auth`, and `@tilcayo/cli` instead.
+Installation failures retain the generated project and report recovery steps.
+MongoDB must be running before starting an API that uses it.
+
+If installation fails or was skipped, enter the generated project and run
+`npm install` then `npm run build`; do not regenerate the same directory.
+
+Inside the generated project, use `tilcayo dev`, `tilcayo build`, `tilcayo start`,
+and `tilcayo routes:list`. If the CLI is installed only in the project, invoke
+it through `npx tilcayo`, `pnpm exec tilcayo`, or `yarn exec tilcayo`.
+
+[Project guide](https://github.com/jomobrain1/tilcayo#readme) ·
+[Generators](https://www.npmjs.com/package/@tilcayo/cli) ·
+[Runtime](https://www.npmjs.com/package/@tilcayo/core)
+
+Plain React starters include `@tilcayo/react` and `src/lib/api.ts`, configured with
+public `VITE_API_URL` or `/api`. No API requests run on startup. Local generation
+links both frontend packages; future published generation uses registry versions.
+Publish `@tilcayo/react` as well before releasing this creator. Never put secrets
+in VITE_* variables. See [API client](../react/README.md).
+
+### React auth installation (local, unpublished)
+
+From `examples`, after building the workspace:
+
+```sh
+node ../packages/create-tilcayo-app/dist/bin.js my-auth-app --type react --auth --yes
+cd my-auth-app
+npm run dev
+```
+
+Open `/register` or `/login`. The generated README explains creating a separate
+auth backend and connecting MongoDB. Frontend files live in `src/app/auth.ts`,
+`src/middleware/auth.tsx`, `src/components/auth-form.tsx`, and `src/pages/`.
+The creator ships the auth overlay in `dist/react-auth.json`. Tokens remain in
+memory. A standalone React app needs a compatible cookie-session backend and matching frontend configuration to restore login on reload; full-stack auth starters configure this automatically. No backend secrets are generated in the frontend.
+Existing generated apps are not overwritten or upgraded by this command.
+## Full-stack presets
+
+From a built source checkout:
+
+```sh
+node packages/create-tilcayo-app/dist/bin.js bookstore --fullstack --auth --admin --yes
+cd bookstore
+npm run dev
+```
+
+`--api` preserves API-only creation. `--fullstack` creates `api/` and `client/`
+workspaces with one dev command, separate dev scripts, both production builds,
+an API proxy and generated Notes CRUD. Set MongoDB in `api/.env`. Auth adds
+login/register/recovery/profile pages and protected routes; admin requires auth
+and adds `/admin` management pages. Provision roles through trusted server code.
+
+Run `tilcayo make:resource Book title:string author:ref:Author --fullstack` from
+the generated root and follow the printed route registration steps. Production
+hosts serve `client/dist` with SPA fallback and proxy `/api` to the Node API.
+`npm run start` starts the API only. See the generated README for configuration.
+
+The updated frontend packages and creator must be published before these flags
+work through `npm create tilcayo-app@latest`. Verify packed artifacts externally
+with `node tests/fullstack-starter-consumer.mjs` before release.
+
+
+## Tenant workspaces
+
+Create a local full-stack auth/admin app with `--tenancy`:
+
+```sh
+node packages/create-tilcayo-app/dist/bin.js my-saas --fullstack --auth --admin --tenancy --yes
+```
+
+From the generated application, set `TENANCY_SUPERADMIN_EMAIL` and
+`TENANCY_SUPERADMIN_PASSWORD` for the setup process, then run `npm run tenancy:setup`.
+This explicit command provisions only a Super Admin. It does not create a default
+tenant, assign memberships or migrate existing records. Re-running it updates
+the designated account password and revokes its existing sessions. No bootstrap
+password is generated into source files or run automatically on startup.
+
+Run the app and use `http://localhost:5173/admin/workspaces` for
+platform management. Create tenants and assign their administrators in Tenant administration. Open `<tenant-slug>.localhost` with the port printed by Vite.
+Users can register on the main site or at a tenant address. Tenant signup creates a normal membership in that tenant. An existing account can join another tenant using its existing password; signup never grants an admin role. There is no default tenant or Main app workspace switcher. The main site supports ordinary users and public registration; tenant administrators manage their own users, roles and product catalog.
+Each hostname has its own HttpOnly session cookie; sign in once per workspace.
+
+Super Admin manages tenants and global accounts. Tenant roles belong to Memberships,
+not global Users. A Super Admin must be explicitly added to enter a workspace.
+Tenant administrators manage their own members, custom roles, products, orders and
+Trash. Suspending a membership affects only that workspace; global user suspension
+affects all workspaces. Suspended or archived tenants retain data but reject access.
+
+`TENANCY_BASE_DOMAIN` defaults to `localhost`. Production needs wildcard DNS and
+HTTPS for that domain, with a same-origin `/api` proxy preserving Host. Subdomains
+are resolved from Host; forwarded tenant headers are not trusted.
+
+Tenant-owned models use `mongoModel(name, schema, { tenantScoped: true })`.
+The generator applies this to existing models and future `make:model` and
+`make:resource` output. Queries, writes, counts, distinct, population and supported
+aggregations use the request's tenant context. Platform requests cannot read these
+records. Native `raw.collection` operations bypass Mongoose and are reserved for
+explicit setup/migration code. Bulk writes, replacement updates and cross-collection
+aggregate stages are rejected unless implemented with their own isolation checks.
+
+## Complete command reference
+
+See the [main README](../../README.md#create-an-application) for every creator flag, app preset, generator command, environment setting and framework development command. Source checkout builds use the current code; registry creation uses the packages that have been published.

package/dist/bin.js

@@ -51,6 +51,8 @@ async function main() {
                 options: [
                     { value: "api", label: color.green("API"), hint: "MongoDB with sample CRUD routes" },
                     { value: "minimal", label: color.magenta("Minimal"), hint: "Health-check endpoint only" },
+                    { value: "react", label: color.cyan("React"), hint: "React client with Tilcayo styles and responsive navigation" },
+                    { value: "fullstack", label: color.blue("Full stack"), hint: "MongoDB API and React client in one workspace" },
                 ],
             }));
         if (missing.has("auth"))
@@ -58,7 +60,7 @@ async function main() {
                 message: "Include authentication?",
                 initialValue: options.auth,
                 options: [
-                    { value: true, label: color.green("Yes"), hint: "Register, login, refresh and logout; requires MongoDB" },
+                    { value: true, label: color.green("Yes"), hint: options.type === "react" ? "Login/register pages, dashboard and route guards; connects to a Tilcayo auth API" : "Register, login, refresh and logout; requires MongoDB" },
                     { value: false, label: color.yellow("No"), hint: "Start without authentication" },
                 ],
             }));
@@ -67,15 +69,22 @@ async function main() {
     const target = await generateApp(options);
     console.log(`Created ${target}`);
     if (options.install) {
-        console.log(`Installing dependencies with ${options.packageManager} and building the API...`);
+        console.log(`Installing dependencies with ${options.packageManager} and building the application...`);
         await installApp(target, options.packageManager);
     }
     console.log(`\nNext:\n  cd ${options.name}`);
     if (!options.install)
         console.log(`  ${options.packageManager} install`);
     const cli = options.packageManager === "npm" ? "npx tilcayo" : `${options.packageManager} exec tilcayo`;
-    console.log(`  ${cli} dev\n\nWith Tilcayo on PATH, use tilcayo dev directly.`);
-    if (options.type === "api" || options.auth)
+    if (options.type === "react" || options.type === "fullstack")
+        console.log(`  ${options.packageManager} run dev`);
+    else
+        console.log(`  ${cli} dev\n\nWith Tilcayo on PATH, use tilcayo dev directly.`);
+    if (options.type === "react" && options.auth)
+        console.log("Open /login or /register. Start a Tilcayo auth API on port 9149; see README.md for setup and API URL configuration.");
+    else if (options.type === "fullstack")
+        console.log("Start MongoDB or update api/.env. The client proxies /api to the API on port 9149; see README.md.");
+    else if (options.type === "api" || options.auth)
         console.log("Start MongoDB or update MONGODB_URI in .env before starting the API.");
 }
 main().catch((error) => {

package/dist/fullstack.d.ts

@@ -0,0 +1,2 @@
+import type { StarterOptions } from "./options.js";
+export declare function fullstackTemplates(options: StarterOptions, localPackages: Record<string, string>): Record<string, string>;

package/dist/fullstack.js

@@ -0,0 +1,107 @@
+import { templates } from "./templates.js";
+// Each half remains an ordinary Tilcayo API or Vite app.
+export function fullstackTemplates(options, localPackages) {
+    const api = templates({ ...options, name: `${options.name}-api`, type: "api", admin: options.admin }, localPackages);
+    const client = templates({ ...options, name: `${options.name}-client`, type: "react" }, localPackages);
+    client["vite.config.ts"] = `import react from '@vitejs/plugin-react';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+  plugins: [react()],
+  resolve: { dedupe: ['react', 'react-dom', 'react-redux', '@reduxjs/toolkit', 'react-router'] },
+  server: { proxy: { '/api': { target: process.env.API_PROXY_TARGET || 'http://127.0.0.1:9149', changeOrigin: false } } },
+});
+`;
+    if (options.auth) {
+        api[".env"] += "\nAUTH_COOKIE_SESSION=true\n";
+        api[".env.example"] += "\nAUTH_COOKIE_SESSION=true\n";
+        client["src/app/auth.ts"] = client["src/app/auth.ts"].replace("createTilcayoAuth({", "createTilcayoAuth({ cookieSession: true,");
+    }
+    client[".env.example"] = "# Public frontend API base URL\nVITE_API_URL=/api\n";
+    client["src/routes.tsx"] = "import { notesRoutes } from './features/notes/notes.routes';\n" + client["src/routes.tsx"].replace("children: [", "children: [\n      ...notesRoutes,");
+    const files = {};
+    for (const [name, source] of Object.entries(api))
+        files[`api/${name}`] = source;
+    for (const [name, source] of Object.entries(client))
+        files[`client/${name}`] = source;
+    files["package.json"] = JSON.stringify({
+        name: options.name, version: "0.0.1", private: true, type: "module",
+        engines: { node: "^22.12.0 || >=24.0.0" },
+        workspaces: ["api", "client"],
+        tilcayo: { type: "fullstack", auth: options.auth, admin: options.admin ?? false, packageManager: options.packageManager },
+        scripts: {
+            dev: "node scripts/dev.mjs", "dev:api": "npm run dev --workspace api", "dev:client": "npm run dev --workspace client",
+            build: "npm run build --workspaces", start: "npm run start --workspace api", routes: "npm run routes --workspace api",
+            ...(options.admin ? { 'seed:demo': 'npm run build --workspace api && npm run seed:demo --workspace api', 'seed:demo:remove': 'npm run build --workspace api && npm run seed:demo --workspace api -- --remove' } : {}),
+        },
+        devDependencies: { "@tilcayo/cli": localPackages.rootCli ?? "^0.0.3" },
+    }, null, 2) + "\n";
+    files[".gitignore"] = "node_modules/\n**/dist/\n.env\n.env.*\n**/.env\n**/.env.*\n!**/.env.example\n*.log\n";
+    if (options.packageManager === "yarn")
+        files[".yarnrc.yml"] = "nodeLinker: node-modules\n";
+    files["scripts/dev.mjs"] = devScript;
+    files["README.md"] = fullstackReadme(options, Object.keys(localPackages).length > 0);
+    return files;
+}
+function fullstackReadme(options, local) {
+    return `# ${options.name}
+
+Tilcayo MongoDB API + React/Vite client${options.auth ? " with authentication" : ""}${options.admin ? " and admin pages" : ""}.
+
+Use Node.js 22.12+ or 24+. Start MongoDB and configure api/.env (MONGODB_URI,
+PORT and private auth/mail settings when enabled). Never put secrets in VITE_*.
+
+\`\`\`sh
+${options.packageManager} install
+${options.packageManager} run dev
+\`\`\`
+
+The client runs on Vite's printed URL and proxies /api to port 9149. If you change
+the API port, set API_PROXY_TARGET for the client dev process or edit
+client/vite.config.ts. Visit /notes for sample CRUD${options.auth ? ", /login to sign in, /register to create an account, /dashboard for your overview and /profile for profile and settings" : ""}${options.admin ? ", and /admin for management" : ""}.
+${options.auth ? "Access tokens stay in memory; an HttpOnly refresh cookie restores the session on reload. Production requires HTTPS and a same-origin API proxy. Configure backend SMTP settings for password recovery.\n" : ""}${options.admin ? "Provision the admin role through trusted server code; registration never grants it.\n" : ""}
+${options.admin ? "Admin users and role filters are at /admin/users. The catalog at /admin/products includes inventory cards and add/edit forms. Product data starts empty; add products in the UI. Protected catalog routes and the Product model are generated in api/src.\n" : ""}
+Generate both halves from this directory:
+
+\`\`\`sh
+npx tilcayo make:resource Author name:string --fullstack
+npx tilcayo make:resource Book title:string author:ref:Author year:number? --fullstack
+\`\`\`
+
+Register backend routes in api/src/app.ts and spread frontend route arrays into
+client/src/routes.tsx layout children. For admin resources, add their links in
+client/src/features/admin/admin-layout.tsx and nest createBooksRoutes('books',
+'/admin/books') in the admin route module. ${options.tenancy ? "Tenant resource routes require membership and use tenant-scoped models. Add role guards for privileged actions." : "Resource routes are public until you add backend auth.middleware (and auth.requireRole('admin') where appropriate)."}
+
+Run ${options.packageManager} run build to build both halves. Production uses
+api/dist/index.js and client/dist; serve the client with SPA fallback and proxy
+/api to the API. npm run start starts the API only. Configure HTTPS on your host.
+The dev runner requires npm on PATH; npm ships with Node.js even if dependencies
+are installed with pnpm or Yarn. Stop both processes with Ctrl+C. Separate
+dev:api and dev:client scripts are available.
+${local ? "\nDependencies link to this source checkout. Keep it available, or replace file/link dependencies with published package versions before sharing the app.\n" : ""}`;
+}
+const devScript = `import { spawn, spawnSync } from 'node:child_process';
+
+const windows = process.platform === 'win32';
+const children = ['api', 'client'].map(workspace => spawn('npm', ['run', 'dev', '--workspace', workspace], {
+  stdio: 'inherit', shell: windows, windowsHide: true, detached: !windows,
+}));
+let stopping = false;
+function stop(code = 0) {
+  if (stopping) return;
+  stopping = true;
+  for (const child of children) {
+    if (!child.pid || child.exitCode !== null) continue;
+    if (windows) spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' });
+    else { try { process.kill(-child.pid, 'SIGTERM'); } catch {} }
+  }
+  process.exitCode = code;
+}
+for (const child of children) {
+  child.on('error', error => { console.error(error.message); stop(1); });
+  child.on('exit', code => stop(code ?? 0));
+}
+process.on('SIGINT', () => stop());
+process.on('SIGTERM', () => stop());
+`;

package/dist/index.js

@@ -1,3 +1,4 @@
+import { installTenancy } from "./installTenancy.js";
 import { mkdir, writeFile, readFile, access } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
@@ -18,20 +19,23 @@ async function localDependencies(target, options) {
     if (manifest.name !== "tilcayo" || manifest.private !== true || !Array.isArray(manifest.workspaces) || !manifest.workspaces.includes("packages/*"))
         return {};
     const dependencies = {};
-    for (const name of ["core", "cli", ...(options.auth ? ["auth"] : [])]) {
+    for (const name of options.type === "react" ? ["styles", "ui", "react", ...(options.admin ? ["admin"] : [])] : ["core", "cli", ...(options.auth ? ["auth", "cloudinary"] : [])]) {
         const directory = path.join(checkout, "packages", name);
         const pkg = JSON.parse(await readFile(path.join(directory, "package.json"), "utf8"));
         if (pkg.name !== `@tilcayo/${name}`)
             throw new Error(`Invalid local Tilcayo package: ${directory}`);
+        const entry = name === "styles" ? "dist/index.css" : "dist/index.js";
         try {
-            await access(path.join(directory, "dist/index.js"));
+            await access(path.join(directory, entry));
         }
         catch {
-            throw new Error(`Build the Tilcayo workspace before creating an application: ${directory}/dist/index.js is missing.`);
+            throw new Error(`Build the Tilcayo workspace before creating an application: ${directory}/${entry} is missing.`);
         }
         const relative = path.relative(target, directory).split(path.sep).join("/");
         dependencies[name] = `${options.packageManager === "npm" ? "file" : "link"}:${relative}`;
     }
+    if (options.type === "react")
+        return dependencies;
     const require = createRequire(path.join(checkout, "packages/core/package.json"));
     for (const name of ["zod", ...(options.type === "api" || options.auth ? ["mongoose"] : [])]) {
         const directory = path.dirname(require.resolve(`${name}/package.json`));
@@ -43,7 +47,18 @@ async function localDependencies(target, options) {
 export async function generateApp(options, root = process.cwd()) {
     validateOptions(options);
     const target = path.resolve(root, options.name);
-    const sources = templates(options, await localDependencies(target, options));
+    let packages;
+    if (options.type === "fullstack") {
+        const [api, client, app] = await Promise.all([
+            localDependencies(path.join(target, "api"), { ...options, type: "api" }),
+            localDependencies(path.join(target, "client"), { ...options, type: "react" }),
+            localDependencies(target, { ...options, type: "api" }),
+        ]);
+        packages = { ...api, ...client, ...(app.cli ? { rootCli: app.cli } : {}) };
+    }
+    else
+        packages = await localDependencies(target, options);
+    const sources = templates(options, packages);
     try {
         await mkdir(target);
     }
@@ -55,12 +70,27 @@ export async function generateApp(options, root = process.cwd()) {
     for (const [filename, source] of Object.entries(sources)) {
         const destination = path.join(target, filename);
         await mkdir(path.dirname(destination), { recursive: true });
-        await writeFile(destination, source, { flag: "wx", ...(filename === ".env" ? { mode: 0o600 } : {}) });
+        const content = source.startsWith("__TILCAYO_BASE64__:") ? Buffer.from(source.slice("__TILCAYO_BASE64__:".length), "base64") : source;
+        await writeFile(destination, content, { flag: "wx", ...(filename === ".env" ? { mode: 0o600 } : {}) });
     }
     if (options.type === "api")
         await make(["make:resource", "Note", "title:string", "content?:string"], target);
-    if (options.auth)
+    if (options.type === "fullstack") {
+        await make(["make:resource", "Note", "title:string", "content?:string", "--fullstack"], target);
+        if (options.auth) {
+            await make(["make:auth"], path.join(target, "api"));
+            const authFile = path.join(target, "api/src/auth.ts");
+            const source = await readFile(authFile, "utf8");
+            await writeFile(authFile, source.replace('cookieSession: process.env.AUTH_COOKIE_SESSION === "true"', "cookieSession: true"));
+        }
+    }
+    if (options.auth && options.type !== "react" && options.type !== "fullstack")
         await make(["make:auth"], target);
+    if (options.tenancy) {
+        await installTenancy(target);
+        const readme = path.join(target, "README.md");
+        await writeFile(readme, await readFile(readme, "utf8") + "\nTenancy enabled: set TENANCY_SUPERADMIN_EMAIL and TENANCY_SUPERADMIN_PASSWORD for npm run tenancy:setup. Setup provisions only the Super Admin. Create tenants and assign their administrators in Tenant administration on the main domain; no default tenant or automatic record migration is created. Use the Vite port in the URL. Configure TENANCY_BASE_DOMAIN, wildcard DNS, HTTPS and a same-origin Host-preserving API proxy for production. Workspace sessions are host-only. Platform admins manage tenants; tenant roles belong to memberships.\n");
+    }
     return target;
 }
 function run(command, args, cwd, shell = false) {
@@ -76,11 +106,9 @@ export async function installApp(target, manager) {
     try {
         // Both the command and its arguments are fixed, not user-supplied shell text.
         await run(manager, ["install"], target, process.platform === "win32");
-        const require = createRequire(path.join(target, "package.json"));
-        const cli = path.join(path.dirname(require.resolve("@tilcayo/cli")), "bin.js");
-        await run(process.execPath, [cli, "build"], target);
+        await run(manager, ["run", "build"], target, process.platform === "win32");
     }
     catch {
-        throw new Error(`Project created at ${target}, but dependency installation or build failed. Check that ${manager} is installed and Tilcayo packages are available in your registry, then run ${manager} install and the Tilcayo build command inside the project.`);
+        throw new Error(`Project created at ${target}, but dependency installation or build failed. Check that ${manager} is installed and Tilcayo packages are available in your registry, then run ${manager} install and ${manager} run build inside the project.`);
     }
 }

package/dist/installTenancy.d.ts

@@ -0,0 +1,2 @@
+/** Applied only after generating a full-stack auth/admin app. Also used for explicit upgrades. */
+export declare function installTenancy(root: string): Promise<void>;