create-vexcms 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/index.js

@@ -121,7 +121,7 @@ function rewriteManifestForMonorepo(props) {
 }
 
 // src/installers/base.ts
-import fs4 from "fs-extra";
+import fs5 from "fs-extra";
 import { execa } from "execa";
 import ora from "ora";
 import crypto from "crypto";
@@ -173,585 +173,196 @@ async function overlayTemplate({ overlayDir, targetDir }) {
   await fs3.copy(overlayDir, targetDir, { overwrite: true });
 }
 
-// src/installers/base.ts
-var VexFrameworkInstaller = class {
-  /**
-   * Binds this installer to the destination directory and package name used
-   * throughout scaffolding (template copy target, package.json, README, etc).
-   *
-   * @param targetPath - Absolute path of the directory the project is created in.
-   * @param projectName - npm package name recorded for subclasses; not read directly by the base class.
-   */
-  constructor(targetPath, projectName) {
-    this.targetPath = targetPath;
-    this.projectName = projectName;
-  }
-  targetPath;
-  projectName;
-  /**
-   * Copy base template files to target directory
-   */
-  async copyBaseFiles() {
-    await copyTemplate(this.frameworkName, this.targetPath);
-  }
-  /**
-   * Apply a template overlay on top of the base template.
-   * Merges overlay files onto the already-copied base — existing files
-   * not in the overlay are left untouched.
-   *
-   * @param overlay - Name of the overlay template directory under `templates/` (e.g. `"marketing-site"`).
-   */
-  async applyTemplateOverlay(overlay) {
-    const { dirname: dirname2 } = await import("path");
-    const { fileURLToPath: fileURLToPath2 } = await import("url");
-    const __filename = fileURLToPath2(import.meta.url);
-    const __dirname = dirname2(__filename);
-    let overlayDir = path2.join(__dirname, "../../templates", overlay);
-    if (!await fs4.pathExists(overlayDir)) {
-      overlayDir = path2.join(__dirname, "../templates", overlay);
+// src/installers/string-utils.ts
+import fs4 from "fs-extra";
+
+// src/installers/providers.ts
+var OAUTH_PROVIDERS = {
+  // ========================================
+  // POPULAR PROVIDERS (10)
+  // ========================================
+  google: {
+    id: "google",
+    name: "Google",
+    envPrefix: "GOOGLE",
+    clientIdVar: "GOOGLE_CLIENT_ID",
+    clientSecretVar: "GOOGLE_CLIENT_SECRET",
+    popular: true,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"google"',
+      socialProvider: `google({
+      clientId: process.env.GOOGLE_CLIENT_ID!,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "GOOGLE_CLIENT_ID",
+        type: "server",
+        description: "Google OAuth Client ID"
+      },
+      {
+        name: "GOOGLE_CLIENT_SECRET",
+        type: "server",
+        description: "Google OAuth Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://console.cloud.google.com/apis/credentials",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: false,
+    extraConfigNotes: "",
+    readme: {
+      title: "Google OAuth Setup",
+      content: `## Google OAuth Setup
+
+1. Create OAuth credentials at https://console.cloud.google.com/apis/credentials
+2. Set the Authorized redirect URI to: \`http://localhost:3000/api/auth/callback/google\` (update for production)
+3. Copy the Client ID and Client Secret to your \`.env\` file
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
-    await overlayTemplate({ overlayDir, targetDir: this.targetPath });
-  }
-  /**
-   * Update the package.json name field, the vex:update script (to match the
-   * detected package manager), and README.md's `{{PROJECT_NAME}}` heading.
-   *
-   * @param name - npm package name to write into `package.json`'s `name` field
-   *   and to substitute for `{{PROJECT_NAME}}` in `README.md`.
-   */
-  async updatePackageName(name) {
-    const pkgPath = path2.join(this.targetPath, "package.json");
-    const pkg = await fs4.readJson(pkgPath);
-    pkg.name = name;
-    const pm = this.detectPackageManager();
-    if (pkg.scripts?.["vex:update"] && pm !== "pnpm") {
-      const addCmd = pm === "yarn" ? "yarn add" : pm === "bun" ? "bun add" : "npm install";
-      pkg.scripts["vex:update"] = pkg.scripts["vex:update"].replace(/^pnpm add/, addCmd);
+  },
+  github: {
+    id: "github",
+    name: "GitHub",
+    envPrefix: "GITHUB",
+    clientIdVar: "GITHUB_CLIENT_ID",
+    clientSecretVar: "GITHUB_CLIENT_SECRET",
+    popular: true,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"github"',
+      socialProvider: `github({
+      clientId: process.env.GITHUB_CLIENT_ID!,
+      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+    })`,
+      scopes: ["user:email"]
+    },
+    env: [
+      {
+        name: "GITHUB_CLIENT_ID",
+        type: "server",
+        description: "GitHub OAuth App Client ID"
+      },
+      {
+        name: "GITHUB_CLIENT_SECRET",
+        type: "server",
+        description: "GitHub OAuth App Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: true,
+    extraConfigNotes: "You MUST include the user:email scope in your GitHub app. For GitHub Apps, enable Read-Only access to Email Addresses in Permissions.",
+    readme: {
+      title: "GitHub OAuth Setup",
+      content: `## GitHub OAuth Setup
+
+1. Create a GitHub OAuth App at https://github.com/settings/developers
+2. Set the Authorization callback URL to: \`http://localhost:3000/api/auth/callback/github\` (update for production)
+3. Copy the Client ID and Client Secret to your \`.env\` file
+4. **Important**: Include the \`user:email\` scope in your GitHub app permissions
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
-    await fs4.writeJson(pkgPath, pkg, { spaces: 2 });
-    const readmePath = path2.join(this.targetPath, "README.md");
-    if (await fs4.pathExists(readmePath)) {
-      const readme = await fs4.readFile(readmePath, "utf-8");
-      await fs4.writeFile(readmePath, readme.replace("{{PROJECT_NAME}}", name));
+  },
+  discord: {
+    id: "discord",
+    name: "Discord",
+    envPrefix: "DISCORD",
+    clientIdVar: "DISCORD_CLIENT_ID",
+    clientSecretVar: "DISCORD_CLIENT_SECRET",
+    popular: true,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"discord"',
+      socialProvider: `discord({
+      clientId: process.env.DISCORD_CLIENT_ID!,
+      clientSecret: process.env.DISCORD_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "DISCORD_CLIENT_ID",
+        type: "server",
+        description: "Discord OAuth Application Client ID"
+      },
+      {
+        name: "DISCORD_CLIENT_SECRET",
+        type: "server",
+        description: "Discord OAuth Application Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://discord.com/developers/applications",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: false,
+    extraConfigNotes: "You can optionally add a permissions field to request additional Discord permissions.",
+    readme: {
+      title: "Discord OAuth Setup",
+      content: `## Discord OAuth Setup
+
+1. Create an application at https://discord.com/developers/applications
+2. Add a redirect URL: \`http://localhost:3000/api/auth/callback/discord\` (update for production)
+3. Copy the Client ID and Client Secret to your \`.env\` file
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
-  }
-  /**
-   * Configure the dev server port.
-   * Updates package.json dev script and creates .env.local with NEXT_PUBLIC_SITE_URL.
-   *
-   * @param port - Dev server port number to write into the `dev` script and `.env.local`.
-   */
-  async configurePort(port) {
-    const pkgPath = path2.join(this.targetPath, "package.json");
-    const pkg = await fs4.readJson(pkgPath);
-    if (pkg.scripts?.dev) {
-      if (pkg.scripts.dev.includes("--port")) {
-        pkg.scripts.dev = pkg.scripts.dev.replace(/--port[= ]\d+/, `--port=${port}`);
-      } else {
-        pkg.scripts.dev = `${pkg.scripts.dev} --port=${port}`;
+  },
+  apple: {
+    id: "apple",
+    name: "Apple",
+    envPrefix: "APPLE",
+    clientIdVar: "APPLE_CLIENT_ID",
+    clientSecretVar: "APPLE_CLIENT_SECRET",
+    popular: true,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"apple"',
+      socialProvider: `apple({
+      clientId: process.env.APPLE_CLIENT_ID!,
+      clientSecret: process.env.APPLE_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "APPLE_CLIENT_ID",
+        type: "server",
+        description: "Apple Sign In Service ID"
+      },
+      {
+        name: "APPLE_CLIENT_SECRET",
+        type: "server",
+        description: "Apple Sign In Client Secret (JWT token)"
       }
-    }
-    await fs4.writeJson(pkgPath, pkg, { spaces: 2 });
-    const siteUrl = `http://localhost:${port}`;
-    const envLocalPath = path2.join(this.targetPath, ".env.local");
-    const envContent = [
-      `NEXT_PUBLIC_SITE_URL=${siteUrl}`,
-      `SITE_URL=${siteUrl}`,
-      `BETTER_AUTH_SECRET=${this.generateAuthSecret()}`,
-      `NEXT_PUBLIC_CONVEX_URL=https://placeholder.convex.cloud`,
-      `NEXT_PUBLIC_CONVEX_SITE_URL=https://placeholder.convex.site`,
-      `CONVEX_DEPLOYMENT=`,
-      ""
-    ].join("\n");
-    await fs4.writeFile(envLocalPath, envContent);
-  }
-  /**
-   * Rewrites the scaffolded `package.json` for life inside a host pnpm
-   * workspace (`--monorepo`). `@vexcms/*` dependencies become
-   * `workspace:*`; any other dependency the host's `pnpm-workspace.yaml`
-   * catalog also pins becomes `catalog:`; everything else keeps its
-   * literal, catalog-resolved version. No-op when `options.monorepo` is
-   * false or `options.workspaceRoot` is unset.
-   *
-   * @param options - Resolved project options; only `monorepo`/`workspaceRoot` are consulted.
-   */
-  async applyMonorepoRewrite(options) {
-    if (!options.monorepo || !options.workspaceRoot) return;
-    const pkgPath = path2.join(this.targetPath, "package.json");
-    const manifest = await fs4.readJson(pkgPath);
-    const catalog = await readWorkspaceCatalog({ workspaceRoot: options.workspaceRoot });
-    const rewritten = rewriteManifestForMonorepo({ manifest, catalog });
-    await fs4.writeJson(pkgPath, rewritten, { spaces: 2 });
-  }
-  /**
-   * Detect the package manager used to invoke the CLI
-   *
-   * @returns The package manager inferred from `npm_config_user_agent`, defaulting to `"npm"` when it can't be determined.
-   */
-  detectPackageManager() {
-    const userAgent = process.env.npm_config_user_agent;
-    if (userAgent) {
-      if (userAgent.includes("pnpm")) return "pnpm";
-      if (userAgent.includes("yarn")) return "yarn";
-      if (userAgent.includes("bun")) return "bun";
-    }
-    return "npm";
-  }
-  /**
-   * Install project dependencies using detected package manager
-   */
-  async installDependencies() {
-    const packageManager = this.detectPackageManager();
-    const spinner = ora(`Installing dependencies with ${packageManager}...`).start();
-    try {
-      await execa(packageManager, ["install"], {
-        cwd: this.targetPath,
-        stdio: "pipe"
-      });
-      spinner.succeed("Dependencies installed successfully");
-    } catch (error) {
-      spinner.fail("Failed to install dependencies");
-      throw new Error(
-        `Dependency installation failed: ${error instanceof Error ? error.message : "Unknown error"}`
-      );
-    }
-  }
-  /**
-   * Format code using project's formatter
-   */
-  async formatCode() {
-    const packageManager = this.detectPackageManager();
-    const spinner = ora("Formatting code...").start();
-    try {
-      const result = await execa(packageManager, ["run", "format"], {
-        cwd: this.targetPath,
-        stdio: "pipe",
-        reject: false
-      });
-      if (result.exitCode === 0) {
-        spinner.succeed("Code formatted successfully");
-      } else {
-        spinner.warn("Formatting completed with warnings");
-      }
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : "Unknown error";
-      spinner.warn(`Failed to format code: ${errorMessage}`);
-    }
-  }
-  /**
-   * Lint and fix code using project's ESLint configuration
-   */
-  async lintCode() {
-    const packageManager = this.detectPackageManager();
-    const spinner = ora("Linting and fixing code...").start();
-    try {
-      const args2 = packageManager === "pnpm" ? ["lint", "--fix"] : ["run", "lint", "--", "--fix"];
-      const result = await execa(packageManager, args2, {
-        cwd: this.targetPath,
-        stdio: "pipe",
-        reject: false
-      });
-      if (result.exitCode === 0) {
-        spinner.succeed("Code linted and fixed successfully");
-      } else {
-        spinner.warn("Linting completed with warnings");
-      }
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : "Unknown error";
-      spinner.warn(`Failed to lint code: ${errorMessage}`);
-    }
-  }
-  /**
-   * Initialize Git repository in target directory
-   */
-  async initGitRepo() {
-    const spinner = ora("Initializing Git repository...").start();
-    try {
-      try {
-        await execa("git", ["--version"], { stdio: "pipe" });
-      } catch {
-        spinner.fail("Git is not installed");
-        throw new Error("Git is not installed. Please install Git to initialize a repository.");
-      }
-      await execa("git", ["init"], { cwd: this.targetPath, stdio: "pipe" });
-      await execa("git", ["add", "."], { cwd: this.targetPath, stdio: "pipe" });
-      await execa(
-        "git",
-        ["commit", "-m", "Initial commit from create-vexcms"],
-        { cwd: this.targetPath, stdio: "pipe" }
-      );
-      spinner.succeed("Git repository initialized");
-    } catch (error) {
-      spinner.fail("Failed to initialize Git repository");
-      throw new Error(
-        `Git initialization failed: ${error instanceof Error ? error.message : "Unknown error"}`
-      );
-    }
-  }
-  /**
-   * Generate a secure random secret for Better Auth
-   *
-   * @returns A 64-character hex string (32 random bytes) suitable for `BETTER_AUTH_SECRET`.
-   */
-  generateAuthSecret() {
-    return crypto.randomBytes(32).toString("hex");
-  }
-  /**
-   * Write the generated auth secret to .env.example
-   */
-  async writeAuthSecret() {
-    const envPath = path2.join(this.targetPath, ".env.example");
-    const secret = this.generateAuthSecret();
-    if (await fs4.pathExists(envPath)) {
-      let content = await fs4.readFile(envPath, "utf-8");
-      content = content.replace(
-        /BETTER_AUTH_SECRET=.*/,
-        `BETTER_AUTH_SECRET=${secret}`
-      );
-      await fs4.writeFile(envPath, content);
-    }
-  }
-  /**
-   * Configure the Better Auth organizations plugin.
-   * When enabled, replaces placeholders with organization import and plugin.
-   * When disabled, removes the placeholder lines.
-   *
-   * @param enabled - Whether the organizations (multi-tenant) plugin should be wired into `convex/auth/plugins/index.ts`.
-   */
-  async configureOrganizations(enabled) {
-    const pluginsPath = path2.join(this.targetPath, "convex/auth/plugins/index.ts");
-    if (!await fs4.pathExists(pluginsPath)) return;
-    let content = await fs4.readFile(pluginsPath, "utf-8");
-    if (enabled) {
-      content = content.replace(
-        "// {{ORGANIZATIONS_IMPORT}}",
-        'import { organization } from "better-auth/plugins"'
-      );
-      content = content.replace(
-        "  // {{ORGANIZATIONS_PLUGIN}}",
-        "  organization(),"
-      );
-    } else {
-      content = content.replace(/.*\/\/ \{\{ORGANIZATIONS_IMPORT\}\}\n?/, "");
-      content = content.replace(/.*\/\/ \{\{ORGANIZATIONS_PLUGIN\}\}\n?/, "");
-    }
-    await fs4.writeFile(pluginsPath, content);
-  }
-  /**
-   * Main orchestration method for project initialization
-   *
-   * @param options - Resolved project options from CLI flags and prompts, driving every scaffolding step (template copy, overlay, port, auth, README, git, install).
-   */
-  async initProject(options) {
-    const copySpinner = ora("Copying template files...").start();
-    try {
-      await this.copyBaseFiles();
-      copySpinner.succeed("Template files copied");
-    } catch (error) {
-      copySpinner.fail("Failed to copy template files");
-      throw error;
-    }
-    if (!options.bare) {
-      const overlaySpinner = ora("Applying marketing site template...").start();
-      try {
-        await this.applyTemplateOverlay("marketing-site");
-        overlaySpinner.succeed("Marketing site template applied");
-      } catch (error) {
-        overlaySpinner.fail("Failed to apply template overlay");
-        throw error;
-      }
-    }
-    const nameSpinner = ora("Configuring project...").start();
-    try {
-      await this.updatePackageName(options.projectName);
-      await this.configurePort(options.port);
-      nameSpinner.succeed("Project configured");
-    } catch (error) {
-      nameSpinner.fail("Failed to configure project");
-      throw error;
-    }
-    const authSpinner = ora("Configuring authentication...").start();
-    try {
-      await this.updateOAuthConfig(options.oauthProviders, options.emailPasswordAuth);
-      authSpinner.succeed(
-        options.emailPasswordAuth || options.oauthProviders.length > 0 ? "Authentication configuration updated" : "Authentication placeholders cleaned up"
-      );
-    } catch (error) {
-      authSpinner.fail("Failed to configure authentication");
-      throw error;
-    }
-    const oauthUISpinner = ora("Configuring OAuth UI...").start();
-    try {
-      await this.updateOAuthUIConfig(options.oauthProviders, options.emailPasswordAuth);
-      oauthUISpinner.succeed(
-        options.oauthProviders.length > 0 ? "OAuth UI configuration updated" : "OAuth UI placeholders cleaned up"
-      );
-    } catch (error) {
-      oauthUISpinner.fail("Failed to configure OAuth UI");
-      throw error;
-    }
-    const envSpinner = ora("Updating .env.example...").start();
-    try {
-      await this.updateEnvExample(options.oauthProviders);
-      envSpinner.succeed(
-        options.oauthProviders.length > 0 ? ".env.example updated" : ".env.example placeholders cleaned up"
-      );
-    } catch (error) {
-      envSpinner.fail("Failed to update .env.example");
-      throw error;
-    }
-    const envTsSpinner = ora("Updating typed env configuration...").start();
-    try {
-      await this.updateEnvTs(options.oauthProviders);
-      envTsSpinner.succeed(
-        options.oauthProviders.length > 0 ? "Typed env configuration updated" : "Typed env placeholders cleaned up"
-      );
-    } catch (error) {
-      envTsSpinner.fail("Failed to update typed env configuration");
-      throw error;
-    }
-    const readmeSpinner = ora("Updating README...").start();
-    try {
-      await this.updateReadme(options.oauthProviders);
-      readmeSpinner.succeed(
-        options.oauthProviders.length > 0 ? "README updated" : "README placeholders cleaned up"
-      );
-    } catch (error) {
-      readmeSpinner.fail("Failed to update README");
-      throw error;
-    }
-    const orgsSpinner = ora("Configuring organizations...").start();
-    try {
-      await this.configureOrganizations(options.orgs);
-      orgsSpinner.succeed(
-        options.orgs ? "Organizations plugin enabled" : "Organizations placeholders cleaned up"
-      );
-    } catch (error) {
-      orgsSpinner.fail("Failed to configure organizations");
-      throw error;
-    }
-    const secretSpinner = ora("Generating auth secret...").start();
-    try {
-      await this.writeAuthSecret();
-      secretSpinner.succeed("Auth secret generated");
-    } catch (error) {
-      secretSpinner.fail("Failed to generate auth secret");
-      throw error;
-    }
-    if (options.monorepo) {
-      const monorepoSpinner = ora("Rewriting dependencies for the host workspace...").start();
-      try {
-        await this.applyMonorepoRewrite(options);
-        monorepoSpinner.succeed("Dependencies rewritten for the host workspace");
-      } catch (error) {
-        monorepoSpinner.fail("Failed to rewrite dependencies for the host workspace");
-        throw error;
-      }
-    }
-    if (options.initGit && !options.monorepo) {
-      await this.initGitRepo();
-    }
-    if (options.installDependencies && !options.monorepo) {
-      await this.installDependencies();
-      await this.lintCode();
-      await this.formatCode();
-    }
-  }
-};
-
-// src/installers/nextjs.ts
-import { join as join2 } from "path";
-
-// src/installers/string-utils.ts
-import fs5 from "fs-extra";
-
-// src/installers/providers.ts
-var OAUTH_PROVIDERS = {
-  // ========================================
-  // POPULAR PROVIDERS (10)
-  // ========================================
-  google: {
-    id: "google",
-    name: "Google",
-    envPrefix: "GOOGLE",
-    clientIdVar: "GOOGLE_CLIENT_ID",
-    clientSecretVar: "GOOGLE_CLIENT_SECRET",
-    popular: true,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"google"',
-      socialProvider: `google({
-      clientId: process.env.GOOGLE_CLIENT_ID!,
-      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "GOOGLE_CLIENT_ID",
-        type: "server",
-        description: "Google OAuth Client ID"
-      },
-      {
-        name: "GOOGLE_CLIENT_SECRET",
-        type: "server",
-        description: "Google OAuth Client Secret"
-      }
-    ],
-    docs: {
-      provider: "https://console.cloud.google.com/apis/credentials",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: false,
-    extraConfigNotes: "",
-    readme: {
-      title: "Google OAuth Setup",
-      content: `## Google OAuth Setup
-
-1. Create OAuth credentials at https://console.cloud.google.com/apis/credentials
-2. Set the Authorized redirect URI to: \`http://localhost:3000/api/auth/callback/google\` (update for production)
-3. Copy the Client ID and Client Secret to your \`.env\` file
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
-    }
-  },
-  github: {
-    id: "github",
-    name: "GitHub",
-    envPrefix: "GITHUB",
-    clientIdVar: "GITHUB_CLIENT_ID",
-    clientSecretVar: "GITHUB_CLIENT_SECRET",
-    popular: true,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"github"',
-      socialProvider: `github({
-      clientId: process.env.GITHUB_CLIENT_ID!,
-      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
-    })`,
-      scopes: ["user:email"]
-    },
-    env: [
-      {
-        name: "GITHUB_CLIENT_ID",
-        type: "server",
-        description: "GitHub OAuth App Client ID"
-      },
-      {
-        name: "GITHUB_CLIENT_SECRET",
-        type: "server",
-        description: "GitHub OAuth App Client Secret"
-      }
-    ],
-    docs: {
-      provider: "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: true,
-    extraConfigNotes: "You MUST include the user:email scope in your GitHub app. For GitHub Apps, enable Read-Only access to Email Addresses in Permissions.",
-    readme: {
-      title: "GitHub OAuth Setup",
-      content: `## GitHub OAuth Setup
-
-1. Create a GitHub OAuth App at https://github.com/settings/developers
-2. Set the Authorization callback URL to: \`http://localhost:3000/api/auth/callback/github\` (update for production)
-3. Copy the Client ID and Client Secret to your \`.env\` file
-4. **Important**: Include the \`user:email\` scope in your GitHub app permissions
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
-    }
-  },
-  discord: {
-    id: "discord",
-    name: "Discord",
-    envPrefix: "DISCORD",
-    clientIdVar: "DISCORD_CLIENT_ID",
-    clientSecretVar: "DISCORD_CLIENT_SECRET",
-    popular: true,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"discord"',
-      socialProvider: `discord({
-      clientId: process.env.DISCORD_CLIENT_ID!,
-      clientSecret: process.env.DISCORD_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "DISCORD_CLIENT_ID",
-        type: "server",
-        description: "Discord OAuth Application Client ID"
-      },
-      {
-        name: "DISCORD_CLIENT_SECRET",
-        type: "server",
-        description: "Discord OAuth Application Client Secret"
-      }
-    ],
-    docs: {
-      provider: "https://discord.com/developers/applications",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: false,
-    extraConfigNotes: "You can optionally add a permissions field to request additional Discord permissions.",
-    readme: {
-      title: "Discord OAuth Setup",
-      content: `## Discord OAuth Setup
-
-1. Create an application at https://discord.com/developers/applications
-2. Add a redirect URL: \`http://localhost:3000/api/auth/callback/discord\` (update for production)
-3. Copy the Client ID and Client Secret to your \`.env\` file
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
-    }
-  },
-  apple: {
-    id: "apple",
-    name: "Apple",
-    envPrefix: "APPLE",
-    clientIdVar: "APPLE_CLIENT_ID",
-    clientSecretVar: "APPLE_CLIENT_SECRET",
-    popular: true,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"apple"',
-      socialProvider: `apple({
-      clientId: process.env.APPLE_CLIENT_ID!,
-      clientSecret: process.env.APPLE_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "APPLE_CLIENT_ID",
-        type: "server",
-        description: "Apple Sign In Service ID"
-      },
-      {
-        name: "APPLE_CLIENT_SECRET",
-        type: "server",
-        description: "Apple Sign In Client Secret (JWT token)"
-      }
-    ],
-    docs: {
-      provider: "https://developer.apple.com/sign-in-with-apple/get-started/",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: true,
-    extraConfigNotes: "Apple requires additional configuration: clientId is your Service ID, clientSecret must be a JWT token generated from your Team ID, Key ID, and Private Key. You may also need to provide appBundleIdentifier for iOS apps.",
-    readme: {
-      title: "Apple Sign In Setup",
-      content: `## Apple Sign In Setup
-
-1. Create a Sign In with Apple service at https://developer.apple.com
-2. Configure your Service ID and return URLs
-3. Generate a client secret JWT using your private key, Team ID, and Key ID
-4. Add credentials to your \`.env\` file
-
-**Note**: The clientSecret must be a JWT token generated from your Apple credentials, not a standard client secret.
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    ],
+    docs: {
+      provider: "https://developer.apple.com/sign-in-with-apple/get-started/",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: true,
+    extraConfigNotes: "Apple requires additional configuration: clientId is your Service ID, clientSecret must be a JWT token generated from your Team ID, Key ID, and Private Key. You may also need to provide appBundleIdentifier for iOS apps.",
+    readme: {
+      title: "Apple Sign In Setup",
+      content: `## Apple Sign In Setup
+
+1. Create a Sign In with Apple service at https://developer.apple.com
+2. Configure your Service ID and return URLs
+3. Generate a client secret JWT using your private key, Team ID, and Key ID
+4. Add credentials to your \`.env\` file
+
+**Note**: The clientSecret must be a JWT token generated from your Apple credentials, not a standard client secret.
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
   },
   microsoft: {
@@ -1829,511 +1440,1070 @@ For more details, see the [Better Auth documentation](https://www.better-auth.co
     },
     env: [
       {
-        name: "ROBLOX_CLIENT_ID",
+        name: "ROBLOX_CLIENT_ID",
+        type: "server",
+        description: "Roblox OAuth Client ID"
+      },
+      {
+        name: "ROBLOX_CLIENT_SECRET",
+        type: "server",
+        description: "Roblox OAuth Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://create.roblox.com/credentials",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: true,
+    extraConfigNotes: "Note: Roblox OAuth does not provide user email addresses.",
+    readme: {
+      title: "Roblox OAuth Setup",
+      content: `## Roblox OAuth Setup
+
+1. Create OAuth credentials at https://create.roblox.com/credentials
+2. Configure OAuth 2.0 settings
+3. Add redirect URI: \`http://localhost:3000/api/auth/callback/roblox\` (update for production)
+4. Copy the Client ID and Client Secret to your \`.env\` file
+
+**Note**: Roblox does not provide email addresses through OAuth.
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    }
+  },
+  salesforce: {
+    id: "salesforce",
+    name: "Salesforce",
+    envPrefix: "SALESFORCE",
+    clientIdVar: "SALESFORCE_CLIENT_ID",
+    clientSecretVar: "SALESFORCE_CLIENT_SECRET",
+    popular: false,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"salesforce"',
+      socialProvider: `salesforce({
+      clientId: process.env.SALESFORCE_CLIENT_ID!,
+      clientSecret: process.env.SALESFORCE_CLIENT_SECRET!,
+      environment: process.env.SALESFORCE_ENVIRONMENT || "login",
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "SALESFORCE_CLIENT_ID",
+        type: "server",
+        description: "Salesforce Connected App Consumer Key"
+      },
+      {
+        name: "SALESFORCE_CLIENT_SECRET",
+        type: "server",
+        description: "Salesforce Connected App Consumer Secret"
+      },
+      {
+        name: "SALESFORCE_ENVIRONMENT",
+        type: "server",
+        description: 'Salesforce environment: "login" (production) or "test" (sandbox) (default: login)'
+      }
+    ],
+    docs: {
+      provider: "https://developer.salesforce.com/",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: true,
+    extraConfigNotes: 'Salesforce supports environment field: "login" for production, "test" for sandbox.',
+    readme: {
+      title: "Salesforce OAuth Setup",
+      content: `## Salesforce OAuth Setup
+
+1. Create a Connected App in Salesforce Setup
+2. Enable OAuth Settings
+3. Add callback URL: \`http://localhost:3000/api/auth/callback/salesforce\` (update for production)
+4. Copy the Consumer Key and Consumer Secret to your \`.env\` file
+5. Set SALESFORCE_ENVIRONMENT to "login" for production or "test" for sandbox
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    }
+  },
+  slack: {
+    id: "slack",
+    name: "Slack",
+    envPrefix: "SLACK",
+    clientIdVar: "SLACK_CLIENT_ID",
+    clientSecretVar: "SLACK_CLIENT_SECRET",
+    popular: false,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"slack"',
+      socialProvider: `slack({
+      clientId: process.env.SLACK_CLIENT_ID!,
+      clientSecret: process.env.SLACK_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "SLACK_CLIENT_ID",
+        type: "server",
+        description: "Slack App Client ID"
+      },
+      {
+        name: "SLACK_CLIENT_SECRET",
+        type: "server",
+        description: "Slack App Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://api.slack.com/apps",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: false,
+    extraConfigNotes: "Supports optional team field for workspace restrictions.",
+    readme: {
+      title: "Slack OAuth Setup",
+      content: `## Slack OAuth Setup
+
+1. Create a Slack app at https://api.slack.com/apps
+2. Add OAuth & Permissions and configure redirect URLs
+3. Add redirect URL: \`http://localhost:3000/api/auth/callback/slack\` (update for production)
+4. Copy the Client ID and Client Secret to your \`.env\` file
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    }
+  },
+  tiktok: {
+    id: "tiktok",
+    name: "TikTok",
+    envPrefix: "TIKTOK",
+    clientIdVar: "TIKTOK_CLIENT_KEY",
+    clientSecretVar: "TIKTOK_CLIENT_SECRET",
+    popular: false,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"tiktok"',
+      socialProvider: `tiktok({
+      clientKey: process.env.TIKTOK_CLIENT_KEY!,
+      clientSecret: process.env.TIKTOK_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "TIKTOK_CLIENT_KEY",
+        type: "server",
+        description: "TikTok Client Key (not Client ID)"
+      },
+      {
+        name: "TIKTOK_CLIENT_SECRET",
+        type: "server",
+        description: "TikTok Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://developers.tiktok.com/",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: true,
+    extraConfigNotes: "TikTok uses clientKey instead of clientId. Make sure to use the correct field name.",
+    readme: {
+      title: "TikTok OAuth Setup",
+      content: `## TikTok OAuth Setup
+
+1. Register an app at https://developers.tiktok.com/
+2. Configure Login Kit
+3. Add redirect URI: \`http://localhost:3000/api/auth/callback/tiktok\` (update for production)
+4. Copy the Client Key (not Client ID) and Client Secret to your \`.env\` file
+
+**Important**: TikTok uses clientKey instead of clientId.
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    }
+  },
+  vercel: {
+    id: "vercel",
+    name: "Vercel",
+    envPrefix: "VERCEL",
+    clientIdVar: "VERCEL_CLIENT_ID",
+    clientSecretVar: "VERCEL_CLIENT_SECRET",
+    popular: false,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"vercel"',
+      socialProvider: `vercel({
+      clientId: process.env.VERCEL_CLIENT_ID!,
+      clientSecret: process.env.VERCEL_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "VERCEL_CLIENT_ID",
+        type: "server",
+        description: "Vercel OAuth Client ID"
+      },
+      {
+        name: "VERCEL_CLIENT_SECRET",
+        type: "server",
+        description: "Vercel OAuth Client Secret"
+      }
+    ],
+    docs: {
+      provider: "https://vercel.com/account/integrations",
+      betterAuth: "https://www.better-auth.com/docs/authentication/social"
+    },
+    requiresExtraConfig: false,
+    extraConfigNotes: "Uses PKCE for enhanced security.",
+    readme: {
+      title: "Vercel OAuth Setup",
+      content: `## Vercel OAuth Setup
+
+1. Create an integration at https://vercel.com/account/integrations
+2. Configure OAuth settings
+3. Add redirect URL: \`http://localhost:3000/api/auth/callback/vercel\` (update for production)
+4. Copy the Client ID and Client Secret to your \`.env\` file
+
+For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    }
+  },
+  vk: {
+    id: "vk",
+    name: "VK",
+    envPrefix: "VK",
+    clientIdVar: "VK_CLIENT_ID",
+    clientSecretVar: "VK_CLIENT_SECRET",
+    popular: false,
+    betterAuthConfig: {
+      import: "",
+      clientSideProvider: '"vk"',
+      socialProvider: `vk({
+      clientId: process.env.VK_CLIENT_ID!,
+      clientSecret: process.env.VK_CLIENT_SECRET!,
+    })`,
+      scopes: []
+    },
+    env: [
+      {
+        name: "VK_CLIENT_ID",
         type: "server",
-        description: "Roblox OAuth Client ID"
+        description: "VK Application ID"
       },
       {
-        name: "ROBLOX_CLIENT_SECRET",
+        name: "VK_CLIENT_SECRET",
         type: "server",
-        description: "Roblox OAuth Client Secret"
+        description: "VK Secure Key"
       }
     ],
     docs: {
-      provider: "https://create.roblox.com/credentials",
+      provider: "https://vk.com/apps?act=manage",
       betterAuth: "https://www.better-auth.com/docs/authentication/social"
     },
-    requiresExtraConfig: true,
-    extraConfigNotes: "Note: Roblox OAuth does not provide user email addresses.",
+    requiresExtraConfig: false,
+    extraConfigNotes: "",
     readme: {
-      title: "Roblox OAuth Setup",
-      content: `## Roblox OAuth Setup
-
-1. Create OAuth credentials at https://create.roblox.com/credentials
-2. Configure OAuth 2.0 settings
-3. Add redirect URI: \`http://localhost:3000/api/auth/callback/roblox\` (update for production)
-4. Copy the Client ID and Client Secret to your \`.env\` file
+      title: "VK OAuth Setup",
+      content: `## VK OAuth Setup
 
-**Note**: Roblox does not provide email addresses through OAuth.
+1. Create an app at https://vk.com/apps?act=manage
+2. Configure OAuth settings in the app
+3. Add authorized redirect URI: \`http://localhost:3000/api/auth/callback/vk\` (update for production)
+4. Copy the Application ID and Secure Key to your \`.env\` file
 
 For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
   },
-  salesforce: {
-    id: "salesforce",
-    name: "Salesforce",
-    envPrefix: "SALESFORCE",
-    clientIdVar: "SALESFORCE_CLIENT_ID",
-    clientSecretVar: "SALESFORCE_CLIENT_SECRET",
+  zoom: {
+    id: "zoom",
+    name: "Zoom",
+    envPrefix: "ZOOM",
+    clientIdVar: "ZOOM_CLIENT_ID",
+    clientSecretVar: "ZOOM_CLIENT_SECRET",
     popular: false,
     betterAuthConfig: {
       import: "",
-      clientSideProvider: '"salesforce"',
-      socialProvider: `salesforce({
-      clientId: process.env.SALESFORCE_CLIENT_ID!,
-      clientSecret: process.env.SALESFORCE_CLIENT_SECRET!,
-      environment: process.env.SALESFORCE_ENVIRONMENT || "login",
+      clientSideProvider: '"zoom"',
+      socialProvider: `zoom({
+      clientId: process.env.ZOOM_CLIENT_ID!,
+      clientSecret: process.env.ZOOM_CLIENT_SECRET!,
     })`,
-      scopes: []
+      scopes: ["user:read:user"]
     },
     env: [
       {
-        name: "SALESFORCE_CLIENT_ID",
-        type: "server",
-        description: "Salesforce Connected App Consumer Key"
-      },
-      {
-        name: "SALESFORCE_CLIENT_SECRET",
+        name: "ZOOM_CLIENT_ID",
         type: "server",
-        description: "Salesforce Connected App Consumer Secret"
+        description: "Zoom OAuth Client ID"
       },
       {
-        name: "SALESFORCE_ENVIRONMENT",
+        name: "ZOOM_CLIENT_SECRET",
         type: "server",
-        description: 'Salesforce environment: "login" (production) or "test" (sandbox) (default: login)'
+        description: "Zoom OAuth Client Secret"
       }
     ],
     docs: {
-      provider: "https://developer.salesforce.com/",
+      provider: "https://marketplace.zoom.us/",
       betterAuth: "https://www.better-auth.com/docs/authentication/social"
     },
     requiresExtraConfig: true,
-    extraConfigNotes: 'Salesforce supports environment field: "login" for production, "test" for sandbox.',
+    extraConfigNotes: "You MUST include the user:read:user scope for Zoom.",
     readme: {
-      title: "Salesforce OAuth Setup",
-      content: `## Salesforce OAuth Setup
+      title: "Zoom OAuth Setup",
+      content: `## Zoom OAuth Setup
 
-1. Create a Connected App in Salesforce Setup
-2. Enable OAuth Settings
-3. Add callback URL: \`http://localhost:3000/api/auth/callback/salesforce\` (update for production)
-4. Copy the Consumer Key and Consumer Secret to your \`.env\` file
-5. Set SALESFORCE_ENVIRONMENT to "login" for production or "test" for sandbox
+1. Create an app at https://marketplace.zoom.us/
+2. Choose OAuth as the app type
+3. Add redirect URL: \`http://localhost:3000/api/auth/callback/zoom\` (update for production)
+4. Copy the Client ID and Client Secret to your \`.env\` file
+5. **Important**: Make sure to include the \`user:read:user\` scope
 
 For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
-  },
-  slack: {
-    id: "slack",
-    name: "Slack",
-    envPrefix: "SLACK",
-    clientIdVar: "SLACK_CLIENT_ID",
-    clientSecretVar: "SLACK_CLIENT_SECRET",
-    popular: false,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"slack"',
-      socialProvider: `slack({
-      clientId: process.env.SLACK_CLIENT_ID!,
-      clientSecret: process.env.SLACK_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "SLACK_CLIENT_ID",
-        type: "server",
-        description: "Slack App Client ID"
-      },
-      {
-        name: "SLACK_CLIENT_SECRET",
-        type: "server",
-        description: "Slack App Client Secret"
-      }
-    ],
-    docs: {
-      provider: "https://api.slack.com/apps",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: false,
-    extraConfigNotes: "Supports optional team field for workspace restrictions.",
-    readme: {
-      title: "Slack OAuth Setup",
-      content: `## Slack OAuth Setup
+  }
+};
+function getProvider(id) {
+  return OAUTH_PROVIDERS[id];
+}
+function getPopularProviders() {
+  return Object.values(OAUTH_PROVIDERS).filter(
+    (provider) => provider.popular === true
+  );
+}
+function getAdditionalProviders() {
+  return Object.values(OAUTH_PROVIDERS).filter(
+    (provider) => provider.popular !== true
+  );
+}
+
+// src/installers/string-utils.ts
+function detectIndentation(line) {
+  const match = line.match(/^(\s*)/);
+  return match ? match[1] : "";
+}
+async function replacePlaceholder(filePath, placeholder, content, options) {
+  const fileContent = await fs4.readFile(filePath, "utf-8");
+  if (!fileContent.includes(placeholder)) {
+    if (options?.graceful) {
+      console.warn(
+        `Warning: Placeholder "${placeholder}" not found in file: ${filePath}. Skipping replacement.`
+      );
+      return;
+    }
+    throw new Error(
+      `Placeholder "${placeholder}" not found in file: ${filePath}`
+    );
+  }
+  if (options?.inline) {
+    const updatedContent = fileContent.replace(placeholder, content);
+    await fs4.writeFile(filePath, updatedContent, "utf-8");
+    return;
+  }
+  const lines = fileContent.split("\n");
+  const updatedLines = [];
+  for (const line of lines) {
+    if (line.includes(placeholder)) {
+      if (content === "" || content.startsWith("__REMOVE_")) {
+        continue;
+      }
+      const indentation = detectIndentation(line);
+      const indentedContent = content.split("\n").map((contentLine, index) => {
+        if (index === 0) {
+          return indentation + contentLine;
+        }
+        return contentLine ? indentation + contentLine : "";
+      }).join("\n");
+      updatedLines.push(indentedContent);
+    } else {
+      updatedLines.push(line);
+    }
+  }
+  await fs4.writeFile(filePath, updatedLines.join("\n"), "utf-8");
+}
+function generateCredentialsValue(enabled) {
+  return `credentials={${enabled}}`;
+}
+function generateAuthProvidersBlock(oauthProviders, emailPasswordEnabled) {
+  const parts = [];
+  parts.push(`emailAndPassword: {
+      enabled: ${emailPasswordEnabled}
+    },`);
+  if (oauthProviders.length > 0) {
+    const providersObject = oauthProviders.map((providerId) => {
+      const provider = getProvider(providerId);
+      if (!provider) {
+        throw new Error(`Unknown OAuth provider: ${providerId}`);
+      }
+      const configLines = [
+        `clientId: process.env.${provider.envPrefix}_CLIENT_ID!,`,
+        `clientSecret: process.env.${provider.envPrefix}_CLIENT_SECRET!,`
+      ];
+      if (providerId === "figma") {
+        configLines.push(`clientKey: process.env.FIGMA_CLIENT_KEY!,`);
+      }
+      return `${providerId}: {
+        ${configLines.join("\n        ")}
+      }`;
+    }).join(",\n      ");
+    parts.push(`socialProviders: {
+      ${providersObject}
+    },`);
+  }
+  return parts.join("\n    ");
+}
+function generateEnvTsServerSchema(providers) {
+  if (providers.length === 0) {
+    return "";
+  }
+  const schemas = providers.map((providerId) => {
+    const provider = getProvider(providerId);
+    if (!provider) {
+      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    const lines = [];
+    lines.push(`${provider.envPrefix}_CLIENT_ID: z.string(),`);
+    lines.push(`${provider.envPrefix}_CLIENT_SECRET: z.string(),`);
+    if (providerId === "figma") {
+      lines.push(`FIGMA_CLIENT_KEY: z.string(),`);
+    }
+    return lines.join("\n    ");
+  }).join("\n    ");
+  return schemas;
+}
+function generateEnvTsRuntimeMapping(providers) {
+  if (providers.length === 0) {
+    return "";
+  }
+  const mappings = providers.map((providerId) => {
+    const provider = getProvider(providerId);
+    if (!provider) {
+      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    const lines = [];
+    lines.push(`${provider.envPrefix}_CLIENT_ID: process.env.${provider.envPrefix}_CLIENT_ID,`);
+    lines.push(`${provider.envPrefix}_CLIENT_SECRET: process.env.${provider.envPrefix}_CLIENT_SECRET,`);
+    if (providerId === "figma") {
+      lines.push(`FIGMA_CLIENT_KEY: process.env.FIGMA_CLIENT_KEY,`);
+    }
+    return lines.join("\n    ");
+  }).join("\n    ");
+  return mappings;
+}
+function generateOAuthUIProvidersBlock(providers) {
+  if (providers.length === 0) {
+    return "";
+  }
+  const providerList = providers.map((id) => `"${id}"`).join(", ");
+  return `social={{
+  providers: [${providerList}]
+}}`;
+}
+function generateEnvVarsBlock(providers, framework) {
+  if (providers.length === 0) {
+    return "";
+  }
+  const envVars = providers.flatMap((providerId) => {
+    const provider = getProvider(providerId);
+    if (!provider) {
+      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    if (provider.env && provider.env.length > 0) {
+      return provider.env.map((envVar) => {
+        let prefix = "";
+        if (envVar.type === "client") {
+          prefix = framework === "nextjs" ? "NEXT_PUBLIC_" : "VITE_";
+        }
+        return `# ${envVar.description}
+${prefix}${envVar.name}=`;
+      });
+    } else {
+      return [
+        `${provider.clientIdVar}=`,
+        `${provider.clientSecretVar}=`
+      ];
+    }
+  });
+  return envVars.join("\n");
+}
+function generateReadmeSection(providers) {
+  if (providers.length === 0) {
+    return "";
+  }
+  const sections = providers.map((providerId) => {
+    const provider = getProvider(providerId);
+    if (!provider) {
+      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    if (!provider.readme) {
+      throw new Error(
+        `Provider ${providerId} missing readme metadata`
+      );
+    }
+    return provider.readme.content;
+  }).filter(Boolean);
+  if (sections.length === 0) {
+    return "";
+  }
+  return `# OAuth Provider Setup
 
-1. Create a Slack app at https://api.slack.com/apps
-2. Add OAuth & Permissions and configure redirect URLs
-3. Add redirect URL: \`http://localhost:3000/api/auth/callback/slack\` (update for production)
-4. Copy the Client ID and Client Secret to your \`.env\` file
+${sections.join("\n\n---\n\n")}`;
+}
+function assertAndReplace(filePath, content, oldBlock, newBlock, label) {
+  if (!content.includes(oldBlock)) {
+    throw new Error(
+      `configureOrganizations: expected pattern "${label}" not found in ${filePath} \u2014 template drift?`
+    );
+  }
+  return content.replace(oldBlock, newBlock);
+}
+function stripOrgFromGetAuthCall(filePath, content) {
+  const importPattern = /import \{ TABLE_SLUG_ORGANIZATIONS, TABLE_SLUG_SESSIONS, TABLE_SLUG_USERS \} from "~\/db\/constants";?/;
+  const importMatch = content.match(importPattern);
+  if (!importMatch) {
+    throw new Error(
+      `configureOrganizations: expected the TABLE_SLUG_ORGANIZATIONS db/constants import in ${filePath} \u2014 template drift?`
+    );
+  }
+  let result = assertAndReplace(
+    filePath,
+    content,
+    importMatch[0],
+    importMatch[0].replace("TABLE_SLUG_ORGANIZATIONS, ", ""),
+    "TABLE_SLUG_ORGANIZATIONS db/constants import"
+  );
+  const orgPropPattern = /\n[ \t]*orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS,/;
+  const orgPropMatch = result.match(orgPropPattern);
+  if (!orgPropMatch) {
+    throw new Error(
+      `configureOrganizations: expected an "orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS," line in ${filePath} \u2014 template drift?`
+    );
+  }
+  result = assertAndReplace(filePath, result, orgPropMatch[0], "", "orgCollectionSlug prop");
+  result = assertAndReplace(
+    filePath,
+    result,
+    "resolveOrgs: true,",
+    "resolveOrgs: false,",
+    "resolveOrgs: true"
+  );
+  return result;
+}
+function stripOrgFromAuthApi(filePath, content) {
+  let result = assertAndReplace(
+    filePath,
+    content,
+    'import { get } from "@vexcms/core/server";\nimport { v } from "convex/values";\n\nimport {\n  type OrganizationID,\n  type SessionID,\n  TABLE_SLUG_ORGANIZATIONS,\n  TABLE_SLUG_SESSIONS,\n  TABLE_SLUG_USERS,\n  type UserID,\n} from "~/db/constants";',
+    'import { get } from "@vexcms/core/server";\n\nimport { type SessionID, TABLE_SLUG_SESSIONS, TABLE_SLUG_USERS, type UserID } from "~/db/constants";',
+    "auth/api.ts imports"
+  );
+  result = assertAndReplace(
+    filePath,
+    result,
+    "export const getUserOrg = query({\n  args: {\n    noOrgs: v.optional(v.boolean()),\n  },\n  handler: async (ctx, args) => {\n    const empty = { user: null, organization: undefined };\n    const identity = await ctx.auth.getUserIdentity();\n    if (!identity) {\n      return empty;\n    }\n    const session = await get({\n      ctx,\n      id: identity.sessionId as SessionID,\n      collection: TABLE_SLUG_SESSIONS,\n    });\n    if (!session) {\n      return empty;\n    }\n    const user = await get({ ctx, id: identity.subject as UserID, collection: TABLE_SLUG_USERS });\n    if (!user) {\n      return empty;\n    }\n    if (!session.activeOrganizationId || args.noOrgs) {\n      return { user, organization: undefined };\n    }\n    const organization = await get({\n      ctx,\n      id: session.activeOrganizationId as OrganizationID,\n      collection: TABLE_SLUG_ORGANIZATIONS,\n    });\n    return { user, organization: organization ?? undefined };\n  },\n});",
+    "export const getUserOrg = query({\n  args: {},\n  handler: async (ctx) => {\n    const empty = { user: null, organization: undefined };\n    const identity = await ctx.auth.getUserIdentity();\n    if (!identity) {\n      return empty;\n    }\n    const session = await get({\n      ctx,\n      id: identity.sessionId as SessionID,\n      collection: TABLE_SLUG_SESSIONS,\n    });\n    if (!session) {\n      return empty;\n    }\n    const user = await get({ ctx, id: identity.subject as UserID, collection: TABLE_SLUG_USERS });\n    if (!user) {\n      return empty;\n    }\n    return { user, organization: undefined };\n  },\n});",
+    "auth/api.ts getUserOrg body"
+  );
+  return result;
+}
+function stripOrgFromAccess(filePath, content) {
+  let result = assertAndReplace(
+    filePath,
+    content,
+    'import {\n  TABLE_SLUG_ORGANIZATIONS,\n  TABLE_SLUG_USERS,\n  USER_ROLES,\n} from "~/db/constants"',
+    'import { TABLE_SLUG_USERS, USER_ROLES } from "~/db/constants"',
+    "access.ts db/constants import"
+  );
+  result = assertAndReplace(
+    filePath,
+    result,
+    "\n  orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS,",
+    "",
+    "access.ts orgCollectionSlug prop"
+  );
+  return result;
+}
+function stripOrgFromAuthContext(filePath, content) {
+  let result = assertAndReplace(
+    filePath,
+    content,
+    'import { type OrganizationDoc, type UserDoc } from "~/db/constants";',
+    'import { type UserDoc } from "~/db/constants";',
+    "AuthContext.tsx db/constants import"
+  );
+  result = assertAndReplace(
+    filePath,
+    result,
+    "export interface CurrentAuth {\n  organization?: OrganizationDoc;\n  user: null | UserDoc; // null \u2192 unauthenticated \u2192 no roles \u2192 deny\n}",
+    "export interface CurrentAuth {\n  user: null | UserDoc; // null \u2192 unauthenticated \u2192 no roles \u2192 deny\n}",
+    "AuthContext.tsx CurrentAuth interface"
+  );
+  result = assertAndReplace(
+    filePath,
+    result,
+    "  value: {\n    organization?: OrganizationDoc;\n    user: null | UserDoc; // null \u2192 unauthenticated \u2192 no roles \u2192 deny\n  };",
+    "  value: {\n    user: null | UserDoc; // null \u2192 unauthenticated \u2192 no roles \u2192 deny\n  };",
+    "AuthContext.tsx AuthProvider value prop"
+  );
+  result = assertAndReplace(
+    filePath,
+    result,
+    "/** @returns the current caller `{ user, organization }` from the server layout. */",
+    "/** @returns the current caller `{ user }` from the server layout. */",
+    "AuthContext.tsx useAuth JSDoc"
+  );
+  return result;
+}
+function stripOrgFromHasPermission(filePath, content) {
+  return assertAndReplace(
+    filePath,
+    content,
+    "  const { user, organization } = useAuth();\n  return hasPermissionCore({\n    access,\n    user,\n    organization,\n    ...props,\n  });",
+    "  const { user } = useAuth();\n  return hasPermissionCore({\n    access,\n    user,\n    ...props,\n  });",
+    "hasPermission.ts useAuth destructure + hasPermissionCore call"
+  );
+}
+function stripOrgFromDbConstants(filePath, content) {
+  return assertAndReplace(
+    filePath,
+    content,
+    '\nexport const TABLE_SLUG_ORGANIZATIONS = "organization" as const\nexport type OrganizationDoc = Doc<typeof TABLE_SLUG_ORGANIZATIONS>\nexport type OrganizationID = Id<typeof TABLE_SLUG_ORGANIZATIONS>\n',
+    "",
+    "db/constants/index.ts organization table block"
+  );
+}
 
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+// src/installers/base.ts
+var VexFrameworkInstaller = class {
+  /**
+   * Binds this installer to the destination directory and package name used
+   * throughout scaffolding (template copy target, package.json, README, etc).
+   *
+   * @param targetPath - Absolute path of the directory the project is created in.
+   * @param projectName - npm package name recorded for subclasses; not read directly by the base class.
+   */
+  constructor(targetPath, projectName) {
+    this.targetPath = targetPath;
+    this.projectName = projectName;
+  }
+  targetPath;
+  projectName;
+  /**
+   * Copy base template files to target directory
+   */
+  async copyBaseFiles() {
+    await copyTemplate(this.frameworkName, this.targetPath);
+  }
+  /**
+   * Apply a template overlay on top of the base template.
+   * Merges overlay files onto the already-copied base — existing files
+   * not in the overlay are left untouched.
+   *
+   * @param overlay - Name of the overlay template directory under `templates/` (e.g. `"marketing-site"`).
+   */
+  async applyTemplateOverlay(overlay) {
+    const { dirname: dirname2 } = await import("path");
+    const { fileURLToPath: fileURLToPath2 } = await import("url");
+    const __filename = fileURLToPath2(import.meta.url);
+    const __dirname = dirname2(__filename);
+    let overlayDir = path2.join(__dirname, "../../templates", overlay);
+    if (!await fs5.pathExists(overlayDir)) {
+      overlayDir = path2.join(__dirname, "../templates", overlay);
     }
-  },
-  tiktok: {
-    id: "tiktok",
-    name: "TikTok",
-    envPrefix: "TIKTOK",
-    clientIdVar: "TIKTOK_CLIENT_KEY",
-    clientSecretVar: "TIKTOK_CLIENT_SECRET",
-    popular: false,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"tiktok"',
-      socialProvider: `tiktok({
-      clientKey: process.env.TIKTOK_CLIENT_KEY!,
-      clientSecret: process.env.TIKTOK_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "TIKTOK_CLIENT_KEY",
-        type: "server",
-        description: "TikTok Client Key (not Client ID)"
-      },
-      {
-        name: "TIKTOK_CLIENT_SECRET",
-        type: "server",
-        description: "TikTok Client Secret"
+    await overlayTemplate({ overlayDir, targetDir: this.targetPath });
+  }
+  /**
+   * Update the package.json name field, the vex:update script (to match the
+   * detected package manager), and README.md's `{{PROJECT_NAME}}` heading.
+   *
+   * @param name - npm package name to write into `package.json`'s `name` field
+   *   and to substitute for `{{PROJECT_NAME}}` in `README.md`.
+   */
+  async updatePackageName(name) {
+    const pkgPath = path2.join(this.targetPath, "package.json");
+    const pkg = await fs5.readJson(pkgPath);
+    pkg.name = name;
+    const pm = this.detectPackageManager();
+    if (pkg.scripts?.["vex:update"] && pm !== "pnpm") {
+      const addCmd = pm === "yarn" ? "yarn add" : pm === "bun" ? "bun add" : "npm install";
+      pkg.scripts["vex:update"] = pkg.scripts["vex:update"].replace(/^pnpm add/, addCmd);
+    }
+    await fs5.writeJson(pkgPath, pkg, { spaces: 2 });
+    const readmePath = path2.join(this.targetPath, "README.md");
+    if (await fs5.pathExists(readmePath)) {
+      const readme = await fs5.readFile(readmePath, "utf-8");
+      await fs5.writeFile(readmePath, readme.replace("{{PROJECT_NAME}}", name));
+    }
+  }
+  /**
+   * Configure the dev server port.
+   * Updates package.json dev script and creates .env.local with NEXT_PUBLIC_SITE_URL.
+   *
+   * @param port - Dev server port number to write into the `dev` script and `.env.local`.
+   */
+  async configurePort(port) {
+    const pkgPath = path2.join(this.targetPath, "package.json");
+    const pkg = await fs5.readJson(pkgPath);
+    if (pkg.scripts?.dev) {
+      if (pkg.scripts.dev.includes("--port")) {
+        pkg.scripts.dev = pkg.scripts.dev.replace(/--port[= ]\d+/, `--port=${port}`);
+      } else {
+        pkg.scripts.dev = `${pkg.scripts.dev} --port=${port}`;
       }
-    ],
-    docs: {
-      provider: "https://developers.tiktok.com/",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: true,
-    extraConfigNotes: "TikTok uses clientKey instead of clientId. Make sure to use the correct field name.",
-    readme: {
-      title: "TikTok OAuth Setup",
-      content: `## TikTok OAuth Setup
-
-1. Register an app at https://developers.tiktok.com/
-2. Configure Login Kit
-3. Add redirect URI: \`http://localhost:3000/api/auth/callback/tiktok\` (update for production)
-4. Copy the Client Key (not Client ID) and Client Secret to your \`.env\` file
-
-**Important**: TikTok uses clientKey instead of clientId.
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
     }
-  },
-  vercel: {
-    id: "vercel",
-    name: "Vercel",
-    envPrefix: "VERCEL",
-    clientIdVar: "VERCEL_CLIENT_ID",
-    clientSecretVar: "VERCEL_CLIENT_SECRET",
-    popular: false,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"vercel"',
-      socialProvider: `vercel({
-      clientId: process.env.VERCEL_CLIENT_ID!,
-      clientSecret: process.env.VERCEL_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "VERCEL_CLIENT_ID",
-        type: "server",
-        description: "Vercel OAuth Client ID"
-      },
-      {
-        name: "VERCEL_CLIENT_SECRET",
-        type: "server",
-        description: "Vercel OAuth Client Secret"
+    await fs5.writeJson(pkgPath, pkg, { spaces: 2 });
+    const siteUrl = `http://localhost:${port}`;
+    const envLocalPath = path2.join(this.targetPath, ".env.local");
+    const envContent = [
+      `NEXT_PUBLIC_SITE_URL=${siteUrl}`,
+      `SITE_URL=${siteUrl}`,
+      `BETTER_AUTH_SECRET=${this.generateAuthSecret()}`,
+      `NEXT_PUBLIC_CONVEX_URL=https://placeholder.convex.cloud`,
+      `NEXT_PUBLIC_CONVEX_SITE_URL=https://placeholder.convex.site`,
+      `CONVEX_DEPLOYMENT=`,
+      ""
+    ].join("\n");
+    await fs5.writeFile(envLocalPath, envContent);
+  }
+  /**
+   * Rewrites the scaffolded `package.json` for life inside a host pnpm
+   * workspace (`--monorepo`). `@vexcms/*` dependencies become
+   * `workspace:*`; any other dependency the host's `pnpm-workspace.yaml`
+   * catalog also pins becomes `catalog:`; everything else keeps its
+   * literal, catalog-resolved version. No-op when `options.monorepo` is
+   * false or `options.workspaceRoot` is unset.
+   *
+   * @param options - Resolved project options; only `monorepo`/`workspaceRoot` are consulted.
+   */
+  async applyMonorepoRewrite(options) {
+    if (!options.monorepo || !options.workspaceRoot) return;
+    const pkgPath = path2.join(this.targetPath, "package.json");
+    const manifest = await fs5.readJson(pkgPath);
+    const catalog = await readWorkspaceCatalog({ workspaceRoot: options.workspaceRoot });
+    const rewritten = rewriteManifestForMonorepo({ manifest, catalog });
+    await fs5.writeJson(pkgPath, rewritten, { spaces: 2 });
+  }
+  /**
+   * Detect the package manager used to invoke the CLI
+   *
+   * @returns The package manager inferred from `npm_config_user_agent`, defaulting to `"npm"` when it can't be determined.
+   */
+  detectPackageManager() {
+    const userAgent = process.env.npm_config_user_agent;
+    if (userAgent) {
+      if (userAgent.includes("pnpm")) return "pnpm";
+      if (userAgent.includes("yarn")) return "yarn";
+      if (userAgent.includes("bun")) return "bun";
+    }
+    return "npm";
+  }
+  /**
+   * Install project dependencies using detected package manager
+   */
+  async installDependencies() {
+    const packageManager = this.detectPackageManager();
+    const spinner = ora(`Installing dependencies with ${packageManager}...`).start();
+    try {
+      await execa(packageManager, ["install"], {
+        cwd: this.targetPath,
+        stdio: "pipe"
+      });
+      spinner.succeed("Dependencies installed successfully");
+    } catch (error) {
+      spinner.fail("Failed to install dependencies");
+      throw new Error(
+        `Dependency installation failed: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  }
+  /**
+   * Format code using project's formatter
+   */
+  async formatCode() {
+    const packageManager = this.detectPackageManager();
+    const spinner = ora("Formatting code...").start();
+    try {
+      const result = await execa(packageManager, ["run", "format"], {
+        cwd: this.targetPath,
+        stdio: "pipe",
+        reject: false
+      });
+      if (result.exitCode === 0) {
+        spinner.succeed("Code formatted successfully");
+      } else {
+        spinner.warn("Formatting completed with warnings");
       }
-    ],
-    docs: {
-      provider: "https://vercel.com/account/integrations",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: false,
-    extraConfigNotes: "Uses PKCE for enhanced security.",
-    readme: {
-      title: "Vercel OAuth Setup",
-      content: `## Vercel OAuth Setup
-
-1. Create an integration at https://vercel.com/account/integrations
-2. Configure OAuth settings
-3. Add redirect URL: \`http://localhost:3000/api/auth/callback/vercel\` (update for production)
-4. Copy the Client ID and Client Secret to your \`.env\` file
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      spinner.warn(`Failed to format code: ${errorMessage}`);
     }
-  },
-  vk: {
-    id: "vk",
-    name: "VK",
-    envPrefix: "VK",
-    clientIdVar: "VK_CLIENT_ID",
-    clientSecretVar: "VK_CLIENT_SECRET",
-    popular: false,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"vk"',
-      socialProvider: `vk({
-      clientId: process.env.VK_CLIENT_ID!,
-      clientSecret: process.env.VK_CLIENT_SECRET!,
-    })`,
-      scopes: []
-    },
-    env: [
-      {
-        name: "VK_CLIENT_ID",
-        type: "server",
-        description: "VK Application ID"
-      },
-      {
-        name: "VK_CLIENT_SECRET",
-        type: "server",
-        description: "VK Secure Key"
+  }
+  /**
+   * Lint and fix code using project's ESLint configuration
+   */
+  async lintCode() {
+    const packageManager = this.detectPackageManager();
+    const spinner = ora("Linting and fixing code...").start();
+    try {
+      const args2 = packageManager === "pnpm" ? ["lint", "--fix"] : ["run", "lint", "--", "--fix"];
+      const result = await execa(packageManager, args2, {
+        cwd: this.targetPath,
+        stdio: "pipe",
+        reject: false
+      });
+      if (result.exitCode === 0) {
+        spinner.succeed("Code linted and fixed successfully");
+      } else {
+        spinner.warn("Linting completed with warnings");
       }
-    ],
-    docs: {
-      provider: "https://vk.com/apps?act=manage",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: false,
-    extraConfigNotes: "",
-    readme: {
-      title: "VK OAuth Setup",
-      content: `## VK OAuth Setup
-
-1. Create an app at https://vk.com/apps?act=manage
-2. Configure OAuth settings in the app
-3. Add authorized redirect URI: \`http://localhost:3000/api/auth/callback/vk\` (update for production)
-4. Copy the Application ID and Secure Key to your \`.env\` file
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      spinner.warn(`Failed to lint code: ${errorMessage}`);
     }
-  },
-  zoom: {
-    id: "zoom",
-    name: "Zoom",
-    envPrefix: "ZOOM",
-    clientIdVar: "ZOOM_CLIENT_ID",
-    clientSecretVar: "ZOOM_CLIENT_SECRET",
-    popular: false,
-    betterAuthConfig: {
-      import: "",
-      clientSideProvider: '"zoom"',
-      socialProvider: `zoom({
-      clientId: process.env.ZOOM_CLIENT_ID!,
-      clientSecret: process.env.ZOOM_CLIENT_SECRET!,
-    })`,
-      scopes: ["user:read:user"]
-    },
-    env: [
-      {
-        name: "ZOOM_CLIENT_ID",
-        type: "server",
-        description: "Zoom OAuth Client ID"
-      },
-      {
-        name: "ZOOM_CLIENT_SECRET",
-        type: "server",
-        description: "Zoom OAuth Client Secret"
+  }
+  /**
+   * Initialize Git repository in target directory
+   */
+  async initGitRepo() {
+    const spinner = ora("Initializing Git repository...").start();
+    try {
+      try {
+        await execa("git", ["--version"], { stdio: "pipe" });
+      } catch {
+        spinner.fail("Git is not installed");
+        throw new Error("Git is not installed. Please install Git to initialize a repository.");
       }
-    ],
-    docs: {
-      provider: "https://marketplace.zoom.us/",
-      betterAuth: "https://www.better-auth.com/docs/authentication/social"
-    },
-    requiresExtraConfig: true,
-    extraConfigNotes: "You MUST include the user:read:user scope for Zoom.",
-    readme: {
-      title: "Zoom OAuth Setup",
-      content: `## Zoom OAuth Setup
-
-1. Create an app at https://marketplace.zoom.us/
-2. Choose OAuth as the app type
-3. Add redirect URL: \`http://localhost:3000/api/auth/callback/zoom\` (update for production)
-4. Copy the Client ID and Client Secret to your \`.env\` file
-5. **Important**: Make sure to include the \`user:read:user\` scope
-
-For more details, see the [Better Auth documentation](https://www.better-auth.com/docs/authentication/social).`
+      await execa("git", ["init"], { cwd: this.targetPath, stdio: "pipe" });
+      await execa("git", ["add", "."], { cwd: this.targetPath, stdio: "pipe" });
+      await execa(
+        "git",
+        ["commit", "-m", "Initial commit from create-vexcms"],
+        { cwd: this.targetPath, stdio: "pipe" }
+      );
+      spinner.succeed("Git repository initialized");
+    } catch (error) {
+      spinner.fail("Failed to initialize Git repository");
+      throw new Error(
+        `Git initialization failed: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
     }
   }
-};
-function getProvider(id) {
-  return OAUTH_PROVIDERS[id];
-}
-function getPopularProviders() {
-  return Object.values(OAUTH_PROVIDERS).filter(
-    (provider) => provider.popular === true
-  );
-}
-function getAdditionalProviders() {
-  return Object.values(OAUTH_PROVIDERS).filter(
-    (provider) => provider.popular !== true
-  );
-}
-
-// src/installers/string-utils.ts
-function detectIndentation(line) {
-  const match = line.match(/^(\s*)/);
-  return match ? match[1] : "";
-}
-async function replacePlaceholder(filePath, placeholder, content, options) {
-  const fileContent = await fs5.readFile(filePath, "utf-8");
-  if (!fileContent.includes(placeholder)) {
-    if (options?.graceful) {
-      console.warn(
-        `Warning: Placeholder "${placeholder}" not found in file: ${filePath}. Skipping replacement.`
+  /**
+   * Generate a secure random secret for Better Auth
+   *
+   * @returns A 64-character hex string (32 random bytes) suitable for `BETTER_AUTH_SECRET`.
+   */
+  generateAuthSecret() {
+    return crypto.randomBytes(32).toString("hex");
+  }
+  /**
+   * Write the generated auth secret to .env.example
+   */
+  async writeAuthSecret() {
+    const envPath = path2.join(this.targetPath, ".env.example");
+    const secret = this.generateAuthSecret();
+    if (await fs5.pathExists(envPath)) {
+      let content = await fs5.readFile(envPath, "utf-8");
+      content = content.replace(
+        /BETTER_AUTH_SECRET=.*/,
+        `BETTER_AUTH_SECRET=${secret}`
       );
-      return;
+      await fs5.writeFile(envPath, content);
+    }
+  }
+  /**
+   * Configure the Better Auth organizations plugin.
+   * When enabled, replaces placeholders with organization import and plugin,
+   * and leaves every org-aware file (`createGetAuth` call sites, `access.ts`,
+   * `AuthContext.tsx`, `hasPermission.ts`, `convex/auth/api.ts`,
+   * `db/constants/index.ts`) untouched.
+   * When disabled, removes the placeholder lines AND strips organization
+   * wiring from those same files down to the org-free shape — the
+   * templates ship org-enabled by default (so `--orgs` needs no surgery),
+   * so the default (orgs-declined) path has to actively cut it.
+   *
+   * @param enabled - Whether the organizations (multi-tenant) plugin should stay wired.
+   */
+  async configureOrganizations(enabled) {
+    const pluginsPath = path2.join(this.targetPath, "convex/auth/plugins/index.ts");
+    if (await fs5.pathExists(pluginsPath)) {
+      let content = await fs5.readFile(pluginsPath, "utf-8");
+      if (enabled) {
+        content = content.replace(
+          "// {{ORGANIZATIONS_IMPORT}}",
+          'import { organization } from "better-auth/plugins"'
+        );
+        content = content.replace(
+          "  // {{ORGANIZATIONS_PLUGIN}}",
+          "  organization(),"
+        );
+      } else {
+        content = content.replace(/.*\/\/ \{\{ORGANIZATIONS_IMPORT\}\}\n?/, "");
+        content = content.replace(/.*\/\/ \{\{ORGANIZATIONS_PLUGIN\}\}\n?/, "");
+      }
+      await fs5.writeFile(pluginsPath, content);
+    }
+    if (!enabled) {
+      await this.stripOrganizationWiring();
     }
-    throw new Error(
-      `Placeholder "${placeholder}" not found in file: ${filePath}`
-    );
-  }
-  if (options?.inline) {
-    const updatedContent = fileContent.replace(placeholder, content);
-    await fs5.writeFile(filePath, updatedContent, "utf-8");
-    return;
   }
-  const lines = fileContent.split("\n");
-  const updatedLines = [];
-  for (const line of lines) {
-    if (line.includes(placeholder)) {
-      if (content === "" || content.startsWith("__REMOVE_")) {
-        continue;
+  /**
+   * Rewrites every scaffolded file that references organizations down to
+   * its org-free shape. Called by `configureOrganizations(false)` — the
+   * `--orgs`-declined default. Templates ship org-ENABLED (so `--orgs`
+   * requires no surgery); this is what makes the default scaffold buildable
+   * once the generated registry drops org tables on the first `vex dev`
+   * regen. Every transform throws loudly when its expected pattern is
+   * missing (template drift), rather than silently no-opping.
+   *
+   * `src/vexcms/api.ts` only exists in full (marketing-site overlay)
+   * scaffolds — skipped, not required, for `--bare`.
+   */
+  async stripOrganizationWiring() {
+    const requiredFiles = [
+      { rel: "convex/vex.ts", transform: stripOrgFromGetAuthCall },
+      { rel: "convex/vex/globals.ts", transform: stripOrgFromGetAuthCall },
+      { rel: "convex/vex/media.ts", transform: stripOrgFromGetAuthCall },
+      { rel: "convex/auth/api.ts", transform: stripOrgFromAuthApi },
+      { rel: "src/auth/access.ts", transform: stripOrgFromAccess },
+      { rel: "src/context/AuthContext.tsx", transform: stripOrgFromAuthContext },
+      { rel: "src/auth/hasPermission.ts", transform: stripOrgFromHasPermission },
+      { rel: "src/db/constants/index.ts", transform: stripOrgFromDbConstants }
+    ];
+    for (const file of requiredFiles) {
+      const filePath = path2.join(this.targetPath, file.rel);
+      if (!await fs5.pathExists(filePath)) {
+        throw new Error(
+          `configureOrganizations: required file "${file.rel}" is missing from the scaffold \u2014 template drift?`
+        );
       }
-      const indentation = detectIndentation(line);
-      const indentedContent = content.split("\n").map((contentLine, index) => {
-        if (index === 0) {
-          return indentation + contentLine;
-        }
-        return contentLine ? indentation + contentLine : "";
-      }).join("\n");
-      updatedLines.push(indentedContent);
-    } else {
-      updatedLines.push(line);
+      const content = await fs5.readFile(filePath, "utf-8");
+      await fs5.writeFile(filePath, file.transform(filePath, content));
+    }
+    const apiPath = path2.join(this.targetPath, "src/vexcms/api.ts");
+    if (await fs5.pathExists(apiPath)) {
+      const content = await fs5.readFile(apiPath, "utf-8");
+      await fs5.writeFile(apiPath, stripOrgFromGetAuthCall(apiPath, content));
     }
   }
-  await fs5.writeFile(filePath, updatedLines.join("\n"), "utf-8");
-}
-function generateCredentialsValue(enabled) {
-  return `credentials={${enabled}}`;
-}
-function generateAuthProvidersBlock(oauthProviders, emailPasswordEnabled) {
-  const parts = [];
-  parts.push(`emailAndPassword: {
-      enabled: ${emailPasswordEnabled}
-    },`);
-  if (oauthProviders.length > 0) {
-    const providersObject = oauthProviders.map((providerId) => {
-      const provider = getProvider(providerId);
-      if (!provider) {
-        throw new Error(`Unknown OAuth provider: ${providerId}`);
-      }
-      const configLines = [
-        `clientId: process.env.${provider.envPrefix}_CLIENT_ID!,`,
-        `clientSecret: process.env.${provider.envPrefix}_CLIENT_SECRET!,`
-      ];
-      if (providerId === "figma") {
-        configLines.push(`clientKey: process.env.FIGMA_CLIENT_KEY!,`);
+  /**
+   * Main orchestration method for project initialization
+   *
+   * @param options - Resolved project options from CLI flags and prompts, driving every scaffolding step (template copy, overlay, port, auth, README, git, install).
+   */
+  async initProject(options) {
+    const copySpinner = ora("Copying template files...").start();
+    try {
+      await this.copyBaseFiles();
+      copySpinner.succeed("Template files copied");
+    } catch (error) {
+      copySpinner.fail("Failed to copy template files");
+      throw error;
+    }
+    if (!options.bare) {
+      const overlaySpinner = ora("Applying marketing site template...").start();
+      try {
+        await this.applyTemplateOverlay("marketing-site");
+        overlaySpinner.succeed("Marketing site template applied");
+      } catch (error) {
+        overlaySpinner.fail("Failed to apply template overlay");
+        throw error;
       }
-      return `${providerId}: {
-        ${configLines.join("\n        ")}
-      }`;
-    }).join(",\n      ");
-    parts.push(`socialProviders: {
-      ${providersObject}
-    },`);
-  }
-  return parts.join("\n    ");
-}
-function generateEnvTsServerSchema(providers) {
-  if (providers.length === 0) {
-    return "";
-  }
-  const schemas = providers.map((providerId) => {
-    const provider = getProvider(providerId);
-    if (!provider) {
-      throw new Error(`Unknown OAuth provider: ${providerId}`);
     }
-    const lines = [];
-    lines.push(`${provider.envPrefix}_CLIENT_ID: z.string(),`);
-    lines.push(`${provider.envPrefix}_CLIENT_SECRET: z.string(),`);
-    if (providerId === "figma") {
-      lines.push(`FIGMA_CLIENT_KEY: z.string(),`);
+    const nameSpinner = ora("Configuring project...").start();
+    try {
+      await this.updatePackageName(options.projectName);
+      await this.configurePort(options.port);
+      nameSpinner.succeed("Project configured");
+    } catch (error) {
+      nameSpinner.fail("Failed to configure project");
+      throw error;
     }
-    return lines.join("\n    ");
-  }).join("\n    ");
-  return schemas;
-}
-function generateEnvTsRuntimeMapping(providers) {
-  if (providers.length === 0) {
-    return "";
-  }
-  const mappings = providers.map((providerId) => {
-    const provider = getProvider(providerId);
-    if (!provider) {
-      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    const authSpinner = ora("Configuring authentication...").start();
+    try {
+      await this.updateOAuthConfig(options.oauthProviders, options.emailPasswordAuth);
+      authSpinner.succeed(
+        options.emailPasswordAuth || options.oauthProviders.length > 0 ? "Authentication configuration updated" : "Authentication placeholders cleaned up"
+      );
+    } catch (error) {
+      authSpinner.fail("Failed to configure authentication");
+      throw error;
     }
-    const lines = [];
-    lines.push(`${provider.envPrefix}_CLIENT_ID: process.env.${provider.envPrefix}_CLIENT_ID,`);
-    lines.push(`${provider.envPrefix}_CLIENT_SECRET: process.env.${provider.envPrefix}_CLIENT_SECRET,`);
-    if (providerId === "figma") {
-      lines.push(`FIGMA_CLIENT_KEY: process.env.FIGMA_CLIENT_KEY,`);
+    const oauthUISpinner = ora("Configuring OAuth UI...").start();
+    try {
+      await this.updateOAuthUIConfig(options.oauthProviders, options.emailPasswordAuth);
+      oauthUISpinner.succeed(
+        options.oauthProviders.length > 0 ? "OAuth UI configuration updated" : "OAuth UI placeholders cleaned up"
+      );
+    } catch (error) {
+      oauthUISpinner.fail("Failed to configure OAuth UI");
+      throw error;
     }
-    return lines.join("\n    ");
-  }).join("\n    ");
-  return mappings;
-}
-function generateOAuthUIProvidersBlock(providers) {
-  if (providers.length === 0) {
-    return "";
-  }
-  const providerList = providers.map((id) => `"${id}"`).join(", ");
-  return `social={{
-  providers: [${providerList}]
-}}`;
-}
-function generateEnvVarsBlock(providers, framework) {
-  if (providers.length === 0) {
-    return "";
-  }
-  const envVars = providers.flatMap((providerId) => {
-    const provider = getProvider(providerId);
-    if (!provider) {
-      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    const envSpinner = ora("Updating .env.example...").start();
+    try {
+      await this.updateEnvExample(options.oauthProviders);
+      envSpinner.succeed(
+        options.oauthProviders.length > 0 ? ".env.example updated" : ".env.example placeholders cleaned up"
+      );
+    } catch (error) {
+      envSpinner.fail("Failed to update .env.example");
+      throw error;
     }
-    if (provider.env && provider.env.length > 0) {
-      return provider.env.map((envVar) => {
-        let prefix = "";
-        if (envVar.type === "client") {
-          prefix = framework === "nextjs" ? "NEXT_PUBLIC_" : "VITE_";
-        }
-        return `# ${envVar.description}
-${prefix}${envVar.name}=`;
-      });
-    } else {
-      return [
-        `${provider.clientIdVar}=`,
-        `${provider.clientSecretVar}=`
-      ];
+    const envTsSpinner = ora("Updating typed env configuration...").start();
+    try {
+      await this.updateEnvTs(options.oauthProviders);
+      envTsSpinner.succeed(
+        options.oauthProviders.length > 0 ? "Typed env configuration updated" : "Typed env placeholders cleaned up"
+      );
+    } catch (error) {
+      envTsSpinner.fail("Failed to update typed env configuration");
+      throw error;
     }
-  });
-  return envVars.join("\n");
-}
-function generateReadmeSection(providers) {
-  if (providers.length === 0) {
-    return "";
-  }
-  const sections = providers.map((providerId) => {
-    const provider = getProvider(providerId);
-    if (!provider) {
-      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    const readmeSpinner = ora("Updating README...").start();
+    try {
+      await this.updateReadme(options.oauthProviders);
+      readmeSpinner.succeed(
+        options.oauthProviders.length > 0 ? "README updated" : "README placeholders cleaned up"
+      );
+    } catch (error) {
+      readmeSpinner.fail("Failed to update README");
+      throw error;
     }
-    if (!provider.readme) {
-      throw new Error(
-        `Provider ${providerId} missing readme metadata`
+    const orgsSpinner = ora("Configuring organizations...").start();
+    try {
+      await this.configureOrganizations(options.orgs);
+      orgsSpinner.succeed(
+        options.orgs ? "Organizations plugin enabled" : "Organizations placeholders cleaned up"
       );
+    } catch (error) {
+      orgsSpinner.fail("Failed to configure organizations");
+      throw error;
+    }
+    const secretSpinner = ora("Generating auth secret...").start();
+    try {
+      await this.writeAuthSecret();
+      secretSpinner.succeed("Auth secret generated");
+    } catch (error) {
+      secretSpinner.fail("Failed to generate auth secret");
+      throw error;
+    }
+    if (options.monorepo) {
+      const monorepoSpinner = ora("Rewriting dependencies for the host workspace...").start();
+      try {
+        await this.applyMonorepoRewrite(options);
+        monorepoSpinner.succeed("Dependencies rewritten for the host workspace");
+      } catch (error) {
+        monorepoSpinner.fail("Failed to rewrite dependencies for the host workspace");
+        throw error;
+      }
+    }
+    if (options.initGit && !options.monorepo) {
+      await this.initGitRepo();
+    }
+    if (options.installDependencies && !options.monorepo) {
+      await this.installDependencies();
+      await this.lintCode();
+      await this.formatCode();
     }
-    return provider.readme.content;
-  }).filter(Boolean);
-  if (sections.length === 0) {
-    return "";
   }
-  return `# OAuth Provider Setup
-
-${sections.join("\n\n---\n\n")}`;
-}
+};
 
 // src/installers/nextjs.ts
+import { join as join2 } from "path";
 var VexNextJSInstaller = class extends VexFrameworkInstaller {
   /**
    * Framework identifier used for template selection and logging.