refactor: migrate to base ui

.agents/skills/better-auth-best-practices/SKILL.md

@@ -0,0 +1,182 @@
+---
+name: better-auth-best-practices
+description: Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.
+---
+
+# Better Auth Integration Guide
+
+**Always consult [better-auth.com/docs](https://better-auth.com/docs) for code examples and latest API.**
+
+---
+
+## Setup Workflow
+
+1. Install: `npm install better-auth`
+2. Set env vars: `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL`
+3. Create `auth.ts` with database + config
+4. Create route handler for your framework
+5. Run migrations:
+   - **Built-in adapter:** `npx @better-auth/cli@latest migrate`
+   - **Drizzle:** `npx @better-auth/cli@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)
+   - **Prisma:** `npx @better-auth/cli@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`
+6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`
+
+---
+
+## Quick Reference
+
+### Environment Variables
+- `BETTER_AUTH_SECRET` - Encryption secret (min 32 chars). Generate: `openssl rand -base64 32`
+- `BETTER_AUTH_URL` - Base URL (e.g., `https://example.com`)
+
+Only define `baseURL`/`secret` in config if env vars are NOT set.
+
+### File Location
+CLI looks for `auth.ts` in: `./`, `./lib`, `./utils`, or under `./src`. Use `--config` for custom path.
+
+### CLI Commands
+- `npx @better-auth/cli@latest migrate` - Apply schema (built-in adapter)
+- `npx @better-auth/cli@latest generate` - Generate schema for Prisma/Drizzle
+- `npx @better-auth/cli mcp --cursor` - Add MCP to AI tools
+
+**Re-run after adding/changing plugins.**
+
+---
+
+## Core Config Options
+
+| Option | Notes |
+|--------|-------|
+| `appName` | Optional display name |
+| `baseURL` | Only if `BETTER_AUTH_URL` not set |
+| `basePath` | Default `/api/auth`. Set `/` for root. |
+| `secret` | Only if `BETTER_AUTH_SECRET` not set |
+| `database` | Required for most features. See adapters docs. |
+| `secondaryStorage` | Redis/KV for sessions & rate limits |
+| `emailAndPassword` | `{ enabled: true }` to activate |
+| `socialProviders` | `{ google: { clientId, clientSecret }, ... }` |
+| `plugins` | Array of plugins |
+| `trustedOrigins` | CSRF whitelist |
+
+---
+
+## Database
+
+**Direct connections:** Pass `pg.Pool`, `mysql2` pool, `better-sqlite3`, or `bun:sqlite` instance. For Postgres, also supports `postgres` (postgres.js) and `@neondatabase/serverless`.
+
+**ORM adapters:** Import from `better-auth/adapters/drizzle`, `better-auth/adapters/prisma`, `better-auth/adapters/mongodb`.
+
+**Drizzle provider values:** `"pg"` (PostgreSQL), `"mysql"` (MySQL), `"sqlite"` (SQLite). Must match the driver used.
+
+**Critical:** Better Auth uses adapter model names, NOT underlying table names. If Prisma model is `User` mapping to table `users`, use `modelName: "user"` (Prisma reference), not `"users"`.
+
+---
+
+## Session Management
+
+**Storage priority:**
+1. If `secondaryStorage` defined → sessions go there (not DB)
+2. Set `session.storeSessionInDatabase: true` to also persist to DB
+3. No database + `cookieCache` → fully stateless mode
+
+**Cookie cache strategies:**
+- `compact` (default) - Base64url + HMAC. Smallest.
+- `jwt` - Standard JWT. Readable but signed.
+- `jwe` - Encrypted. Maximum security.
+
+**Key options:** `session.expiresIn` (default 7 days), `session.updateAge` (refresh interval), `session.cookieCache.maxAge`, `session.cookieCache.version` (change to invalidate all sessions).
+
+---
+
+## User & Account Config
+
+**User:** `user.modelName`, `user.fields` (column mapping), `user.additionalFields`, `user.changeEmail.enabled` (disabled by default), `user.deleteUser.enabled` (disabled by default).
+
+**Account:** `account.modelName`, `account.accountLinking.enabled`, `account.storeAccountCookie` (for stateless OAuth).
+
+**Required for registration:** `email` and `name` fields.
+
+---
+
+## Email Flows
+
+- `emailVerification.sendVerificationEmail` - Must be defined for verification to work
+- `emailVerification.sendOnSignUp` / `sendOnSignIn` - Auto-send triggers
+- `emailAndPassword.sendResetPassword` - Password reset email handler
+
+---
+
+## Security
+
+**In `advanced`:**
+- `useSecureCookies` - Force HTTPS cookies
+- `disableCSRFCheck` - ⚠️ Security risk
+- `disableOriginCheck` - ⚠️ Security risk  
+- `crossSubDomainCookies.enabled` - Share cookies across subdomains
+- `ipAddress.ipAddressHeaders` - Custom IP headers for proxies
+- `database.generateId` - Custom ID generation or `"serial"`/`"uuid"`/`false`
+
+**Rate limiting:** `rateLimit.enabled`, `rateLimit.window`, `rateLimit.max`, `rateLimit.storage` ("memory" | "database" | "secondary-storage").
+
+---
+
+## Hooks
+
+**Endpoint hooks:** `hooks.before` / `hooks.after` - Array of `{ matcher, handler }`. Use `createAuthMiddleware`. Access `ctx.path`, `ctx.context.returned` (after), `ctx.context.session`.
+
+**Database hooks:** `databaseHooks.user.create.before/after`, same for `session`, `account`. Useful for adding default values or post-creation actions.
+
+**Hook context (`ctx.context`):** `session`, `secret`, `authCookies`, `password.hash()`/`verify()`, `adapter`, `internalAdapter`, `generateId()`, `tables`, `baseURL`.
+
+---
+
+## Plugins
+
+**Import from dedicated paths for tree-shaking:**
+```
+import { twoFactor } from "better-auth/plugins/two-factor"
+```
+NOT `from "better-auth/plugins"`.
+
+**Popular plugins:** `twoFactor`, `organization`, `passkey`, `magicLink`, `emailOtp`, `username`, `phoneNumber`, `admin`, `apiKey`, `bearer`, `jwt`, `multiSession`, `sso`, `oauthProvider`, `oidcProvider`, `openAPI`, `genericOAuth`.
+
+Client plugins go in `createAuthClient({ plugins: [...] })`.
+
+---
+
+## Client
+
+Import from: `better-auth/client` (vanilla), `better-auth/react`, `better-auth/vue`, `better-auth/svelte`, `better-auth/solid`.
+
+Key methods: `signUp.email()`, `signIn.email()`, `signIn.social()`, `signOut()`, `useSession()`, `getSession()`, `revokeSession()`, `revokeSessions()`.
+
+---
+
+## Type Safety
+
+Infer types: `typeof auth.$Infer.Session`, `typeof auth.$Infer.Session.user`.
+
+For separate client/server projects: `createAuthClient<typeof auth>()`.
+
+---
+
+## Common Gotchas
+
+1. **Model vs table name** - Config uses ORM model name, not DB table name
+2. **Plugin schema** - Re-run CLI after adding plugins
+3. **Secondary storage** - Sessions go there by default, not DB
+4. **Cookie cache** - Custom session fields NOT cached, always re-fetched
+5. **Stateless mode** - No DB = session in cookie only, logout on cache expiry
+6. **Change email flow** - Sends to current email first, then new email
+7. **Drizzle: db not initialized** - `drizzleAdapter(db, ...)` requires a `db` instance from `drizzle()`. See `create-auth` skill for setup examples (node-postgres, postgres.js, Neon).
+8. **Drizzle: missing drizzle.config.ts** - `drizzle-kit` commands require a `drizzle.config.ts` pointing to the generated schema file and DB credentials.
+
+---
+
+## Resources
+
+- [Docs](https://better-auth.com/docs)
+- [Options Reference](https://better-auth.com/docs/reference/options)
+- [LLMs.txt](https://better-auth.com/llms.txt)
+- [GitHub](https://github.com/better-auth/better-auth)
+- [Init Options Source](https://github.com/better-auth/better-auth/blob/main/packages/core/src/types/init-options.ts)

.agents/skills/better-auth-security-best-practices/SKILL.md

@@ -0,0 +1,432 @@
+---
+name: better-auth-security-best-practices
+description: Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
+---
+
+## Secret Management
+
+### Configuring the Secret
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  secret: process.env.BETTER_AUTH_SECRET, // or via `BETTER_AUTH_SECRET` env
+});
+```
+
+Better Auth looks for secrets in this order:
+1. `options.secret` in your config
+2. `BETTER_AUTH_SECRET` environment variable
+3. `AUTH_SECRET` environment variable
+
+### Secret Requirements
+
+- Rejects default/placeholder secrets in production
+- Warns if shorter than 32 characters or entropy below 120 bits
+- Generate: `openssl rand -base64 32`
+- Never commit secrets to version control
+
+## Rate Limiting
+
+Enabled in production by default. Applies to all endpoints. Plugins can override per-endpoint.
+
+### Default Configuration
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  rateLimit: {
+    enabled: true, // Default: true in production
+    window: 10, // Time window in seconds (default: 10)
+    max: 100, // Max requests per window (default: 100)
+  },
+});
+```
+
+### Storage Options
+
+Options: `"memory"` (resets on restart, avoid on serverless), `"database"` (persistent), `"secondary-storage"` (Redis, default when available).
+
+```ts
+rateLimit: {
+  storage: "database",
+}
+```
+
+### Custom Storage
+
+Implement your own rate limit storage:
+
+```ts
+rateLimit: {
+  customStorage: {
+    get: async (key) => {
+      // Return { count: number, expiresAt: number } or null
+    },
+    set: async (key, data) => {
+      // Store the rate limit data
+    },
+  },
+}
+```
+
+### Per-Endpoint Rules
+
+Sensitive endpoints default to 3 requests per 10 seconds (`/sign-in`, `/sign-up`, `/change-password`, `/change-email`). Override:
+
+```ts
+rateLimit: {
+  customRules: {
+    "/api/auth/sign-in/email": {
+      window: 60, // 1 minute window
+      max: 5, // 5 attempts
+    },
+    "/api/auth/some-safe-endpoint": false, // Disable rate limiting
+  },
+}
+```
+
+## CSRF Protection
+
+Multi-layer protection: origin header validation, Fetch Metadata checks, and first-login protection.
+
+### Configuration
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  advanced: {
+    disableCSRFCheck: false, // Default: false (keep enabled)
+  },
+});
+```
+
+Only disable for testing or with an alternative CSRF mechanism.
+
+## Trusted Origins
+
+### Configuring Trusted Origins
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  baseURL: "https://api.example.com",
+  trustedOrigins: [
+    "https://app.example.com",
+    "https://admin.example.com",
+  ],
+});
+```
+
+The `baseURL` origin is automatically trusted. Also configurable via env: `BETTER_AUTH_TRUSTED_ORIGINS=https://app.example.com,https://admin.example.com`
+
+### Wildcard Patterns
+
+```ts
+trustedOrigins: [
+  "*.example.com", // Matches any subdomain
+  "https://*.example.com", // Protocol-specific wildcard
+  "exp://192.168.*.*:*/*", // Custom schemes (e.g., Expo)
+]
+```
+
+### Dynamic Trusted Origins
+
+Compute trusted origins based on the request:
+
+```ts
+trustedOrigins: async (request) => {
+  // Validate against database, header, etc.
+  const tenant = getTenantFromRequest(request);
+  return [`https://${tenant}.myapp.com`];
+}
+```
+
+Validates `callbackURL`, `redirectTo`, `errorCallbackURL`, `newUserCallbackURL`, and `origin` against trusted origins. Invalid URLs receive 403.
+
+## Session Security
+
+### Session Expiration
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  session: {
+    expiresIn: 60 * 60 * 24 * 7, // 7 days (default)
+    updateAge: 60 * 60 * 24, // Refresh session every 24 hours (default)
+  },
+});
+```
+
+### Session Caching Strategies
+
+Cache session data in cookies to reduce database queries:
+
+```ts
+session: {
+  cookieCache: {
+    enabled: true,
+    maxAge: 60 * 5, // 5 minutes
+    strategy: "compact", // Options: "compact", "jwt", "jwe"
+  },
+}
+```
+
+Strategies: `"compact"` (Base64url + HMAC, smallest), `"jwt"` (HS256, standard), `"jwe"` (encrypted, use when session has sensitive data).
+
+## Cookie Security
+
+Defaults: `secure: true` (HTTPS/production), `sameSite: "lax"`, `httpOnly: true`, `path: "/"`, prefix `__Secure-`.
+
+### Custom Cookie Configuration
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  advanced: {
+    useSecureCookies: true, // Force secure cookies
+    cookiePrefix: "myapp", // Custom prefix (default: "better-auth")
+    defaultCookieAttributes: {
+      sameSite: "strict", // Stricter CSRF protection
+      path: "/auth", // Limit cookie scope
+    },
+  },
+});
+```
+
+### Cross-Subdomain Cookies
+
+```ts
+advanced: {
+  crossSubDomainCookies: {
+    enabled: true,
+    domain: ".example.com", // Note the leading dot
+    additionalCookies: ["session_token", "session_data"],
+  },
+}
+```
+
+Only enable if you need authentication sharing and trust all subdomains.
+
+## OAuth / Social Provider Security
+
+PKCE is automatic for all OAuth flows. State tokens are 32-char random strings expiring after 10 minutes.
+
+### State Parameter Storage
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  account: {
+    storeStateStrategy: "cookie", // Options: "cookie" (default), "database"
+  },
+});
+```
+
+### Encrypting OAuth Tokens
+
+```ts
+account: {
+  encryptOAuthTokens: true, // Uses AES-256-GCM
+}
+```
+
+Enable if storing OAuth tokens for API access on behalf of users. Use `skipStateCookieCheck: true` only for mobile apps that cannot maintain cookies.
+
+## IP-Based Security
+
+### IP Address Configuration
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  advanced: {
+    ipAddress: {
+      ipAddressHeaders: ["x-forwarded-for", "x-real-ip"], // Headers to check
+      disableIpTracking: false, // Keep enabled for rate limiting
+    },
+  },
+});
+```
+
+Set `ipv6Subnet` (128, 64, 48, 32; default 64) to group IPv6 addresses. Enable `trustedProxyHeaders: true` only if behind a trusted reverse proxy.
+
+## Database Hooks for Security Auditing
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  databaseHooks: {
+    session: {
+      create: {
+        after: async ({ data, ctx }) => {
+          await auditLog("session.created", {
+            userId: data.userId,
+            ip: ctx?.request?.headers.get("x-forwarded-for"),
+            userAgent: ctx?.request?.headers.get("user-agent"),
+          });
+        },
+      },
+      delete: {
+        before: async ({ data }) => {
+          await auditLog("session.revoked", { sessionId: data.id });
+        },
+      },
+    },
+    user: {
+      update: {
+        after: async ({ data, oldData }) => {
+          if (oldData?.email !== data.email) {
+            await auditLog("user.email_changed", {
+              userId: data.id,
+              oldEmail: oldData?.email,
+              newEmail: data.email,
+            });
+          }
+        },
+      },
+    },
+    account: {
+      create: {
+        after: async ({ data }) => {
+          await auditLog("account.linked", {
+            userId: data.userId,
+            provider: data.providerId,
+          });
+        },
+      },
+    },
+  },
+});
+```
+
+Return `false` from a `before` hook to prevent an operation.
+
+## Background Tasks
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  advanced: {
+    backgroundTasks: {
+      handler: (promise) => {
+        // Platform-specific handler
+        // Vercel: waitUntil(promise)
+        // Cloudflare: ctx.waitUntil(promise)
+        waitUntil(promise);
+      },
+    },
+  },
+});
+```
+
+Ensures operations like sending emails don't affect response timing.
+
+## Account Enumeration Prevention
+
+Built-in: consistent response messages, dummy operations on invalid requests, background email sending. Return generic error messages ("Invalid credentials") rather than specific ones ("User not found").
+
+## Complete Security Configuration Example
+
+```ts
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+  secret: process.env.BETTER_AUTH_SECRET,
+  baseURL: "https://api.example.com",
+  trustedOrigins: [
+    "https://app.example.com",
+    "https://*.preview.example.com",
+  ],
+  
+  // Rate limiting
+  rateLimit: {
+    enabled: true,
+    storage: "secondary-storage",
+    customRules: {
+      "/api/auth/sign-in/email": { window: 60, max: 5 },
+      "/api/auth/sign-up/email": { window: 60, max: 3 },
+    },
+  },
+  
+  // Session security
+  session: {
+    expiresIn: 60 * 60 * 24 * 7, // 7 days
+    updateAge: 60 * 60 * 24, // 24 hours
+    freshAge: 60 * 60, // 1 hour for sensitive actions
+    cookieCache: {
+      enabled: true,
+      maxAge: 300,
+      strategy: "jwe", // Encrypted session data
+    },
+  },
+  
+  // OAuth security
+  account: {
+    encryptOAuthTokens: true,
+    storeStateStrategy: "cookie",
+  },
+  
+  
+  // Advanced settings
+  advanced: {
+    useSecureCookies: true,
+    cookiePrefix: "myapp",
+    defaultCookieAttributes: {
+      sameSite: "lax",
+    },
+    ipAddress: {
+      ipAddressHeaders: ["x-forwarded-for"],
+      ipv6Subnet: 64,
+    },
+    backgroundTasks: {
+      handler: (promise) => waitUntil(promise),
+    },
+  },
+  
+  // Security auditing
+  databaseHooks: {
+    session: {
+      create: {
+        after: async ({ data, ctx }) => {
+          console.log(`New session for user ${data.userId}`);
+        },
+      },
+    },
+    user: {
+      update: {
+        after: async ({ data, oldData }) => {
+          if (oldData?.email !== data.email) {
+            console.log(`Email changed for user ${data.id}`);
+          }
+        },
+      },
+    },
+  },
+});
+```
+
+## Security Checklist
+
+Before deploying to production:
+
+- [ ] **Secret**: Use a strong, unique secret (32+ characters, high entropy)
+- [ ] **HTTPS**: Ensure `baseURL` uses HTTPS
+- [ ] **Trusted Origins**: Configure all valid origins (frontend, mobile apps)
+- [ ] **Rate Limiting**: Keep enabled with appropriate limits
+- [ ] **CSRF Protection**: Keep enabled (`disableCSRFCheck: false`)
+- [ ] **Secure Cookies**: Enabled automatically with HTTPS
+- [ ] **OAuth Tokens**: Consider `encryptOAuthTokens: true` if storing tokens
+- [ ] **Background Tasks**: Configure for serverless platforms
+- [ ] **Audit Logging**: Implement via `databaseHooks` or `hooks`
+- [ ] **IP Tracking**: Configure headers if behind a proxy

.agents/skills/code-review/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: code-review
+description: "Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\"."
+---
+
+Two-axis review of the diff between `HEAD` and a fixed point the user supplies:
+
+- **Standards**: does the code conform to this repo's documented coding standards?
+- **Spec**: does the code faithfully implement the originating issue / spec?
+
+Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.
+
+The issue tracker should have been provided to you. If `docs/agents/issue-tracker.md` is missing, tell the user to run `/setup-matt-pocock-skills`.
+
+## Process
+
+### 1. Pin the fixed point
+
+Whatever the user said is the fixed point (a commit SHA, branch name, tag, `main`, `HEAD~5`, etc.). If they didn't specify one, ask for it.
+
+Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`.
+
+Before going further, confirm the fixed point resolves (`git rev-parse <fixed-point>`) and the diff is non-empty. A bad ref or empty diff should fail here, not inside two parallel sub-agents.
+
+### 2. Identify the spec source
+
+Look for the originating spec, in this order:
+
+1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.), fetched via the workflow in `docs/agents/issue-tracker.md`.
+2. A path the user passed as an argument.
+3. A spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.
+4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
+
+### 3. Identify the standards sources
+
+Anything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`.
+
+On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below: a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
+
+- **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
+- **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation. Like any standard here, skip anything tooling already enforces.
+
+Each smell reads *what it is* → *how to fix*; match it against the diff:
+
+- **Mysterious Name**: a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
+- **Duplicated Code**: the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
+- **Feature Envy**: a method that reaches into another object's data more than its own. → move the method onto the data it envies.
+- **Data Clumps**: the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
+- **Primitive Obsession**: a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
+- **Repeated Switches**: the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.
+- **Shotgun Surgery**: one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
+- **Divergent Change**: one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
+- **Speculative Generality**: abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
+- **Message Chains**: long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.
+- **Middle Man**: a class or function that mostly just delegates onward. → cut it, call the real target direct.
+- **Refused Bequest**: a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
+
+### 4. Spawn both sub-agents in parallel
+
+**Standards sub-agent prompt** should include:
+
+- The full diff command and commit list.
+- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full (the sub-agent has no other access to it).
+- The brief: "Report, per file/hunk where relevant, (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls: documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
+
+**Spec sub-agent prompt** should include:
+
+- The diff command and commit list.
+- The path or fetched contents of the spec.
+- The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
+
+If the spec is missing, skip the Spec sub-agent and note this in the final report.
+
+### 5. Aggregate
+
+Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings, because the two axes are deliberately separate (see _Why two axes_).
+
+End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes: that's the reranking the separation exists to prevent.
+
+## Why two axes
+
+A change can pass one axis and fail the other:
+
+- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**
+- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**
+
+Reporting them separately stops one axis from masking the other.

.agents/skills/code-review/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review a diff on standards and spec"

.agents/skills/codebase-design/DEEPENING.md

@@ -0,0 +1,37 @@
+# Deepening
+
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md): **module**, **interface**, **seam**, **adapter**.
+
+## Dependency categories
+
+When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
+
+### 1. In-process
+
+Pure computation, in-memory state, no I/O. Always deepenable: merge the modules and test through the new interface directly. No adapter needed.
+
+### 2. Local-substitutable
+
+Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
+
+### 3. Remote but owned (Ports & Adapters)
+
+Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
+
+Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
+
+### 4. True external (Mock)
+
+Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
+
+## Seam discipline
+
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
+- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
+
+## Testing strategy: replace, don't layer
+
+- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist; delete them.
+- Write new tests at the deepened module's interface. The **interface is the test surface**.
+- Tests assert on observable outcomes through the interface, not internal state.
+- Tests should survive internal refactors, since they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.

.agents/skills/codebase-design/DESIGN-IT-TWICE.md

@@ -0,0 +1,44 @@
+# Design It Twice
+
+When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout): your first idea is unlikely to be the best.
+
+Uses the vocabulary in [SKILL.md](SKILL.md): **module**, **interface**, **seam**, **adapter**, **leverage**.
+
+## Process
+
+### 1. Frame the problem space
+
+Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
+
+- The constraints any new interface would need to satisfy
+- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- A rough illustrative code sketch to ground the constraints, not a proposal, just a way to make the constraints concrete
+
+Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
+
+### 2. Spawn sub-agents
+
+Spawn 3+ sub-agents in parallel. Each must produce a **radically different** interface for the deepened module.
+
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+
+- Agent 1: "Minimize the interface: aim for 1–3 entry points max. Maximise leverage per entry point."
+- Agent 2: "Maximise flexibility: support many use cases and extension."
+- Agent 3: "Optimise for the most common caller: make the default case trivial."
+- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
+
+Include both [SKILL.md](SKILL.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+
+Each sub-agent outputs:
+
+1. Interface (types, methods, params, plus invariants, ordering, error modes)
+2. Usage example showing how callers use it
+3. What the implementation hides behind the seam
+4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+5. Trade-offs: where leverage is high, where it's thin
+
+### 3. Present and compare
+
+Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
+
+After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated: the user wants a strong read, not a menu.

.agents/skills/codebase-design/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: codebase-design
+description: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
+---
+
+# Codebase Design
+
+Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
+
+## Glossary
+
+Use these terms exactly: don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+**Module**: anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service.
+
+**Interface**: everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow, they refer only to the type-level surface).
+
+**Implementation**: what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth**: leverage at the interface. The amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(Michael Feathers)_: a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter**: a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage**: what callers get from depth. More capability per unit of interface they learn. One implementation pays back across N call sites and M tests.
+
+**Locality**: what maintainers get from depth. Change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Deep vs shallow
+
+**Deep module** = small interface + lots of implementation:
+
+```
+┌─────────────────────┐
+│   Small Interface   │  ← Few methods, simple params
+├─────────────────────┤
+│                     │
+│  Deep Implementation│  ← Complex logic hidden
+│                     │
+└─────────────────────┘
+```
+
+**Shallow module** = large interface + little implementation (avoid):
+
+```
+┌─────────────────────────────────┐
+│       Large Interface           │  ← Many methods, complex params
+├─────────────────────────────────┤
+│  Thin Implementation            │  ← Just passes through
+└─────────────────────────────────┘
+```
+
+When designing an interface, ask:
+
+- Can I reduce the number of methods?
+- Can I simplify the parameters?
+- Can I hide more complexity inside?
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts; they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Designing for testability
+
+Good interfaces make testing natural:
+
+1. **Accept dependencies, don't create them.**
+
+   ```typescript
+   // Testable
+   function processOrder(order, paymentGateway) {}
+
+   // Hard to test
+   function processOrder(order) {
+     const gateway = new StripeGateway();
+   }
+   ```
+
+2. **Return results, don't produce side effects.**
+
+   ```typescript
+   // Testable
+   function calculateDiscount(cart): Discount {}
+
+   // Hard to test
+   function applyDiscount(cart): void {
+     cart.total -= discount;
+   }
+   ```
+
+3. **Small surface area.** Fewer methods = fewer tests needed. Fewer params = simpler test setup.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow: interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
+
+## Going deeper
+
+- **Deepening a cluster given its dependencies**, see [DEEPENING.md](DEEPENING.md): dependency categories, seam discipline, and replace-don't-layer testing.
+- **Exploring alternative interfaces**, see [DESIGN-IT-TWICE.md](DESIGN-IT-TWICE.md): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement.

.agents/skills/codebase-design/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Codebase Design"
+  short_description: "Vocabulary for deep-module design"

.agents/skills/create-auth/SKILL.md

@@ -0,0 +1,390 @@
+---
+name: create-auth
+description: Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
+---
+
+# Create Auth Skill
+
+Guide for adding authentication to TypeScript/JavaScript applications using Better Auth.
+
+**For code examples and syntax, see [better-auth.com/docs](https://better-auth.com/docs).**
+
+---
+
+## Phase 1: Planning (REQUIRED before implementation)
+
+Before writing any code, gather requirements by scanning the project and asking the user structured questions. This ensures the implementation matches their needs.
+
+### Step 1: Scan the project
+
+Analyze the codebase to auto-detect:
+- **Framework** — Look for `next.config`, `svelte.config`, `nuxt.config`, `astro.config`, `vite.config`, or Express/Hono entry files.
+- **Database/ORM** — Look for `prisma/schema.prisma`, `drizzle.config.ts`, `package.json` deps (`pg`, `postgres`, `@neondatabase/serverless`, `mysql2`, `better-sqlite3`, `mongoose`, `mongodb`). If `drizzle.config.ts` exists, read its `dialect` field to determine the DB type (e.g., `"postgresql"` → Drizzle + Postgres). Also check which Drizzle driver is installed (`drizzle-orm/node-postgres` → `pg`, `drizzle-orm/postgres-js` → `postgres`, `drizzle-orm/neon-http` → Neon).
+- **Existing auth** — Look for existing auth libraries (`next-auth`, `lucia`, `clerk`, `supabase/auth`, `firebase/auth`) in `package.json` or imports.
+- **Package manager** — Check for `pnpm-lock.yaml`, `yarn.lock`, `bun.lockb`, or `package-lock.json`.
+
+Use what you find to pre-fill defaults and skip questions you can already answer.
+
+### Step 2: Ask planning questions
+
+Use the `AskQuestion` tool to ask the user **all applicable questions in a single call**. Skip any question you already have a confident answer for from the scan. Group them under a title like "Auth Setup Planning".
+
+**Questions to ask:**
+
+1. **Project type** (skip if detected)
+   - Prompt: "What type of project is this?"
+   - Options: New project from scratch | Adding auth to existing project | Migrating from another auth library
+
+2. **Framework** (skip if detected)
+   - Prompt: "Which framework are you using?"
+   - Options: Next.js (App Router) | Next.js (Pages Router) | SvelteKit | Nuxt | Astro | Express | Hono | SolidStart | Other
+
+3. **Database & ORM** (skip if detected)
+   - Prompt: "Which database setup will you use?"
+   - Options: PostgreSQL (Prisma) | PostgreSQL (Drizzle) | PostgreSQL (pg driver) | MySQL (Prisma) | MySQL (Drizzle) | MySQL (mysql2 driver) | SQLite (Prisma) | SQLite (Drizzle) | SQLite (better-sqlite3 driver) | MongoDB (Mongoose) | MongoDB (native driver)
+
+4. **Authentication methods** (always ask, allow multiple)
+   - Prompt: "Which sign-in methods do you need?"
+   - Options: Email & password | Social OAuth (Google, GitHub, etc.) | Magic link (passwordless email) | Passkey (WebAuthn) | Phone number
+   - `allow_multiple: true`
+
+5. **Social providers** (only if they selected Social OAuth above — ask in a follow-up call)
+   - Prompt: "Which social providers do you need?"
+   - Options: Google | GitHub | Apple | Microsoft | Discord | Twitter/X
+   - `allow_multiple: true`
+
+6. **Email verification** (only if Email & password was selected above — ask in a follow-up call)
+   - Prompt: "Do you want to require email verification?"
+   - Options: Yes | No
+
+7. **Email provider** (only if email verification is Yes, or if Password reset is selected in features — ask in a follow-up call)
+   - Prompt: "How do you want to send emails?"
+   - Options: Resend | Mock it for now (console.log)
+
+8. **Features & plugins** (always ask, allow multiple)
+   - Prompt: "Which additional features do you need?"
+   - Options: Two-factor authentication (2FA) | Organizations / teams | Admin dashboard | API bearer tokens | Password reset | None of these
+   - `allow_multiple: true`
+
+9. **Auth pages** (always ask, allow multiple — pre-select based on earlier answers)
+   - Prompt: "Which auth pages do you need?"
+   - Options vary based on previous answers:
+     - Always available: Sign in | Sign up
+     - If Email & password selected: Forgot password | Reset password
+     - If email verification enabled: Email verification
+   - `allow_multiple: true`
+
+10. **Auth UI style** (always ask)
+   - Prompt: "What style do you want for the auth pages? Pick one or describe your own."
+   - Options: Minimal & clean | Centered card with background | Split layout (form + hero image) | Floating / glassmorphism | Other (I'll describe)
+
+### Step 3: Summarize the plan
+
+After collecting answers, present a concise implementation plan as a markdown checklist. Example:
+
+```
+## Auth Implementation Plan
+
+- **Framework:** Next.js (App Router)
+- **Database:** PostgreSQL via Prisma
+- **Auth methods:** Email/password, Google OAuth, GitHub OAuth
+- **Plugins:** 2FA, Organizations, Email verification
+- **UI:** Custom forms
+
+### Steps
+1. Install `better-auth` and `@better-auth/cli`
+2. Create `lib/auth.ts` with server config
+3. Create `lib/auth-client.ts` with React client
+4. Set up route handler at `app/api/auth/[...all]/route.ts`
+5. Configure Prisma adapter and generate schema
+6. Add Google & GitHub OAuth providers
+7. Enable `twoFactor` and `organization` plugins
+8. Set up email verification handler
+9. Run migrations
+10. Create sign-in / sign-up pages
+```
+
+Ask the user to confirm the plan before proceeding to Phase 2.
+
+---
+
+## Phase 2: Implementation
+
+Only proceed here after the user confirms the plan from Phase 1.
+
+Follow the decision tree below, guided by the answers collected above.
+
+```
+Is this a new/empty project?
+├─ YES → New project setup
+│   1. Install better-auth (+ scoped packages per plan)
+│   2. Create auth.ts with all planned config
+│   3. Create auth-client.ts with framework client
+│   4. Set up route handler
+│   5. Set up environment variables
+│   6. Run CLI migrate/generate
+│   7. Add plugins from plan
+│   8. Create auth UI pages
+│
+├─ MIGRATING → Migration from existing auth
+│   1. Audit current auth for gaps
+│   2. Plan incremental migration
+│   3. Install better-auth alongside existing auth
+│   4. Migrate routes, then session logic, then UI
+│   5. Remove old auth library
+│   6. See migration guides in docs
+│
+└─ ADDING → Add auth to existing project
+    1. Analyze project structure
+    2. Install better-auth
+    3. Create auth config matching plan
+    4. Add route handler
+    5. Run schema migrations
+    6. Integrate into existing pages
+    7. Add planned plugins and features
+```
+
+At the end of implementation, guide users thoroughly on remaining next steps (e.g., setting up OAuth app credentials, deploying env vars, testing flows).
+
+---
+
+## Installation
+
+**Core:** `npm install better-auth`
+
+**Scoped packages (as needed):**
+| Package | Use case |
+|---------|----------|
+| `@better-auth/passkey` | WebAuthn/Passkey auth |
+| `@better-auth/sso` | SAML/OIDC enterprise SSO |
+| `@better-auth/stripe` | Stripe payments |
+| `@better-auth/scim` | SCIM user provisioning |
+| `@better-auth/expo` | React Native/Expo |
+
+---
+
+## Environment Variables
+
+```env
+BETTER_AUTH_SECRET=<32+ chars, generate with: openssl rand -base64 32>
+BETTER_AUTH_URL=http://localhost:3000
+DATABASE_URL=<your database connection string>
+```
+
+Add OAuth secrets as needed: `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `GOOGLE_CLIENT_ID`, etc.
+
+---
+
+## Server Config (auth.ts)
+
+**Location:** `lib/auth.ts` or `src/lib/auth.ts`
+
+**Minimal config needs:**
+- `database` - Connection or adapter
+- `emailAndPassword: { enabled: true }` - For email/password auth
+
+**Standard config adds:**
+- `socialProviders` - OAuth providers (google, github, etc.)
+- `emailVerification.sendVerificationEmail` - Email verification handler
+- `emailAndPassword.sendResetPassword` - Password reset handler
+
+**Full config adds:**
+- `plugins` - Array of feature plugins
+- `session` - Expiry, cookie cache settings
+- `account.accountLinking` - Multi-provider linking
+- `rateLimit` - Rate limiting config
+
+**Export types:** `export type Session = typeof auth.$Infer.Session`
+
+---
+
+## Client Config (auth-client.ts)
+
+**Import by framework:**
+| Framework | Import |
+|-----------|--------|
+| React/Next.js | `better-auth/react` |
+| Vue | `better-auth/vue` |
+| Svelte | `better-auth/svelte` |
+| Solid | `better-auth/solid` |
+| Vanilla JS | `better-auth/client` |
+
+**Client plugins** go in `createAuthClient({ plugins: [...] })`.
+
+**Common exports:** `signIn`, `signUp`, `signOut`, `useSession`, `getSession`
+
+---
+
+## Route Handler Setup
+
+| Framework | File | Handler |
+|-----------|------|---------|
+| Next.js App Router | `app/api/auth/[...all]/route.ts` | `toNextJsHandler(auth)` → export `{ GET, POST }` |
+| Next.js Pages | `pages/api/auth/[...all].ts` | `toNextJsHandler(auth)` → default export |
+| Express | Any file | `app.all("/api/auth/*", toNodeHandler(auth))` |
+| SvelteKit | `src/hooks.server.ts` | `svelteKitHandler(auth)` |
+| SolidStart | Route file | `solidStartHandler(auth)` |
+| Hono | Route file | `auth.handler(c.req.raw)` |
+
+**Next.js Server Components:** Add `nextCookies()` plugin to auth config.
+
+---
+
+## Database Migrations
+
+| Adapter | Command |
+|---------|---------|
+| Built-in Kysely | `npx @better-auth/cli@latest migrate` (applies directly) |
+| Prisma | `npx @better-auth/cli@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev` |
+| Drizzle (dev) | `npx @better-auth/cli@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` |
+| Drizzle (prod) | `npx @better-auth/cli@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit generate` then `npx drizzle-kit migrate` |
+
+> **Note:** `drizzle-kit push` skips migration files and is only safe for development. Use `drizzle-kit generate` + `drizzle-kit migrate` in production.
+
+**Re-run after adding plugins.**
+
+---
+
+## Database Adapters
+
+| Database | Setup |
+|----------|-------|
+| SQLite | Pass `better-sqlite3` or `bun:sqlite` instance directly |
+| PostgreSQL | Pass `pg.Pool` instance directly |
+| MySQL | Pass `mysql2` pool directly |
+| Prisma | `prismaAdapter(prisma, { provider: "postgresql" })` from `better-auth/adapters/prisma` |
+| Drizzle (pg) | `drizzleAdapter(db, { provider: "pg" })` from `better-auth/adapters/drizzle` |
+| Drizzle (mysql) | `drizzleAdapter(db, { provider: "mysql" })` from `better-auth/adapters/drizzle` |
+| Drizzle (sqlite) | `drizzleAdapter(db, { provider: "sqlite" })` from `better-auth/adapters/drizzle` |
+| MongoDB | `mongodbAdapter(db)` from `better-auth/adapters/mongodb` |
+
+### Drizzle + PostgreSQL Setup
+
+Before using `drizzleAdapter`, initialize the `db` instance:
+
+```ts
+// Option 1: node-postgres (pg)
+import { drizzle } from "drizzle-orm/node-postgres"
+import { Pool } from "pg"
+import * as schema from "./auth-schema"
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL })
+export const db = drizzle(pool, { schema })
+```
+
+```ts
+// Option 2: postgres.js
+import { drizzle } from "drizzle-orm/postgres-js"
+import postgres from "postgres"
+import * as schema from "./auth-schema"
+
+const client = postgres(process.env.DATABASE_URL!)
+export const db = drizzle(client, { schema })
+```
+
+```ts
+// Option 3: Neon serverless
+import { drizzle } from "drizzle-orm/neon-http"
+import { neon } from "@neondatabase/serverless"
+import * as schema from "./auth-schema"
+
+const sql = neon(process.env.DATABASE_URL!)
+export const db = drizzle(sql, { schema })
+```
+
+Then pass to Better Auth:
+
+```ts
+import { betterAuth } from "better-auth"
+import { drizzleAdapter } from "better-auth/adapters/drizzle"
+import { db } from "./db"
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: "pg" }),
+  // ...
+})
+```
+
+### Drizzle Config (`drizzle.config.ts`)
+
+Required for `drizzle-kit` commands to find your schema:
+
+```ts
+import { defineConfig } from "drizzle-kit"
+
+export default defineConfig({
+  schema: "./src/db/auth-schema.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: process.env.DATABASE_URL!,
+  },
+})
+```
+
+---
+
+## Common Plugins
+
+| Plugin | Server Import | Client Import | Purpose |
+|--------|---------------|---------------|---------|
+| `twoFactor` | `better-auth/plugins` | `twoFactorClient` | 2FA with TOTP/OTP |
+| `organization` | `better-auth/plugins` | `organizationClient` | Teams/orgs |
+| `admin` | `better-auth/plugins` | `adminClient` | User management |
+| `bearer` | `better-auth/plugins` | - | API token auth |
+| `openAPI` | `better-auth/plugins` | - | API docs |
+| `passkey` | `@better-auth/passkey` | `passkeyClient` | WebAuthn |
+| `sso` | `@better-auth/sso` | - | Enterprise SSO |
+
+**Plugin pattern:** Server plugin + client plugin + run migrations.
+
+---
+
+## Auth UI Implementation
+
+**Sign in flow:**
+1. `signIn.email({ email, password })` or `signIn.social({ provider, callbackURL })`
+2. Handle `error` in response
+3. Redirect on success
+
+**Session check (client):** `useSession()` hook returns `{ data: session, isPending }`
+
+**Session check (server):** `auth.api.getSession({ headers: await headers() })`
+
+**Protected routes:** Check session, redirect to `/sign-in` if null.
+
+---
+
+## Security Checklist
+
+- [ ] `BETTER_AUTH_SECRET` set (32+ chars)
+- [ ] `advanced.useSecureCookies: true` in production
+- [ ] `trustedOrigins` configured
+- [ ] Rate limits enabled
+- [ ] Email verification enabled
+- [ ] Password reset implemented
+- [ ] 2FA for sensitive apps
+- [ ] CSRF protection NOT disabled
+- [ ] `account.accountLinking` reviewed
+
+---
+
+## Troubleshooting
+
+| Issue | Fix |
+|-------|-----|
+| "Secret not set" | Add `BETTER_AUTH_SECRET` env var |
+| "Invalid Origin" | Add domain to `trustedOrigins` |
+| Cookies not setting | Check `baseURL` matches domain; enable secure cookies in prod |
+| OAuth callback errors | Verify redirect URIs in provider dashboard |
+| Type errors after adding plugin | Re-run CLI generate/migrate |
+
+---
+
+## Resources
+
+- [Docs](https://better-auth.com/docs)
+- [Examples](https://github.com/better-auth/examples)
+- [Plugins](https://better-auth.com/docs/concepts/plugins)
+- [CLI](https://better-auth.com/docs/concepts/cli)
+- [Migration Guides](https://better-auth.com/docs/guides)

.agents/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: diagnosing-bugs
+description: Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
+---
+
+# Diagnosing Bugs
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Redact
+
+This skill has you show commands, outputs and captured artifacts. **Redact every secret first**: write `<REDACTED>` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal.
+
+If the redacted output is not enough to diagnose the bug, say so and ask the user.
+
+## Phase 1: Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug (one that goes red on _this_ bug), you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one, in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) that drives the UI and asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Tighten the loop
+
+Treat the loop as a product. Once you have _a_ loop, **tighten** it:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight, a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not, so keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a redacted captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+### Completion criterion: a tight loop that goes red
+
+Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** (a script path, a test invocation, a curl) that you have **already run at least once** (show the invocation and its output, redacted), and that is:
+
+- [ ] **Red-capable**: it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring"; it must be able to _catch this specific bug_.
+- [ ] **Deterministic**: same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).
+- [ ] **Fast**: seconds, not minutes.
+- [ ] **Agent-runnable**: you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
+
+If you catch yourself reading code to build a theory before this command exists, **stop: jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2.
+
+## Phase 2: Reproduce + minimise
+
+Run the loop. Watch it go red as the bug appears.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described, not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+### Minimise
+
+Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut, and keep only what's load-bearing for the failure.
+
+Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5.
+
+Done when **every remaining element is load-bearing**: removing any one of them makes the loop go green.
+
+Do not proceed until you have reproduced **and** minimised.
+
+## Phase 3: Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe: discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it; proceed with your ranking if the user is AFK.
+
+## Phase 4: Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5: Fix + regression test
+
+Write the regression test **before the fix**, but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6: Cleanup
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message, so the next debugger learns

.agents/skills/diagnosing-bugs/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Diagnosing Bugs"
+  short_description: "Diagnose hard bugs and regressions"

.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+#
+# `capture` prints its value back to the terminal, where the agent reads it,
+# so capture observations, and leave signing in to the user as a `step`.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"

.agents/skills/domain-modeling/ADR-FORMAT.md

@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily: only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why*, not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`): useful when decisions are revisited
+- **Considered Options**: only when the rejected alternatives are worth remembering
+- **Consequences**: only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse**: the cost of changing your mind later is meaningful
+2. **Surprising without context**: a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off**: there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it: you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library: just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it; otherwise someone will suggest GraphQL again in six months.

.agents/skills/domain-modeling/CONTEXT-FORMAT.md

@@ -0,0 +1,60 @@
+# CONTEXT.md Format
+
+## Structure
+
+```md
+# {Context Name}
+
+{One or two sentence description of what this context is and why it exists.}
+
+## Language
+
+**Order**:
+{A one or two sentence description of the term}
+_Avoid_: Purchase, transaction
+
+**Invoice**:
+A request for payment sent to a customer after delivery.
+_Avoid_: Bill, payment request
+
+**Customer**:
+A person or organization that places orders.
+_Avoid_: Client, buyer, account
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others under `_Avoid_`.
+- **Keep definitions tight.** One or two sentences max. Define what it IS, not what it does.
+- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
+- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
+
+## Single vs multi-context repos
+
+**Single context (most repos):** One `CONTEXT.md` at the repo root.
+
+**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
+
+```md
+# Context Map
+
+## Contexts
+
+- [Ordering](./src/ordering/CONTEXT.md): receives and tracks customer orders
+- [Billing](./src/billing/CONTEXT.md): generates invoices and processes payments
+- [Fulfillment](./src/fulfillment/CONTEXT.md): manages warehouse picking and shipping
+
+## Relationships
+
+- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
+- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
+- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
+```
+
+The skill infers which structure applies:
+
+- If `CONTEXT-MAP.md` exists, read it to find contexts
+- If only a root `CONTEXT.md` exists, single context
+- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
+
+When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.

.agents/skills/domain-modeling/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: domain-modeling
+description: Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a CONTEXT.md, or recording or editing an ADR.
+---
+
+# Domain Modeling
+
+Actively build and sharpen the project's domain model as you design. This is the *active* discipline: challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `CONTEXT.md` for vocabulary is not this skill: that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.)
+
+## File structure
+
+Most repos have a single context:
+
+```
+/
+├── CONTEXT.md
+├── docs/
+│   └── adr/
+│       ├── 0001-event-sourced-orders.md
+│       └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/
+│   └── adr/                          ← system-wide decisions
+├── src/
+│   ├── ordering/
+│   │   ├── CONTEXT.md
+│   │   └── docs/adr/                 ← context-specific decisions
+│   └── billing/
+│       ├── CONTEXT.md
+│       └── docs/adr/
+```
+
+Create files lazily: only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+
+## During the session
+
+### Challenge against the glossary
+
+When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y. Which is it?"
+
+### Sharpen fuzzy language
+
+When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account': do you mean the Customer or the User? Those are different things."
+
+### Discuss concrete scenarios
+
+When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
+
+### Cross-reference with code
+
+When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible. Which is right?"
+
+### Update CONTEXT.md inline
+
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up: capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+
+`CONTEXT.md` should be totally devoid of implementation details. Do not treat `CONTEXT.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else.
+
+### Offer ADRs sparingly
+
+Only offer to create an ADR when all three are true:
+
+1. **Hard to reverse**: the cost of changing your mind later is meaningful
+2. **Surprising without context**: a future reader will wonder "why did they do it this way?"
+3. **The result of a real trade-off**: there were genuine alternatives and you picked one for specific reasons
+
+If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).

.agents/skills/domain-modeling/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Domain Modeling"
+  short_description: "Build and sharpen a domain model"

.agents/skills/email-and-password-best-practices/SKILL.md

@@ -0,0 +1,212 @@
+---
+name: email-and-password-best-practices
+description: Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.
+---
+
+## Quick Start
+
+1. Enable email/password: `emailAndPassword: { enabled: true }`
+2. Configure `emailVerification.sendVerificationEmail`
+3. Add `sendResetPassword` for password reset flows
+4. Run `npx @better-auth/cli@latest migrate`
+5. Verify: attempt sign-up and confirm verification email triggers
+
+---
+
+## Email Verification Setup
+
+Configure `emailVerification.sendVerificationEmail` to verify user email addresses.
+
+```ts
+import { betterAuth } from "better-auth";
+import { sendEmail } from "./email"; // your email sending function
+
+export const auth = betterAuth({
+  emailVerification: {
+    sendVerificationEmail: async ({ user, url, token }, request) => {
+      await sendEmail({
+        to: user.email,
+        subject: "Verify your email address",
+        text: `Click the link to verify your email: ${url}`,
+      });
+    },
+  },
+});
+```
+
+**Note**: The `url` parameter contains the full verification link. The `token` is available if you need to build a custom verification URL.
+
+### Requiring Email Verification
+
+For stricter security, enable `emailAndPassword.requireEmailVerification` to block sign-in until the user verifies their email. When enabled, unverified users will receive a new verification email on each sign-in attempt.
+
+```ts
+export const auth = betterAuth({
+  emailAndPassword: {
+    requireEmailVerification: true,
+  },
+});
+```
+
+**Note**: This requires `sendVerificationEmail` to be configured and only applies to email/password sign-ins.
+
+## Client Side Validation
+
+Implement client-side validation for immediate user feedback and reduced server load.
+
+## Callback URLs
+
+Always use absolute URLs (including the origin) for callback URLs in sign-up and sign-in requests. This prevents Better Auth from needing to infer the origin, which can cause issues when your backend and frontend are on different domains.
+
+```ts
+const { data, error } = await authClient.signUp.email({
+  callbackURL: "https://example.com/callback", // absolute URL with origin
+});
+```
+
+## Password Reset Flows
+
+Provide `sendResetPassword` in the email and password config to enable password resets.
+
+```ts
+import { betterAuth } from "better-auth";
+import { sendEmail } from "./email"; // your email sending function
+
+export const auth = betterAuth({
+  emailAndPassword: {
+    enabled: true,
+    // Custom email sending function to send reset-password email
+    sendResetPassword: async ({ user, url, token }, request) => {
+      void sendEmail({
+        to: user.email,
+        subject: "Reset your password",
+        text: `Click the link to reset your password: ${url}`,
+      });
+    },
+    // Optional event hook
+    onPasswordReset: async ({ user }, request) => {
+      // your logic here
+      console.log(`Password for user ${user.email} has been reset.`);
+    },
+  },
+});
+```
+
+### Security Considerations
+
+Built-in protections: background email sending (timing attack prevention), dummy operations on invalid requests, constant response messages regardless of user existence.
+
+On serverless platforms, configure a background task handler:
+
+```ts
+export const auth = betterAuth({
+  advanced: {
+    backgroundTasks: {
+      handler: (promise) => {
+        // Use platform-specific methods like waitUntil
+        waitUntil(promise);
+      },
+    },
+  },
+});
+```
+
+#### Token Security
+
+Tokens expire after 1 hour by default. Configure with `resetPasswordTokenExpiresIn` (in seconds):
+
+```ts
+export const auth = betterAuth({
+  emailAndPassword: {
+    enabled: true,
+    resetPasswordTokenExpiresIn: 60 * 30, // 30 minutes
+  },
+});
+```
+
+Tokens are single-use — deleted immediately after successful reset.
+
+#### Session Revocation
+
+Enable `revokeSessionsOnPasswordReset` to invalidate all existing sessions on password reset:
+
+```ts
+export const auth = betterAuth({
+  emailAndPassword: {
+    enabled: true,
+    revokeSessionsOnPasswordReset: true,
+  },
+});
+```
+
+#### Password Requirements
+
+Password length limits (configurable):
+
+```ts
+export const auth = betterAuth({
+  emailAndPassword: {
+    enabled: true,
+    minPasswordLength: 12,
+    maxPasswordLength: 256,
+  },
+});
+```
+
+### Sending the Password Reset
+
+Call `requestPasswordReset` to send the reset link. Triggers the `sendResetPassword` function from your config.
+
+```ts
+const data = await auth.api.requestPasswordReset({
+  body: {
+    email: "john.doe@example.com", // required
+    redirectTo: "https://example.com/reset-password",
+  },
+});
+```
+
+Or authClient:
+
+```ts
+const { data, error } = await authClient.requestPasswordReset({
+  email: "john.doe@example.com", // required
+  redirectTo: "https://example.com/reset-password",
+});
+```
+
+**Note**: While the `email` is required, we also recommend configuring the `redirectTo` for a smoother user experience.
+
+## Password Hashing
+
+Default: `scrypt` (Node.js native, no external dependencies).
+
+### Custom Hashing Algorithm
+
+To use Argon2id or another algorithm, provide custom `hash` and `verify` functions:
+
+```ts
+import { betterAuth } from "better-auth";
+import { hash, verify, type Options } from "@node-rs/argon2";
+
+const argon2Options: Options = {
+  memoryCost: 65536, // 64 MiB
+  timeCost: 3, // 3 iterations
+  parallelism: 4, // 4 parallel lanes
+  outputLen: 32, // 32 byte output
+  algorithm: 2, // Argon2id variant
+};
+
+export const auth = betterAuth({
+  emailAndPassword: {
+    enabled: true,
+    password: {
+      hash: (password) => hash(password, argon2Options),
+      verify: ({ password, hash: storedHash }) =>
+        verify(storedHash, password, argon2Options),
+    },
+  },
+});
+```
+
+**Note**: If you switch hashing algorithms on an existing system, users with passwords hashed using the old algorithm won't be able to sign in. Plan a migration strategy if needed.

.agents/skills/grill-me/SKILL.md

@@ -0,0 +1,7 @@
+---
+name: grill-me
+description: A relentless interview to sharpen a plan or design.
+disable-model-invocation: true
+---
+
+Call the Skill tool with "grilling".

.agents/skills/grill-me/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: "Grill Me"
+  short_description: "Sharpen a plan through interview"
+policy:
+  allow_implicit_invocation: false

.agents/skills/grill-with-docs/SKILL.md

@@ -0,0 +1,7 @@
+---
+name: grill-with-docs
+description: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
+disable-model-invocation: true
+---
+
+Call the Skill tool twice, for "grilling" and "domain-modeling".

.agents/skills/grill-with-docs/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: "Grill with Docs"
+  short_description: "Grill a design and write its docs"
+policy:
+  allow_implicit_invocation: false

.agents/skills/handoff/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+disable-model-invocation: true
+---
+
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
+
+Include a "suggested skills" section in the document, naming which skills the next agent should call the Skill tool for.
+
+Do not duplicate content already captured in other artifacts (specs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.

.agents/skills/handoff/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: "Handoff"
+  short_description: "Compact a conversation into a handoff"
+policy:
+  allow_implicit_invocation: false

.agents/skills/improve-codebase-architecture/HTML-REPORT.md

@@ -0,0 +1,123 @@
+# HTML Report Format
+
+The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two: don't lean on Mermaid for everything, it'll start to look generic.
+
+## Scaffold
+
+```html
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Architecture review for {{repo name}}</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script type="module">
+      import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";
+      mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });
+    </script>
+    <style>
+      /* small custom layer for things Tailwind doesn't cover cleanly:
+         dashed seam lines, hand-drawn-feeling arrow heads, etc. */
+      .seam { stroke-dasharray: 4 4; }
+      .leak { stroke: #dc2626; }
+      .deep { background: linear-gradient(135deg, #0f172a, #1e293b); }
+    </style>
+  </head>
+  <body class="bg-stone-50 text-slate-900 font-sans">
+    <main class="max-w-5xl mx-auto px-6 py-12 space-y-12">
+      <header>...</header>
+      <section id="candidates" class="space-y-10">...</section>
+      <section id="top-recommendation">...</section>
+    </main>
+  </body>
+</html>
+```
+
+## Header
+
+Repo name, date, and a compact legend: solid box = module, dashed line = seam, red arrow = leakage, thick dark box = deep module. No introduction paragraph. Straight into the candidates.
+
+## Candidate card
+
+The diagrams carry the weight. Prose is sparse, plain, and uses the glossary terms (from the `/codebase-design` skill) without ceremony.
+
+Each candidate is one `<article>`:
+
+- **Title**: short, names the deepening (e.g. "Collapse the Order intake pipeline").
+- **Badge row**: recommendation strength (`Strong` = emerald, `Worth exploring` = amber, `Speculative` = slate), plus a tag for the dependency category (`in-process`, `local-substitutable`, `ports & adapters`, `mock`).
+- **Files**: monospaced list, `font-mono text-sm`.
+- **Before / After diagram**: the centrepiece. Two columns, side by side. See patterns below.
+- **Problem**: one sentence. What hurts.
+- **Solution**: one sentence. What changes.
+- **Wins**: bullets, ≤6 words each. e.g. "Tests hit one interface", "Pricing logic stops leaking", "Delete 4 shallow wrappers".
+- **ADR callout** (if applicable): one line in an amber-tinted box.
+
+No paragraphs of explanation. If the diagram needs a paragraph to be understood, redraw the diagram.
+
+## Diagram patterns
+
+Pick the pattern that fits the candidate. Mix them. Don't make every diagram look the same. Variety is part of the point.
+
+### Mermaid graph (the workhorse for dependencies / call flow)
+
+Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1."
+
+```html
+<div class="rounded-lg border border-slate-200 bg-white p-4">
+  <pre class="mermaid">
+    flowchart LR
+      A[OrderHandler] --> B[OrderValidator]
+      B --> C[OrderRepo]
+      C -.leak.-> D[PricingClient]
+      classDef leak stroke:#dc2626,stroke-width:2px;
+      class C,D leak
+  </pre>
+</div>
+```
+
+### Hand-built boxes-and-arrows (when Mermaid's layout fights you)
+
+Modules as `<div>`s with borders and labels. Arrows as inline SVG `<line>` or `<path>` elements positioned absolutely over a relative container. Reach for this when you want the "after" diagram to feel like one thick-bordered deep module with greyed-out internals, since Mermaid won't render that with the right weight.
+
+### Cross-section (good for layered shallowness)
+
+Stack horizontal bands (`h-12 border-l-4`) to show layers a call passes through. Before: 6 thin layers each doing nothing. After: 1 thick band labelled with the consolidated responsibility.
+
+### Mass diagram (good for "interface as wide as implementation")
+
+Two rectangles per module: one for interface surface area, one for implementation. Before: interface rectangle is nearly as tall as the implementation rectangle (shallow). After: interface rectangle is short, implementation rectangle is tall (deep).
+
+### Call-graph collapse
+
+Before: a tree of function calls rendered as nested boxes. After: the same tree collapsed into one box, with the now-internal calls shown faded inside it.
+
+## Style guidance
+
+- Lean editorial, not corporate-dashboard. Generous whitespace. Serif optional for headings (`font-serif` works well with stone/slate).
+- Colour sparingly: one accent (emerald or indigo) plus red for leakage and amber for warnings.
+- Keep diagrams ~320px tall so before/after sits comfortably side by side without scrolling.
+- Use `text-xs uppercase tracking-wider` for module labels inside diagrams, so they read as schematic, not as UI.
+- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static: no app code, no interactivity beyond Mermaid's own rendering.
+
+## Top recommendation section
+
+One larger card. Candidate name, one sentence on why, anchor link to its card. That's it.
+
+## Tone
+
+Plain English, concise, but the architectural nouns and verbs come straight from the `/codebase-design` skill. Concision is not an excuse to drift.
+
+**Use exactly:** module, interface, implementation, depth, deep, shallow, seam, adapter, leverage, locality.
+
+**Never substitute:** component, service, unit (for module) · API, signature (for interface) · boundary (for seam) · layer, wrapper (for module, when you mean module).
+
+**Phrasings that fit the style:**
+
+- "Order intake module is shallow: interface nearly matches the implementation."
+- "Pricing leaks across the seam."
+- "Deepen: one interface, one place to test."
+- "Two adapters justify the seam: HTTP in prod, in-memory in tests."
+
+**Wins bullets** name the gain in glossary terms: *"locality: bugs concentrate in one module"*, *"leverage: one interface, N call sites"*, *"interface shrinks; implementation absorbs the wrappers"*. Don't write *"easier to maintain"* or *"cleaner code"*, because those terms aren't in the glossary and don't earn their place.
+
+No hedging, no throat-clearing, no "it's worth noting that…". If a sentence could be a bullet, make it a bullet. If a bullet could be cut, cut it. If a term isn't in the `/codebase-design` glossary, reach for one that is before inventing a new one.

.agents/skills/improve-codebase-architecture/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: improve-codebase-architecture
+description: Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
+disable-model-invocation: true
+---
+
+# Improve Codebase Architecture
+
+Surface architectural friction and propose **deepening opportunities**: refactors that turn shallow modules into deep ones. The aim is testability and AI-navigability.
+
+This command is _informed_ by the project's domain model and built on a shared design vocabulary:
+
+- Call the Skill tool with "codebase-design" for the architecture vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**, **locality**) and its principles (the deletion test, "the interface is the test surface", "one adapter = hypothetical seam, two = real"). Use these terms exactly in every suggestion, and don't drift into "component," "service," "API," or "boundary."
+- The domain language in `CONTEXT.md` gives names to good seams; ADRs in `docs/adr/` record decisions this command should not re-litigate.
+
+## Process
+
+### 1. Explore
+
+**Scope before you scan: YAGNI.** Deepening a module pays off by making future changes to it easier, so put extra weight on the parts of the codebase that have recently changed. Decide *where* to look before you look:
+
+- If the user named a direction (a module, a subsystem, a pain point), take it, and skip the inference below.
+- Otherwise, walk back a good stretch of the commit history (`git log --oneline`) to find the codebase's hot spots, the files and areas that keep coming up, and let those paths pull your attention first. If the changes are scattered with no clear hot spot, widen the net.
+
+Read the project's domain glossary (`CONTEXT.md`) and any ADRs in the area you're touching first.
+
+Then spawn a sub-agent to walk the codebase. Don't follow rigid heuristics; explore organically and note where you experience friction:
+
+- Where does understanding one concept require bouncing between many small modules?
+- Where are modules **shallow**, with an interface nearly as complex as the implementation?
+- Where have pure functions been extracted just for testability, but the real bugs hide in how they're called (no **locality**)?
+- Where do tightly-coupled modules leak across their seams?
+- Which parts of the codebase are untested, or hard to test through their current interface?
+
+Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
+
+### 2. Present candidates as an HTML report
+
+Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user (`xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows) and tell them the absolute path.
+
+The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals: use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.
+
+For each candidate, render a card with:
+
+- **Files**: which files/modules are involved
+- **Problem**: why the current architecture is causing friction
+- **Solution**: plain English description of what would change
+- **Benefits**: explained in terms of locality and leverage, and how tests would improve
+- **Before / After diagram**: side-by-side, custom-drawn, illustrating the shallowness and the deepening
+- **Recommendation strength**: one of `Strong`, `Worth exploring`, `Speculative`, rendered as a badge
+
+End the report with a **Top recommendation** section: which candidate you'd tackle first and why.
+
+**Use CONTEXT.md vocabulary for the domain, and the `/codebase-design` vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module," not "the FooBarHandler," and not "the Order service."
+
+**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly in the card (e.g. a warning callout: _"contradicts ADR-0007, but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+
+See [HTML-REPORT.md](HTML-REPORT.md) for the full HTML scaffold, diagram patterns, and styling guidance.
+
+Do NOT propose interfaces yet. After the file is written, ask the user: "Which of these would you like to explore?"
+
+### 3. Grilling loop
+
+Once the user picks a candidate, call the Skill tool with "grilling" to walk the decision tree with them: constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
+
+Side effects happen inline as decisions crystallize; call the Skill tool with "domain-modeling" to keep the domain model current as you go:
+
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.
+- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing; skip ephemeral reasons ("not worth it right now") and self-evident ones.
+- **Want to explore alternative interfaces for the deepened module?** Call the Skill tool with "codebase-design" and use its design-it-twice parallel sub-agent pattern.

.agents/skills/improve-codebase-architecture/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: "Improve Codebase Architecture"
+  short_description: "Find and grill architecture improvements"
+policy:
+  allow_implicit_invocation: false

.agents/skills/organization-best-practices/SKILL.md

@@ -0,0 +1,479 @@
+---
+name: organization-best-practices
+description: Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.
+---
+
+## Setup
+
+1. Add `organization()` plugin to server config
+2. Add `organizationClient()` plugin to client config
+3. Run `npx @better-auth/cli@latest migrate` (built-in adapter) or generate + push for Drizzle/Prisma
+4. Verify: check that organization, member, invitation tables exist in your database
+
+```ts
+import { betterAuth } from "better-auth";
+import { organization } from "better-auth/plugins";
+
+export const auth = betterAuth({
+  plugins: [
+    organization({
+      allowUserToCreateOrganization: true,
+      organizationLimit: 5, // Max orgs per user
+      membershipLimit: 100, // Max members per org
+    }),
+  ],
+});
+```
+
+### Client-Side Setup
+
+```ts
+import { createAuthClient } from "better-auth/client";
+import { organizationClient } from "better-auth/client/plugins";
+
+export const authClient = createAuthClient({
+  plugins: [organizationClient()],
+});
+```
+
+## Creating Organizations
+
+The creator is automatically assigned the `owner` role.
+
+```ts
+const createOrg = async () => {
+  const { data, error } = await authClient.organization.create({
+    name: "My Company",
+    slug: "my-company",
+    logo: "https://example.com/logo.png",
+    metadata: { plan: "pro" },
+  });
+};
+```
+
+### Controlling Organization Creation
+
+Restrict who can create organizations based on user attributes:
+
+```ts
+organization({
+  allowUserToCreateOrganization: async (user) => {
+    return user.emailVerified === true;
+  },
+  organizationLimit: async (user) => {
+    // Premium users get more organizations
+    return user.plan === "premium" ? 20 : 3;
+  },
+});
+```
+
+### Creating Organizations on Behalf of Users
+
+Administrators can create organizations for other users (server-side only):
+
+```ts
+await auth.api.createOrganization({
+  body: {
+    name: "Client Organization",
+    slug: "client-org",
+    userId: "user-id-who-will-be-owner", // `userId` is required
+  },
+});
+```
+
+**Note**: The `userId` parameter cannot be used alongside session headers.
+
+
+## Active Organizations
+
+Stored in the session and scopes subsequent API calls. Set after user selects one.
+
+```ts
+const setActive = async (organizationId: string) => {
+  const { data, error } = await authClient.organization.setActive({
+    organizationId,
+  });
+};
+```
+
+Many endpoints use the active organization when `organizationId` is not provided (`listMembers`, `listInvitations`, `inviteMember`, etc.).
+
+Use `getFullOrganization()` to retrieve the active org with all members, invitations, and teams.
+
+## Members
+
+### Adding Members (Server-Side)
+
+```ts
+await auth.api.addMember({
+  body: {
+    userId: "user-id",
+    role: "member",
+    organizationId: "org-id",
+  },
+});
+```
+
+For client-side member additions, use the invitation system instead.
+
+### Assigning Multiple Roles
+
+```ts
+await auth.api.addMember({
+  body: {
+    userId: "user-id",
+    role: ["admin", "moderator"],
+    organizationId: "org-id",
+  },
+});
+```
+
+### Removing Members
+
+Use `removeMember({ memberIdOrEmail })`. The last owner cannot be removed — assign ownership to another member first.
+
+### Updating Member Roles
+
+Use `updateMemberRole({ memberId, role })`.
+
+### Membership Limits
+
+```ts
+organization({
+  membershipLimit: async (user, organization) => {
+    if (organization.metadata?.plan === "enterprise") {
+      return 1000;
+    }
+    return 50;
+  },
+});
+```
+
+## Invitations
+
+### Setting Up Invitation Emails
+
+```ts
+import { betterAuth } from "better-auth";
+import { organization } from "better-auth/plugins";
+import { sendEmail } from "./email";
+
+export const auth = betterAuth({
+  plugins: [
+    organization({
+      sendInvitationEmail: async (data) => {
+        const { email, organization, inviter, invitation } = data;
+
+        await sendEmail({
+          to: email,
+          subject: `Join ${organization.name}`,
+          html: `
+            <p>${inviter.user.name} invited you to join ${organization.name}</p>
+            <a href="https://yourapp.com/accept-invite?id=${invitation.id}">
+              Accept Invitation
+            </a>
+          `,
+        });
+      },
+    }),
+  ],
+});
+```
+
+### Sending Invitations
+
+```ts
+await authClient.organization.inviteMember({
+  email: "newuser@example.com",
+  role: "member",
+});
+```
+
+### Shareable Invitation URLs
+
+```ts
+const { data } = await authClient.organization.getInvitationURL({
+  email: "newuser@example.com",
+  role: "member",
+  callbackURL: "https://yourapp.com/dashboard",
+});
+
+// Share data.url via any channel
+```
+
+This endpoint does not call `sendInvitationEmail` — handle delivery yourself.
+
+### Invitation Configuration
+
+```ts
+organization({
+  invitationExpiresIn: 60 * 60 * 24 * 7, // 7 days (default: 48 hours)
+  invitationLimit: 100, // Max pending invitations per org
+  cancelPendingInvitationsOnReInvite: true, // Cancel old invites when re-inviting
+});
+```
+
+## Roles & Permissions
+
+Default roles: `owner` (full access), `admin` (manage members/invitations/settings), `member` (basic access).
+
+### Checking Permissions
+
+```ts
+const { data } = await authClient.organization.hasPermission({
+  permission: "member:write",
+});
+
+if (data?.hasPermission) {
+  // User can manage members
+}
+```
+
+Use `checkRolePermission({ role, permissions })` for client-side UI rendering (static only). For dynamic access control, use the `hasPermission` endpoint.
+
+## Teams
+
+### Enabling Teams
+
+```ts
+import { organization } from "better-auth/plugins";
+
+export const auth = betterAuth({
+  plugins: [
+    organization({
+        teams: {
+            enabled: true
+        }
+    }),
+  ],
+});
+```
+
+### Creating Teams
+
+```ts
+const { data } = await authClient.organization.createTeam({
+  name: "Engineering",
+});
+```
+
+### Managing Team Members
+
+Use `addTeamMember({ teamId, userId })` (member must be in org first) and `removeTeamMember({ teamId, userId })` (stays in org).
+
+Set active team with `setActiveTeam({ teamId })`.
+
+### Team Limits
+
+```ts
+organization({
+  teams: {
+      maximumTeams: 20, // Max teams per org
+      maximumMembersPerTeam: 50, // Max members per team
+      allowRemovingAllTeams: false, // Prevent removing last team
+  }
+});
+```
+
+## Dynamic Access Control
+
+### Enabling Dynamic Access Control
+
+```ts
+import { organization } from "better-auth/plugins";
+import { dynamicAccessControl } from "@better-auth/organization/addons";
+
+export const auth = betterAuth({
+  plugins: [
+    organization({
+        dynamicAccessControl: {
+            enabled: true
+        }
+    }),
+  ],
+});
+```
+
+### Creating Custom Roles
+
+```ts
+await authClient.organization.createRole({
+  role: "moderator",
+  permission: {
+    member: ["read"],
+    invitation: ["read"],
+  },
+});
+```
+
+Use `updateRole({ roleId, permission })` and `deleteRole({ roleId })`. Pre-defined roles (owner, admin, member) cannot be deleted. Roles assigned to members cannot be deleted until reassigned.
+
+## Lifecycle Hooks
+
+Execute custom logic at various points in the organization lifecycle:
+
+```ts
+organization({
+  hooks: {
+    organization: {
+      beforeCreate: async ({ data, user }) => {
+        // Validate or modify data before creation
+        return {
+          data: {
+            ...data,
+            metadata: { ...data.metadata, createdBy: user.id },
+          },
+        };
+      },
+      afterCreate: async ({ organization, member }) => {
+        // Post-creation logic (e.g., send welcome email, create default resources)
+        await createDefaultResources(organization.id);
+      },
+      beforeDelete: async ({ organization }) => {
+        // Cleanup before deletion
+        await archiveOrganizationData(organization.id);
+      },
+    },
+    member: {
+      afterCreate: async ({ member, organization }) => {
+        await notifyAdmins(organization.id, `New member joined`);
+      },
+    },
+    invitation: {
+      afterCreate: async ({ invitation, organization, inviter }) => {
+        await logInvitation(invitation);
+      },
+    },
+  },
+});
+```
+
+## Schema Customization
+
+Customize table names, field names, and add additional fields:
+
+```ts
+organization({
+  schema: {
+    organization: {
+      modelName: "workspace", // Rename table
+      fields: {
+        name: "workspaceName", // Rename fields
+      },
+      additionalFields: {
+        billingId: {
+          type: "string",
+          required: false,
+        },
+      },
+    },
+    member: {
+      additionalFields: {
+        department: {
+          type: "string",
+          required: false,
+        },
+        title: {
+          type: "string",
+          required: false,
+        },
+      },
+    },
+  },
+});
+```
+
+## Security Considerations
+
+### Owner Protection
+
+- The last owner cannot be removed from an organization
+- The last owner cannot leave the organization
+- The owner role cannot be removed from the last owner
+
+Always ensure ownership transfer before removing the current owner:
+
+```ts
+// Transfer ownership first
+await authClient.organization.updateMemberRole({
+  memberId: "new-owner-member-id",
+  role: "owner",
+});
+
+// Then the previous owner can be demoted or removed
+```
+
+### Organization Deletion
+
+Deleting an organization removes all associated data (members, invitations, teams). Prevent accidental deletion:
+
+```ts
+organization({
+  disableOrganizationDeletion: true, // Disable via config
+});
+```
+
+Or implement soft delete via hooks:
+
+```ts
+organization({
+  hooks: {
+    organization: {
+      beforeDelete: async ({ organization }) => {
+        // Archive instead of delete
+        await archiveOrganization(organization.id);
+        throw new Error("Organization archived, not deleted");
+      },
+    },
+  },
+});
+```
+
+### Invitation Security
+
+- Invitations expire after 48 hours by default
+- Only the invited email address can accept an invitation
+- Pending invitations can be cancelled by organization admins
+
+## Complete Configuration Example
+
+```ts
+import { betterAuth } from "better-auth";
+import { organization } from "better-auth/plugins";
+import { sendEmail } from "./email";
+
+export const auth = betterAuth({
+  plugins: [
+    organization({
+      // Organization limits
+      allowUserToCreateOrganization: true,
+      organizationLimit: 10,
+      membershipLimit: 100,
+      creatorRole: "owner",
+
+      // Slugs
+      defaultOrganizationIdField: "slug",
+
+      // Invitations
+      invitationExpiresIn: 60 * 60 * 24 * 7, // 7 days
+      invitationLimit: 50,
+      sendInvitationEmail: async (data) => {
+        await sendEmail({
+          to: data.email,
+          subject: `Join ${data.organization.name}`,
+          html: `<a href="https://app.com/invite/${data.invitation.id}">Accept</a>`,
+        });
+      },
+
+      // Hooks
+      hooks: {
+        organization: {
+          afterCreate: async ({ organization }) => {
+            console.log(`Organization ${organization.name} created`);
+          },
+        },
+      },
+    }),
+  ],
+});
+```

.agents/skills/tdd/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: tdd
+description: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
+---
+
+# Test-Driven Development
+
+TDD is the red → green loop. This skill is the reference that makes that loop produce tests worth keeping: what a good test is, where tests go, the anti-patterns, and the rules of the loop. Every section applies on every cycle: consult them before and during the loop, not after.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) so test names and interface vocabulary match the project's domain language, and respect ADRs in the area you're touching.
+
+## What a good test is
+
+Tests verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't. A good test reads like a specification: "user can checkout with valid cart" tells you exactly what capability exists, and it survives refactors because it doesn't care about internal structure.
+
+See [tests.md](tests.md) for examples and [mocking.md](mocking.md) for mocking guidelines.
+
+## Seams: where tests go
+
+A **seam** is the public boundary you test at: the interface where you observe behavior without reaching inside. Tests live at seams, never against internals.
+
+**Test only at pre-agreed seams.** Before writing any test, write down the seams under test and confirm them with the user. No test is written at an unconfirmed seam. You can't test everything, so agreeing the seams up front is how testing effort lands on the critical paths and complex logic instead of every edge case.
+
+Ask: "What's the public interface, and which seams should we test?"
+
+When the shape of that interface is itself in question (how deep the module is, where the seam belongs, what the interface should expose), call the Skill tool with "codebase-design" for the vocabulary. It is the shared source of the module, interface, depth, seam, adapter, leverage and locality terms, and it is a reference to consult, not a session to run.
+
+## Anti-patterns
+
+- **Implementation-coupled**: mocks internal collaborators, tests private methods, or verifies through a side channel (querying the database instead of using the interface). The tell: the test breaks when you refactor but behavior hasn't changed.
+- **Tautological**: the assertion recomputes the expected value the way the code does (`expect(add(a, b)).toBe(a + b)`, a snapshot derived by hand the same way, a constant asserted equal to itself), so it passes by construction and can never disagree with the code. Expected values must come from an independent source of truth: a known-good literal, a worked example, the spec.
+- **Horizontal slicing**: writing all tests first, then all implementation. Bulk tests verify _imagined_ behavior: you test the _shape_ of things rather than user-facing behavior, the tests go insensitive to real changes, and you commit to test structure before understanding the implementation. Work in **vertical slices** instead: one test → one implementation → repeat, each test a **tracer bullet** that responds to what the last cycle taught you.
+
+## Rules of the loop
+
+- **Red before green.** Write the failing test first, then only enough code to pass it. Don't anticipate future tests or add speculative features.
+- **One slice at a time.** One seam, one test, one minimal implementation per cycle.
+- **Refactoring is not part of the loop.** It belongs to the review stage (see the `code-review` skill), not the red → green implementation cycle.

.agents/skills/tdd/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "TDD"
+  short_description: "Test-driven red-green-refactor"

.agents/skills/tdd/mocking.md

@@ -0,0 +1,59 @@
+# When to Mock
+
+Mock at **system boundaries** only:
+
+- External APIs (payment, email, etc.)
+- Databases (sometimes - prefer test DB)
+- Time/randomness
+- File system (sometimes)
+
+Don't mock:
+
+- Your own classes/modules
+- Internal collaborators
+- Anything you control
+
+## Designing for Mockability
+
+At system boundaries, design interfaces that are easy to mock:
+
+**1. Use dependency injection**
+
+Pass external dependencies in rather than creating them internally:
+
+```typescript
+// Easy to mock
+function processPayment(order, paymentClient) {
+  return paymentClient.charge(order.total);
+}
+
+// Hard to mock
+function processPayment(order) {
+  const client = new StripeClient(process.env.STRIPE_KEY);
+  return client.charge(order.total);
+}
+```
+
+**2. Prefer SDK-style interfaces over generic fetchers**
+
+Create specific functions for each external operation instead of one generic function with conditional logic:
+
+```typescript
+// GOOD: Each function is independently mockable
+const api = {
+  getUser: (id) => fetch(`/users/${id}`),
+  getOrders: (userId) => fetch(`/users/${userId}/orders`),
+  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
+};
+
+// BAD: Mocking requires conditional logic inside the mock
+const api = {
+  fetch: (endpoint, options) => fetch(endpoint, options),
+};
+```
+
+The SDK approach means:
+- Each mock returns one specific shape
+- No conditional logic in test setup
+- Easier to see which endpoints a test exercises
+- Type safety per endpoint

.agents/skills/tdd/tests.md

@@ -0,0 +1,77 @@
+# Good and Bad Tests
+
+## Good Tests
+
+**Integration-style**: Test through real interfaces, not mocks of internal parts.
+
+```typescript
+// GOOD: Tests observable behavior
+test("user can checkout with valid cart", async () => {
+  const cart = createCart();
+  cart.add(product);
+  const result = await checkout(cart, paymentMethod);
+  expect(result.status).toBe("confirmed");
+});
+```
+
+Characteristics:
+
+- Tests behavior users/callers care about
+- Uses public API only
+- Survives internal refactors
+- Describes WHAT, not HOW
+- One logical assertion per test
+
+## Bad Tests
+
+**Implementation-detail tests**: Coupled to internal structure.
+
+```typescript
+// BAD: Tests implementation details
+test("checkout calls paymentService.process", async () => {
+  const mockPayment = jest.mock(paymentService);
+  await checkout(cart, payment);
+  expect(mockPayment.process).toHaveBeenCalledWith(cart.total);
+});
+```
+
+Red flags:
+
+- Mocking internal collaborators
+- Testing private methods
+- Asserting on call counts/order
+- Test breaks when refactoring without behavior change
+- Test name describes HOW not WHAT
+- Verifying through external means instead of interface
+
+```typescript
+// BAD: Bypasses interface to verify
+test("createUser saves to database", async () => {
+  await createUser({ name: "Alice" });
+  const row = await db.query("SELECT * FROM users WHERE name = ?", ["Alice"]);
+  expect(row).toBeDefined();
+});
+
+// GOOD: Verifies through interface
+test("createUser makes user retrievable", async () => {
+  const user = await createUser({ name: "Alice" });
+  const retrieved = await getUser(user.id);
+  expect(retrieved.name).toBe("Alice");
+});
+```
+
+**Tautological tests**: Expected value restates the implementation, so the test passes by construction.
+
+```typescript
+// BAD: Expected value is recomputed the way the code computes it
+test("calculateTotal sums line items", () => {
+  const items = [{ price: 10 }, { price: 5 }];
+  const expected = items.reduce((sum, i) => sum + i.price, 0);
+  expect(calculateTotal(items)).toBe(expected);
+});
+
+// GOOD: Expected value is an independent, known literal
+test("calculateTotal sums line items", () => {
+  expect(calculateTotal([{ price: 10 }, { price: 5 }])).toBe(15);
+});
+```

.agents/skills/two-factor-authentication-best-practices/SKILL.md

@@ -0,0 +1,331 @@
+---
+name: two-factor-authentication-best-practices
+description: Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.
+---
+
+## Setup
+
+1. Add `twoFactor()` plugin to server config with `issuer`
+2. Add `twoFactorClient()` plugin to client config
+3. Run `npx @better-auth/cli@latest migrate` (built-in adapter) or generate + push for Drizzle/Prisma
+4. Verify: check that `twoFactorSecret` column exists on user table
+
+```ts
+import { betterAuth } from "better-auth";
+import { twoFactor } from "better-auth/plugins";
+
+export const auth = betterAuth({
+  appName: "My App",
+  plugins: [
+    twoFactor({
+      issuer: "My App",
+    }),
+  ],
+});
+```
+
+### Client-Side Setup
+
+```ts
+import { createAuthClient } from "better-auth/client";
+import { twoFactorClient } from "better-auth/client/plugins";
+
+export const authClient = createAuthClient({
+  plugins: [
+    twoFactorClient({
+      onTwoFactorRedirect() {
+        window.location.href = "/2fa";
+      },
+    }),
+  ],
+});
+```
+
+## Enabling 2FA for Users
+
+Requires password verification. Returns TOTP URI (for QR code) and backup codes.
+
+```ts
+const enable2FA = async (password: string) => {
+  const { data, error } = await authClient.twoFactor.enable({
+    password,
+  });
+
+  if (data) {
+    // data.totpURI — generate a QR code from this
+    // data.backupCodes — display to user
+  }
+};
+```
+
+`twoFactorEnabled` is not set to `true` until first TOTP verification succeeds. Override with `skipVerificationOnEnable: true` (not recommended).
+
+## TOTP (Authenticator App)
+
+### Displaying the QR Code
+
+```tsx
+import QRCode from "react-qr-code";
+
+const TotpSetup = ({ totpURI }: { totpURI: string }) => {
+  return <QRCode value={totpURI} />;
+};
+```
+
+### Verifying TOTP Codes
+
+Accepts codes from one period before/after current time:
+
+```ts
+const verifyTotp = async (code: string) => {
+  const { data, error } = await authClient.twoFactor.verifyTotp({
+    code,
+    trustDevice: true,
+  });
+};
+```
+
+### TOTP Configuration Options
+
+```ts
+twoFactor({
+  totpOptions: {
+    digits: 6, // 6 or 8 digits (default: 6)
+    period: 30, // Code validity period in seconds (default: 30)
+  },
+});
+```
+
+## OTP (Email/SMS)
+
+### Configuring OTP Delivery
+
+```ts
+import { betterAuth } from "better-auth";
+import { twoFactor } from "better-auth/plugins";
+import { sendEmail } from "./email";
+
+export const auth = betterAuth({
+  plugins: [
+    twoFactor({
+      otpOptions: {
+        sendOTP: async ({ user, otp }, ctx) => {
+          await sendEmail({
+            to: user.email,
+            subject: "Your verification code",
+            text: `Your code is: ${otp}`,
+          });
+        },
+        period: 5, // Code validity in minutes (default: 3)
+        digits: 6, // Number of digits (default: 6)
+        allowedAttempts: 5, // Max verification attempts (default: 5)
+      },
+    }),
+  ],
+});
+```
+
+### Sending and Verifying OTP
+
+Send: `authClient.twoFactor.sendOtp()`. Verify: `authClient.twoFactor.verifyOtp({ code, trustDevice: true })`.
+
+### OTP Storage Security
+
+Configure how OTP codes are stored in the database:
+
+```ts
+twoFactor({
+  otpOptions: {
+    storeOTP: "encrypted", // Options: "plain", "encrypted", "hashed"
+  },
+});
+```
+
+For custom encryption:
+
+```ts
+twoFactor({
+  otpOptions: {
+    storeOTP: {
+      encrypt: async (token) => myEncrypt(token),
+      decrypt: async (token) => myDecrypt(token),
+    },
+  },
+});
+```
+
+## Backup Codes
+
+Generated automatically when 2FA is enabled. Each code is single-use.
+
+### Displaying Backup Codes
+
+```tsx
+const BackupCodes = ({ codes }: { codes: string[] }) => {
+  return (
+    <div>
+      <p>Save these codes in a secure location:</p>
+      <ul>
+        {codes.map((code, i) => (
+          <li key={i}>{code}</li>
+        ))}
+      </ul>
+    </div>
+  );
+};
+```
+
+### Regenerating Backup Codes
+
+Invalidates all previous codes:
+
+```ts
+const regenerateBackupCodes = async (password: string) => {
+  const { data, error } = await authClient.twoFactor.generateBackupCodes({
+    password,
+  });
+  // data.backupCodes contains the new codes
+};
+```
+
+### Using Backup Codes for Recovery
+
+```ts
+const verifyBackupCode = async (code: string) => {
+  const { data, error } = await authClient.twoFactor.verifyBackupCode({
+    code,
+    trustDevice: true,
+  });
+};
+```
+
+### Backup Code Configuration
+
+```ts
+twoFactor({
+  backupCodeOptions: {
+    amount: 10, // Number of codes to generate (default: 10)
+    length: 10, // Length of each code (default: 10)
+    storeBackupCodes: "encrypted", // Options: "plain", "encrypted"
+  },
+});
+```
+
+## Handling 2FA During Sign-In
+
+Response includes `twoFactorRedirect: true` when 2FA is required:
+
+### Sign-In Flow
+
+1. Call `signIn.email({ email, password })`
+2. Check `context.data.twoFactorRedirect` in `onSuccess`
+3. If `true`, redirect to `/2fa` verification page
+4. Verify via TOTP, OTP, or backup code
+5. Session cookie is created on successful verification
+
+```ts
+const signIn = async (email: string, password: string) => {
+  const { data, error } = await authClient.signIn.email(
+    { email, password },
+    {
+      onSuccess(context) {
+        if (context.data.twoFactorRedirect) {
+          window.location.href = "/2fa";
+        }
+      },
+    }
+  );
+};
+```
+
+Server-side: check `"twoFactorRedirect" in response` when using `auth.api.signInEmail`.
+
+## Trusted Devices
+
+Pass `trustDevice: true` when verifying. Default trust duration: 30 days (`trustDeviceMaxAge`). Refreshes on each sign-in.
+
+## Security Considerations
+
+### Session Management
+
+Flow: credentials → session removed → temporary 2FA cookie (10 min default) → verify → session created.
+
+```ts
+twoFactor({
+  twoFactorCookieMaxAge: 600, // 10 minutes in seconds (default)
+});
+```
+
+### Rate Limiting
+
+Built-in: 3 requests per 10 seconds for all 2FA endpoints. OTP has additional attempt limiting:
+
+```ts
+twoFactor({
+  otpOptions: {
+    allowedAttempts: 5, // Max attempts per OTP code (default: 5)
+  },
+});
+```
+
+### Encryption at Rest
+
+TOTP secrets: encrypted with auth secret. Backup codes: encrypted by default. OTP: configurable (`"plain"`, `"encrypted"`, `"hashed"`). Uses constant-time comparison for verification.
+
+2FA can only be enabled for credential (email/password) accounts.
+
+## Disabling 2FA
+
+Requires password confirmation. Revokes trusted device records:
+
+```ts
+const disable2FA = async (password: string) => {
+  const { data, error } = await authClient.twoFactor.disable({
+    password,
+  });
+};
+```
+
+## Complete Configuration Example
+
+```ts
+import { betterAuth } from "better-auth";
+import { twoFactor } from "better-auth/plugins";
+import { sendEmail } from "./email";
+
+export const auth = betterAuth({
+  appName: "My App",
+  plugins: [
+    twoFactor({
+      // TOTP settings
+      issuer: "My App",
+      totpOptions: {
+        digits: 6,
+        period: 30,
+      },
+      // OTP settings
+      otpOptions: {
+        sendOTP: async ({ user, otp }) => {
+          await sendEmail({
+            to: user.email,
+            subject: "Your verification code",
+            text: `Your code is: ${otp}`,
+          });
+        },
+        period: 5,
+        allowedAttempts: 5,
+        storeOTP: "encrypted",
+      },
+      // Backup code settings
+      backupCodeOptions: {
+        amount: 10,
+        length: 10,
+        storeBackupCodes: "encrypted",
+      },
+      // Session settings
+      twoFactorCookieMaxAge: 600, // 10 minutes
+      trustDeviceMaxAge: 30 * 24 * 60 * 60, // 30 days
+    }),
+  ],
+});
+```

.agents/skills/web-design-guidelines/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: web-design-guidelines
+description: Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
+metadata:
+  author: vercel
+  version: "1.0.0"
+  argument-hint: <file-or-pattern>
+---
+
+# Web Interface Guidelines
+
+Review files for compliance with Web Interface Guidelines.
+
+## How It Works
+
+1. Fetch the latest guidelines from the source URL below
+2. Read the specified files (or prompt user for files/pattern)
+3. Check against all rules in the fetched guidelines
+4. Output findings in the terse `file:line` format
+
+## Guidelines Source
+
+Fetch fresh guidelines before each review:
+
+```
+https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
+```
+
+Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.
+
+## Usage
+
+When a user provides a file or pattern argument:
+1. Fetch guidelines from the source URL above
+2. Read the specified files
+3. Apply all rules from the fetched guidelines
+4. Output findings using the format specified in the guidelines
+
+If no files specified, ask the user which files to review.

.agents/skills/writing-guidelines/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: writing-guidelines
+description: Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
+metadata:
+  author: vercel
+  version: "1.0.0"
+  argument-hint: <file-or-pattern>
+---
+
+# Writing Guidelines
+
+Review files for compliance with Writing Guidelines.
+
+## How It Works
+
+1. Fetch the latest guidelines from the source URL below
+2. Read the specified files (or prompt user for files/pattern)
+3. Check against all rules in the fetched guidelines
+4. Output findings in the terse `file:line` format
+
+## Guidelines Source
+
+Fetch fresh guidelines before each review:
+
+```
+https://raw.githubusercontent.com/vercel-labs/writing-guidelines/main/command.md
+```
+
+Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.
+
+## Usage
+
+When a user provides a file or pattern argument:
+1. Fetch guidelines from the source URL above
+2. Read the specified files
+3. Apply all rules from the fetched guidelines
+4. Output findings using the format specified in the guidelines
+
+If no files specified, ask the user which files to review.

.env

@@ -2,18 +2,18 @@
 BASANGO_API_HOST=localhost
 BASANGO_API_PORT=3080
 BASANGO_API_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
-BASANGO_API_KEY=your_api_key_here
+BASANGO_API_KEY=e0f53e6ca1f9fd7ab672a128fdd899d4dbacaba0e00f6388effadc298956e160
 BASANGO_API_CRAWLER_TOKEN=dev
 BASANGO_API_CRAWLER_ENDPOINT="http://localhost:3080"
 BASANGO_API_JWT_SECRET=your_jwt_secret_here
 
+BASANGO_ADMIN_EMAIL="ngandubernard@gmail.com"
+BASANGO_ADMIN_NAME="Bernard Ngandu"
+BASANGO_ADMIN_PASSWORD="#QWeqwe123_123#**"
+BETTER_AUTH_SECRET=sta3pwzhXqWbMYEN1fRUG7ve3MXHuxWQ
+
 # db
 BASANGO_DATABASE_URL="postgresql://postgres:postgres@localhost:5432/app?serverVersion=16&charset=utf8"
-BASANGO_DATABASE_LEGACY_HOST="localhost"
-BASANGO_DATABASE_LEGACY_PASSWORD="root"
-BASANGO_DATABASE_LEGACY_NAME="app"
-BASANGO_DATABASE_LEGACY_USER="root"
-BASANGO_DATABASE_LEGACY_PORT=3306
 
 # logger
 BASANGO_LOGGER_LEVEL=debug
@@ -37,4 +37,4 @@ BASANGO_CRAWLER_ASYNC_QUEUE_DETAILS="details"
 BASANGO_CRAWLER_ASYNC_QUEUE_PROCESSING="processing"
 
 # encryption
-BASANGO_ENCRYPTION_KEY=testkey
+BASANGO_ENCRYPTION_KEY=9bec222d42416839ae81de4b593c7d95982714cf9e6d35906ca9affb0f352dfc

AGENTS.md

@@ -15,6 +15,12 @@ Workspace Layout
 - Internal packages use the `@basango/` scope and `workspace:*` versions.
 - Avoid nested packages like `apps/**` or `packages/**`.
 
+Documentation
+- Engineering documentation belongs under `docs/`.
+- Before changing a TypeScript application or shared package, read `docs/web/README.md` and the relevant package or feature documentation.
+- All authored TypeScript and React follows `docs/web/code-style.md`. It is authoritative for naming, readability, React patterns, module boundaries, and package interfaces.
+- Update architecture documentation when a change introduces a new application, package, process boundary, public package entrypoint, or workspace dependency direction.
+
 Packages
 - `@basango/logger`: Pino wrapper. Prefer named import `import { logger } from "@basango/logger"`.
 - `@basango/db`: Drizzle ORM for Postgres. Import via defined subpaths (`./client`, `./queries`, `./schema`, `./utils`).
@@ -29,6 +35,78 @@ Conventions
 - Keep changes minimal and localized; avoid cross-cutting refactors without discussion.
 - When using tRPC in React, always compose `useQuery`/`useMutation` from TanStack with `trpc.*.queryOptions`/`mutationOptions` instead of calling `trpc.*.useQuery`/`useMutation` helpers directly (they are deprecated).
 
+Architecture
+- Organize application code by bounded context and product capability before technical role.
+- Keep route composition, navigation, environment access, and platform behavior in the owning application.
+- Start new behavior in its owning application. Extract it only for at least two real consumers or a clear package-owned responsibility.
+- Packages expose small, intentional interfaces and hide cohesive implementation details.
+- No package may import from an application. No client application may import `@basango/db`, `@basango/logger`, or `@basango/encryption`.
+- Dashboard code imports API router types only through the explicit `@basango/api/trpc/routers/_app` export.
+- Mobile may share platform-neutral domain contracts but must not import the DOM-based `@basango/ui` package.
+- Follow the dependency graph in `docs/web/README.md`. A new lateral package dependency requires a real ownership relationship and a documentation update.
+
+TypeScript
+- Use `type`. Use `interface` only when declaration merging or third-party module augmentation requires it.
+- Define API transport, persisted structured data, and structured form contracts as Zod schemas.
+- Infer TypeScript types from Zod rather than duplicating contract types manually. A focused typed parser is sufficient for one simple route or environment value.
+- Use camelCase for schema properties.
+- Use function declarations for named functions, components, hooks, handlers, formatters, predicates, and factories. Reserve arrow functions for inline callbacks and expression-based wrappers.
+- Use `T[]` and `readonly T[]`, `unknown` at untrusted seams, and discriminated unions instead of enums.
+- Use `import type` for type-only dependencies.
+- Prefer `undefined` for omitted internal values. Preserve `null` only where a transport or persisted contract distinguishes it.
+
+Readability
+- Separate logical blocks with one blank line: declaration groups, control flow, side effects, render guards, and final returns must read as distinct semantic paragraphs.
+- Put one blank line between every top-level schema, type, constant, function, and component declaration.
+- Always use braces and multiline bodies for `if`, `for`, `while`, `switch`, and `try`; never compress a guard or side effect onto one line.
+- Inside a function, closely related side-effect-free declarations may stay together. Do not add padding immediately inside braces or between `if`/`else` and `try`/`catch`.
+
+Imports and Exports
+- Use relative imports inside one feature slice or package.
+- Use `#dashboard/*` or `#mobile/*` when crossing an application seam.
+- Use `@basango/*` only when crossing a declared package seam. Never import a package from itself through its public alias.
+- Never import another workspace's undeclared source or internal path. Do not use TypeScript path mappings as a substitute for package exports.
+- Omit `.ts` and `.tsx` extensions. Use named React imports rather than `import * as React` in authored code.
+- Prefer named exports. Default exports are limited to framework requirements.
+- Keep `index.ts` interface- or composition-only and use explicit exports instead of `export *`.
+- Do not pass through another package's domain symbols. Consumers import a symbol from its owner.
+- Public package paths must be intentional `package.json` exports. Wildcard exports are limited to the UI registry's component-per-file convention.
+
+React
+- Keep one owner for each piece of state and derive values during render.
+- Use effects only to synchronize with an external system. Event-driven resets belong in a handler or keyed session; asynchronous synchronization must not overwrite dirty input.
+- Use a named `ComponentNameProps` type for every exported component. Inline prop types are limited to small private leaves with at most two simple fields.
+- Do not use `React.FC` or `React.FunctionComponent`.
+- Import Lucide icons using the `Icon` suffix, for example `UserAddIcon`.
+- Dashboard components use shared `@basango/ui` primitives where they express the required semantics. Mobile components use React Native or Expo primitives.
+
+Components and Logic
+- Keep one stateful UI responsibility per module. Cohesive compound primitives may export a family of parts.
+- Split independent dialogs, tabs, workflows, or data lifecycles into composable modules with descriptive names.
+- Review behavioral `.ts` and `.tsx` modules at 250 lines and actively look for independent responsibilities above 300 lines. Authored modules above 500 lines require an explicit architectural reason.
+- Extract a custom hook for reusable or lifecycle-owning React behavior with a cohesive interface.
+- Keep a single-consumer private hook beside its component when that improves locality; put exported reusable feature hooks under `hooks/`.
+- Extract calculations and normalization into pure functions, not hooks.
+- Introduce an adapter only at a real varying seam. Do not add a pass-through service or hook around one implementation.
+
+Data, Mutations, and Forms
+- Compose TanStack Query's `useQuery` and `useMutation` with `trpc.*.queryOptions()` and `trpc.*.mutationOptions()` for direct API operations.
+- Use procedure-owned query keys or prefixes for invalidation. Do not invent independent raw query-key arrays in components.
+- Reserve handwritten query and mutation functions for composed workflows, pagination adapters, server actions, or deliberate transformations.
+- Give each mutation object an imperative domain-verb name and call it directly. Do not wrap `mutate` unless additional behavior is required.
+- Every user-triggered mutation must explicitly provide inline error feedback or a localized toast. Deliberately silent failure requires an explanatory comment.
+- Mutation-backed HTML forms with structured input use a domain Zod contract and `useZodForm`; do not retype API payloads locally.
+- Zero-field confirmations and non-data-entry actions do not need ceremonial schemas.
+- Normalize transport errors at the API or application transport seam. Components must not depend on low-level transport internals.
+
+Packages
+- Use scoped names `@basango/<name>` and `workspace:*` for internal dependencies.
+- Keep package interfaces small and explicit. Internal imports are relative and public subpaths are intentional.
+- A package must not expose another package's domain as its own.
+- Shared versions used by multiple workspaces belong in the root Bun catalog and consumers reference them with `catalog:`.
+- Every workspace TypeScript configuration extends `@basango/tsconfig` when its framework permits. Expo may extend its framework configuration while preserving equivalent strictness.
+- The web UI package is DOM-specific. Share schemas and pure platform-neutral logic with mobile, not web components.
+
 Tasks & Commands
 - Install: `bun install` (run at repo root only).
 - Dev: `bun run dev`.
@@ -36,7 +114,7 @@ Tasks & Commands
 - Typecheck: `bun run typecheck`.
 - Lint/format: `bun run lint` or `bun run format`.
 - Turbo filtering examples:
-  - `bunx turbo dev --filter=@basango/crawler`
+  - `bun run crawler:worker` (starts the sibling Rust crawler)
   - `bunx turbo build --filter=@basango/dashboard`
 
 Adding a New Package
@@ -67,4 +145,6 @@ Gotchas
 
 Contact Points
 - Architecture overview: `docs/architecture.md`.
+- TypeScript applications and package boundaries: `docs/web/README.md`.
+- TypeScript and React module design: `docs/web/code-style.md`.
 - Forms handling patterns: `docs/forms-handling.md`.

Makefile

@@ -2,15 +2,9 @@
 default: help
 
 COMPOSE ?= docker compose
-MYSQL_BACKUP ?= var/volumes/backups/basango.mysql.gz
-MYSQL_BACKUP_IN_CONTAINER ?= /var/www/var/basango.mysql.gz
-MYSQL_DATABASE ?= app
-MYSQL_SERVICE ?= mariadb
-MYSQL_ROOT_USER ?= root
 POSTGRES_DATABASE ?= app
 POSTGRES_SERVICE ?= postgres
 POSTGRES_USER ?= postgres
-SYNC_TABLES ?= user source article
 
 .PHONY: help
 help:
@@ -20,26 +14,15 @@ help:
 # -----------------------------------
 # Local data
 # -----------------------------------
-.PHONY: db-reload-from-backup
-db-reload-from-backup: ## Reset local MariaDB/Postgres, load basango.mysql.gz, migrate, and sync data
-	@test -f "$(MYSQL_BACKUP)" || (echo "Missing backup: $(MYSQL_BACKUP)" >&2; exit 1)
-	$(COMPOSE) up -d $(MYSQL_SERVICE) $(POSTGRES_SERVICE)
-	@echo "Waiting for MariaDB..."
-	@until $(COMPOSE) exec -T $(MYSQL_SERVICE) sh -c 'mariadb-admin ping -u$(MYSQL_ROOT_USER) -p"$${MARIADB_ROOT_PASSWORD}" --silent'; do sleep 1; done
+.PHONY: db-rebuild
+db-rebuild: ## Rebuild the local PostgreSQL database and run migrations
+	$(COMPOSE) up -d $(POSTGRES_SERVICE)
 	@echo "Waiting for Postgres..."
 	@until $(COMPOSE) exec -T $(POSTGRES_SERVICE) pg_isready -U $(POSTGRES_USER) -d postgres >/dev/null; do sleep 1; done
-	@echo "Resetting MariaDB database $(MYSQL_DATABASE)..."
-	$(COMPOSE) exec -T $(MYSQL_SERVICE) sh -c 'mariadb -u$(MYSQL_ROOT_USER) -p"$${MARIADB_ROOT_PASSWORD}" -e "DROP DATABASE IF EXISTS \`$(MYSQL_DATABASE)\`; CREATE DATABASE \`$(MYSQL_DATABASE)\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"'
-	@echo "Loading $(MYSQL_BACKUP_IN_CONTAINER) into MariaDB database $(MYSQL_DATABASE)..."
-	$(COMPOSE) exec -T $(MYSQL_SERVICE) sh -c 'gzip -dc "$(MYSQL_BACKUP_IN_CONTAINER)" | mariadb -u$(MYSQL_ROOT_USER) -p"$${MARIADB_ROOT_PASSWORD}" "$(MYSQL_DATABASE)"'
 	@echo "Resetting Postgres database $(POSTGRES_DATABASE)..."
 	$(COMPOSE) exec -T $(POSTGRES_SERVICE) psql -U $(POSTGRES_USER) -d postgres -v ON_ERROR_STOP=1 -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '$(POSTGRES_DATABASE)' AND pid <> pg_backend_pid();" -c "DROP DATABASE IF EXISTS \"$(POSTGRES_DATABASE)\";" -c "CREATE DATABASE \"$(POSTGRES_DATABASE)\";"
 	@echo "Running Postgres migrations..."
 	bun run migrate
-	@echo "Synchronizing legacy data into Postgres..."
-	cd packages/db && bun run sync:data -- $(SYNC_TABLES)
-	@echo "Synchronizing categories..."
-	cd packages/db && bun run sync:categories
 
 # -----------------------------------
 # Deployment

README.md

@@ -11,7 +11,7 @@
 | Scope             | Link                                      |
 |-------------------|-------------------------------------------|
 | API               | [README.md](./apps/api/README.md)         |
-| Crawler           | [README.md](./apps/crawler/README.md)     |
+| Crawler (Rust)    | [bernard-ng/basango-rs](https://github.com/bernard-ng/basango-rs) |
 | Dashboard         | [README.md](./apps/dashboard/README.md)   |
 | Mobile            | [README.md](./apps/mobile/README.md)      |
 
@@ -30,6 +30,8 @@
 | Scope             | Link                                          |
 |-------------------|-----------------------------------------------|
 | Architecture      | [ARCHITECTURE.md](./docs/architecture.md)     |
+| TypeScript apps   | [README.md](./docs/web/README.md)             |
+| TypeScript style  | [CODE-STYLE.md](./docs/web/code-style.md)     |
 | Contributing      | [CONTRIBUTING.md](./CONTRIBUTING.md)          |
 | Code of Conduct   | [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md)    |
 | Security          | [SECURITY.md](./SECURITY.md)                  |

apps/api/README.md

@@ -1 +1,54 @@
 # Basango API
+
+The API is the boundary between the Rust crawler and Basango's canonical dataset.
+
+## Ingestion writes
+
+All crawler writes require the raw `BASANGO_API_CRAWLER_TOKEN` value in the `Authorization` header.
+
+- `POST /ingest/articles` stores an idempotent crawled article.
+- `POST /ingest/signals` accepts idempotent `agent.*` and `run.*` operational signals.
+- `POST /ingest/sources/publication-bounds` returns the current collection boundary for a source.
+
+The domain package owns request validation. The ingestion service applies signals to the durable operations projection; REST handlers do not contain projection logic.
+
+## Operations reads
+
+Authenticated administrators receive the durable snapshot through `operations.getIngestionOverview` over tRPC. `GET /operations/ingestion/stream` sends lightweight realtime invalidations and uses the same Better Auth session cookie as tRPC. The stream never serves as the source of truth.
+
+## Authentication
+
+Better Auth owns password credentials, sessions, password-reset verifications, and roles. Public sign-up is disabled while the only client is the admin dashboard; future web and mobile clients can use the same `/api/auth/*` API after sign-up is enabled. Dashboard tRPC and operations endpoints require the `admin` role.
+
+Configure:
+
+- `BETTER_AUTH_SECRET`: random secret with at least 32 characters; required in production.
+- `BETTER_AUTH_URL`: public API origin, for example `https://api.basango.io`.
+- `BETTER_AUTH_COOKIE_DOMAIN`: optional shared production domain, for example `.basango.io`, when API and clients use subdomains.
+
+The dashboard supplies its own origin as the password-reset destination; Better Auth validates it against the configured trusted CORS origins.
+
+## Password reset email delivery
+
+Password reset uses Better Auth's single-use verification flow and Resend's HTTPS API in production. Configure:
+
+- `BASANGO_RESEND_API_KEY`: Resend API key (required in production).
+- `BASANGO_RESEND_FROM_EMAIL`: verified sender, for example `Basango <noreply@basango.io>`.
+In development, when no Resend API key is configured, the API writes the Better Auth reset URL to the development log. Reset tokens expire after 30 minutes, can only be used once, and reset completion revokes all existing sessions.
+
+Apply the database migrations before enabling password reset or ingestion signals:
+
+```bash
+bun run migrate
+```
+
+While the schema is still under active development, migration history is intentionally squashed into `0000_init.sql`. Databases that ran an older migration chain must be recreated before applying this baseline.
+
+Create the first dashboard administrator after migrating:
+
+```bash
+BASANGO_ADMIN_EMAIL=admin@example.com \
+BASANGO_ADMIN_NAME="Basango Admin" \
+BASANGO_ADMIN_PASSWORD="replace-with-a-strong-password" \
+bun --filter @basango/api auth:create-admin
+```

apps/api/package.json

@@ -2,16 +2,19 @@
   "dependencies": {
     "@basango/db": "workspace:*",
     "@basango/domain": "workspace:*",
-    "@basango/encryption": "workspace:*",
     "@basango/logger": "workspace:*",
+    "@better-auth/drizzle-adapter": "^1.7.1",
     "@hono/node-server": "^1.19.6",
     "@hono/trpc-server": "^0.4.0",
     "@hono/zod-openapi": "^1.1.4",
     "@trpc/server": "^11.7.1",
+    "better-auth": "^1.7.1",
     "camelcase-keys": "^10.0.1",
     "date-fns": "catalog:",
+    "hono": "^4.13.3",
     "hono-rate-limiter": "^0.4.2",
-    "jose": "^6.1.0",
+    "superjson": "^2.2.6",
+    "uuid": "^13.0.0",
     "zod": "catalog:",
     "zod-openapi": "^5.4.3"
   },
@@ -24,6 +27,7 @@
   "name": "@basango/api",
   "private": true,
   "scripts": {
+    "auth:create-admin": "bun run src/scripts/create-admin.ts",
     "dev": "bun run --hot src/index.ts",
     "start": "NODE_ENV=production bun run src/index.ts",
     "typecheck": "tsc --noEmit"

apps/api/src/auth.ts

@@ -0,0 +1,85 @@
+import { db } from "@basango/db/client";
+import { accounts, sessions, users, verifications } from "@basango/db/schema";
+import { config, env } from "@basango/domain/config";
+import { logger } from "@basango/logger";
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { admin } from "better-auth/plugins";
+import { v7 as uuidv7 } from "uuid";
+
+import { sendPasswordResetEmail } from "#api/utils/password-reset-email";
+
+const isProduction = env.NODE_ENV === "production";
+const baseURL = env.BETTER_AUTH_URL?.trim() ?? `http://localhost:${config.api.server.port}`;
+const cookieDomain = env.BETTER_AUTH_COOKIE_DOMAIN?.trim();
+const secret =
+  env.BETTER_AUTH_SECRET?.trim() ??
+  (isProduction ? undefined : "basango-local-better-auth-secret-change-me");
+
+if (!secret) {
+  throw new Error("BETTER_AUTH_SECRET is required in production.");
+}
+
+export const auth = betterAuth({
+  advanced: {
+    database: {
+      generateId: () => uuidv7(),
+    },
+    ...(cookieDomain
+      ? {
+          crossSubDomainCookies: {
+            domain: cookieDomain,
+            enabled: true,
+          },
+        }
+      : {}),
+  },
+  appName: "Basango",
+  basePath: "/api/auth",
+  baseURL,
+  database: drizzleAdapter(db, {
+    provider: "pg",
+    schema: {
+      account: accounts,
+      session: sessions,
+      user: users,
+      verification: verifications,
+    },
+  }),
+  emailAndPassword: {
+    disableSignUp: true,
+    enabled: true,
+    maxPasswordLength: 72,
+    minPasswordLength: 8,
+    resetPasswordTokenExpiresIn: 30 * 60,
+    revokeSessionsOnPasswordReset: true,
+    sendResetPassword: async ({ token, url, user }) => {
+      void sendPasswordResetEmail({
+        email: user.email,
+        name: user.name,
+        token,
+        url,
+      }).catch((error: unknown) => {
+        logger.error({ email: user.email, error }, "Unable to deliver password reset email");
+      });
+    },
+  },
+  plugins: [
+    admin({
+      adminRoles: ["admin"],
+      defaultRole: "user",
+    }),
+  ] as const,
+  secret,
+  session: {
+    expiresIn: 60 * 60 * 24 * 7,
+    updateAge: 60 * 60 * 24,
+  },
+  trustedOrigins: [...config.api.cors.origin],
+});
+
+export type AuthSession = typeof auth.$Infer.Session;
+
+export function isAdmin(session: AuthSession | null): boolean {
+  return session?.user.role?.split(",").includes("admin") ?? false;
+}

apps/api/src/index.ts

@@ -5,6 +5,7 @@ import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 import { secureHeaders } from "hono/secure-headers";
 
+import { auth } from "#api/auth";
 import { routers } from "#api/rest/routers";
 import { createTRPCContext } from "#api/trpc/init";
 import { appRouter } from "#api/trpc/routers/_app";
@@ -17,14 +18,17 @@ app.use(secureHeaders());
 app.use(
   "*",
   cors({
-    allowHeaders: config.api.cors.allowedHeaders,
-    allowMethods: config.api.cors.allowMethods,
-    exposeHeaders: config.api.cors.exposeHeaders,
+    allowHeaders: [...config.api.cors.allowedHeaders],
+    allowMethods: [...config.api.cors.allowMethods],
+    credentials: true,
+    exposeHeaders: [...config.api.cors.exposeHeaders],
     maxAge: config.api.cors.maxAge,
-    origin: config.api.cors.origin,
+    origin: [...config.api.cors.origin],
   }),
 );
 
+app.all("/api/auth/*", (c) => auth.handler(c.req.raw));
+
 app.use(
   "/trpc/*",
   trpcServer({

apps/api/src/rest/init.ts

@@ -1,7 +1,10 @@
 import type { Database } from "@basango/db/client";
 
+import type { AuthSession } from "#api/auth";
+
 export type Context = {
   Variables: {
     db: Database;
+    session: AuthSession;
   };
 };

apps/api/src/rest/middlewares/ingestion.ts

@@ -2,15 +2,15 @@ import { config } from "@basango/domain/config";
 import type { MiddlewareHandler } from "hono";
 import { HTTPException } from "hono/http-exception";
 
-export const withCrawlerAuth: MiddlewareHandler = async (c, next) => {
+export const withIngestionAuth: MiddlewareHandler = async (c, next) => {
   const token = c.req.header("Authorization");
 
   if (!token) {
     throw new HTTPException(401, { message: "Authorization header required" });
   }
 
-  if (token !== config.api.security.crawlerToken) {
-    throw new HTTPException(403, { message: "Invalid token" });
+  if (token !== config.api.security.ingestionToken) {
+    throw new HTTPException(403, { message: "Invalid ingestion token" });
   }
 
   await next();

apps/api/src/rest/middlewares/session.ts

@@ -0,0 +1,18 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+import { auth, isAdmin } from "#api/auth";
+import type { Context } from "#api/rest/init";
+
+export const withAdminSession: MiddlewareHandler<Context> = async (c, next) => {
+  const session = await auth.api.getSession({ headers: c.req.raw.headers });
+  if (!session) {
+    throw new HTTPException(401, { message: "Authentication required" });
+  }
+  if (!isAdmin(session)) {
+    throw new HTTPException(403, { message: "Administrator access required" });
+  }
+
+  c.set("session", session);
+  await next();
+};

apps/api/src/rest/routers/index.ts

@@ -1,11 +1,11 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 
-import { articlesRouter } from "#api/rest/routers/articles";
-import { sourcesRouter } from "#api/rest/routers/sources";
+import { ingestionRouter } from "#api/rest/routers/ingestion";
+import { operationsRouter } from "#api/rest/routers/operations";
 
 const routers: OpenAPIHono = new OpenAPIHono();
 
-routers.route("/articles", articlesRouter);
-routers.route("/sources", sourcesRouter);
+routers.route("/ingest", ingestionRouter);
+routers.route("/operations", operationsRouter);
 
 export { routers };

apps/api/src/rest/routers/ingestion/articles.ts

@@ -3,18 +3,18 @@ import { createArticleResponseSchema, createArticleSchema } from "@basango/domai
 import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
 
 import type { Context } from "#api/rest/init";
-import { withCrawlerAuth } from "#api/rest/middlewares/crawler";
 import { withDatabase } from "#api/rest/middlewares/db";
+import { withIngestionAuth } from "#api/rest/middlewares/ingestion";
 import { validateResponse } from "#api/utils/response";
 
 const app = new OpenAPIHono<Context>();
 
 app.openapi(
   createRoute({
-    description: "Store a new crawled article in the database.",
+    description: "Add a collected article to Basango's canonical dataset.",
     method: "post",
-    middleware: [withCrawlerAuth, withDatabase],
-    operationId: "CreateArticle",
+    middleware: [withIngestionAuth, withDatabase],
+    operationId: "IngestArticle",
     path: "/",
     request: {
       body: {
@@ -32,20 +32,16 @@ app.openapi(
             schema: createArticleResponseSchema,
           },
         },
-        description: "Article created",
+        description: "Article ingested",
       },
     },
-    summary: "Create Article",
-    tags: ["Articles"],
-    "x-speakeasy-name-override": "create",
+    summary: "Ingest article",
+    tags: ["Ingestion"],
   }),
   async (c) => {
-    const db = c.get("db");
-    const input = c.req.valid("json");
-    const result = await createArticle(db, input);
-
+    const result = await createArticle(c.get("db"), c.req.valid("json"));
     return c.json(validateResponse(result, createArticleResponseSchema), 201);
   },
 );
 
-export const articlesRouter = app;
+export const articleIngestionRouter = app;

apps/api/src/rest/routers/ingestion/index.ts

@@ -0,0 +1,13 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+
+import { articleIngestionRouter } from "./articles";
+import { publicationBoundsRouter } from "./publication-bounds";
+import { ingestionSignalsRouter } from "./signals";
+
+const app = new OpenAPIHono();
+
+app.route("/articles", articleIngestionRouter);
+app.route("/signals", ingestionSignalsRouter);
+app.route("/sources/publication-bounds", publicationBoundsRouter);
+
+export const ingestionRouter = app;

apps/api/src/rest/routers/ingestion/publication-bounds.ts

@@ -0,0 +1,58 @@
+import { getEarliestPublished, getLatestPublished } from "@basango/db/queries";
+import {
+  getSourcePublicationBoundsResponseSchema,
+  getSourcePublicationBoundsSchema,
+} from "@basango/domain/models";
+import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+
+import type { Context } from "#api/rest/init";
+import { withDatabase } from "#api/rest/middlewares/db";
+import { withIngestionAuth } from "#api/rest/middlewares/ingestion";
+import { validateResponse } from "#api/utils/response";
+
+const app = new OpenAPIHono<Context>();
+
+app.openapi(
+  createRoute({
+    description: "Get the current publication boundaries for one source.",
+    method: "post",
+    middleware: [withIngestionAuth, withDatabase],
+    operationId: "GetSourcePublicationBounds",
+    path: "/",
+    request: {
+      body: {
+        content: {
+          "application/json": {
+            schema: getSourcePublicationBoundsSchema,
+          },
+        },
+      },
+    },
+    responses: {
+      200: {
+        content: {
+          "application/json": {
+            schema: getSourcePublicationBoundsResponseSchema,
+          },
+        },
+        description: "Publication boundaries retrieved",
+      },
+    },
+    summary: "Get source publication boundaries",
+    tags: ["Ingestion"],
+  }),
+  async (c) => {
+    const { name } = c.req.valid("json");
+    const [latest, earliest] = await Promise.all([
+      getLatestPublished(c.get("db"), name),
+      getEarliestPublished(c.get("db"), name),
+    ]);
+
+    return c.json(
+      validateResponse({ earliest, latest }, getSourcePublicationBoundsResponseSchema),
+      200,
+    );
+  },
+);
+
+export const publicationBoundsRouter = app;

apps/api/src/rest/routers/ingestion/signals.ts

@@ -0,0 +1,53 @@
+import { ingestionSignalAcceptedSchema, ingestionSignalSchema } from "@basango/domain/models";
+import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+
+import type { Context } from "#api/rest/init";
+import { withDatabase } from "#api/rest/middlewares/db";
+import { withIngestionAuth } from "#api/rest/middlewares/ingestion";
+import { acceptIngestionSignal } from "#api/services/ingestion/signals";
+import { validateResponse } from "#api/utils/response";
+
+const app = new OpenAPIHono<Context>();
+
+app.openapi(
+  createRoute({
+    description: "Project an idempotent ingestion lifecycle signal into the operations read model.",
+    method: "post",
+    middleware: [withIngestionAuth, withDatabase],
+    operationId: "AcceptIngestionSignal",
+    path: "/",
+    request: {
+      body: {
+        content: {
+          "application/json": {
+            schema: ingestionSignalSchema,
+          },
+        },
+      },
+    },
+    responses: {
+      202: {
+        content: {
+          "application/json": {
+            schema: ingestionSignalAcceptedSchema,
+          },
+        },
+        description: "Signal accepted",
+      },
+    },
+    summary: "Accept ingestion signal",
+    tags: ["Ingestion"],
+  }),
+  async (c) => {
+    const result = await acceptIngestionSignal(c.get("db"), c.req.valid("json"));
+    return c.json(
+      validateResponse(
+        { accepted: true as const, duplicate: result.duplicate },
+        ingestionSignalAcceptedSchema,
+      ),
+      202,
+    );
+  },
+);
+
+export const ingestionSignalsRouter = app;

apps/api/src/rest/routers/operations/index.ts

@@ -0,0 +1,8 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+
+import { ingestionOperationsRouter } from "./ingestion";
+
+const app = new OpenAPIHono();
+app.route("/ingestion", ingestionOperationsRouter);
+
+export const operationsRouter = app;

apps/api/src/rest/routers/operations/ingestion.ts

@@ -0,0 +1,57 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { streamSSE } from "hono/streaming";
+
+import type { Context } from "#api/rest/init";
+import { withAdminSession } from "#api/rest/middlewares/session";
+import { subscribeToIngestionChanges } from "#api/services/ingestion/signals";
+
+const app = new OpenAPIHono<Context>();
+
+app.get("/stream", withAdminSession, (c) =>
+  streamSSE(c, async (stream) => {
+    const pending: string[] = [];
+    let closed = false;
+    let wake: () => void = () => undefined;
+    let signal = new Promise<void>((resolve) => {
+      wake = resolve;
+    });
+    const unsubscribe = subscribeToIngestionChanges((signalId) => {
+      pending.push(signalId);
+      wake();
+    });
+
+    stream.onAbort(() => {
+      closed = true;
+      unsubscribe();
+      wake();
+    });
+
+    try {
+      await stream.writeSSE({ data: "connected", event: "ready" });
+
+      while (!closed) {
+        await Promise.race([signal, stream.sleep(15_000)]);
+        signal = new Promise<void>((resolve) => {
+          wake = resolve;
+        });
+
+        if (pending.length === 0) {
+          await stream.writeSSE({ data: new Date().toISOString(), event: "heartbeat" });
+          continue;
+        }
+
+        for (const signalId of pending.splice(0)) {
+          await stream.writeSSE({
+            data: signalId,
+            event: "ingestion-update",
+            id: signalId,
+          });
+        }
+      }
+    } finally {
+      unsubscribe();
+    }
+  }),
+);
+
+export const ingestionOperationsRouter = app;

apps/api/src/rest/routers/sources.ts

@@ -1,58 +0,0 @@
-import { getEarliestPublished, getLatestPublished } from "@basango/db/queries";
-import {
-  getSourceUpdateDatesResponseSchema,
-  getSourceUpdateDatesSchema,
-} from "@basango/domain/models";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
-
-import type { Context } from "#api/rest/init";
-import { withCrawlerAuth } from "#api/rest/middlewares/crawler";
-import { withDatabase } from "#api/rest/middlewares/db";
-import { validateResponse } from "#api/utils/response";
-
-const app = new OpenAPIHono<Context>();
-
-app.openapi(
-  createRoute({
-    description: "Get the latest and earliest published dates for articles from a specific source.",
-    method: "post",
-    middleware: [withCrawlerAuth, withDatabase],
-    operationId: "GetSourceUpdateDates",
-    path: "/update-dates",
-    request: {
-      body: {
-        content: {
-          "application/json": {
-            schema: getSourceUpdateDatesSchema,
-          },
-        },
-      },
-    },
-    responses: {
-      200: {
-        content: {
-          "application/json": {
-            schema: getSourceUpdateDatesResponseSchema,
-          },
-        },
-        description: "Source update dates retrieved",
-      },
-    },
-    summary: "Get Source Update Dates",
-    tags: ["Sources"],
-    "x-speakeasy-name-override": "getSourceUpdateDates",
-  }),
-  async (c) => {
-    const db = c.get("db");
-    const input = c.req.valid("json");
-
-    const [latest, earliest] = await Promise.all([
-      getLatestPublished(db, input.name),
-      getEarliestPublished(db, input.name),
-    ]);
-
-    return c.json(validateResponse({ earliest, latest }, getSourceUpdateDatesResponseSchema), 200);
-  },
-);
-
-export const sourcesRouter = app;

apps/api/src/scripts/create-admin.ts

@@ -0,0 +1,25 @@
+import { env } from "@basango/domain/config";
+import { logger } from "@basango/logger";
+
+import { auth } from "#api/auth";
+
+const email = env.BASANGO_ADMIN_EMAIL?.trim();
+const name = env.BASANGO_ADMIN_NAME?.trim();
+const password = env.BASANGO_ADMIN_PASSWORD;
+
+if (!email || !name || !password) {
+  throw new Error(
+    "BASANGO_ADMIN_EMAIL, BASANGO_ADMIN_NAME, and BASANGO_ADMIN_PASSWORD are required.",
+  );
+}
+
+const result = await auth.api.createUser({
+  body: {
+    email,
+    name,
+    password,
+    role: "admin",
+  },
+});
+
+logger.info({ email: result.user.email, userId: result.user.id }, "Created Better Auth admin");

apps/api/src/services/ingestion/signals.ts

@@ -0,0 +1,20 @@
+import type { Database } from "@basango/db/client";
+import { applyIngestionSignal } from "@basango/db/queries";
+import type { IngestionSignal } from "@basango/domain/models";
+
+type ChangeListener = (signalId: string) => void;
+
+const listeners = new Set<ChangeListener>();
+
+export async function acceptIngestionSignal(db: Database, signal: IngestionSignal) {
+  const result = await applyIngestionSignal(db, signal);
+  if (!result.duplicate) {
+    for (const listener of listeners) listener(signal.signalId);
+  }
+  return result;
+}
+
+export function subscribeToIngestionChanges(listener: ChangeListener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}

apps/api/src/trpc/init.ts

@@ -1,22 +1,20 @@
-import { Database, db } from "@basango/db/client";
+import { type Database, db } from "@basango/db/client";
 import { TRPCError, initTRPC } from "@trpc/server";
 import type { Context } from "hono";
 import superjson from "superjson";
 
-import { withAuthentication } from "#api/trpc/middlewares/auth";
+import { type AuthSession, auth, isAdmin } from "#api/auth";
 import { withDatabase } from "#api/trpc/middlewares/db";
-import { Session, getSession } from "#api/utils/auth";
 import { getGeoContext } from "#api/utils/geo";
 
 type TRPCContext = {
-  session: Session | null;
+  session: AuthSession | null;
   db: Database;
   geo: ReturnType<typeof getGeoContext>;
 };
 
 export const createTRPCContext = async (_: unknown, c: Context): Promise<TRPCContext> => {
-  const accessToken = c.req.header("Authorization")?.split(" ")[1];
-  const session = await getSession(db, accessToken);
+  const session = await auth.api.getSession({ headers: c.req.raw.headers });
   const geo = getGeoContext(c.req);
 
   return {
@@ -40,28 +38,26 @@ const withDatabaseMiddleware = t.middleware(async (opts) => {
   });
 });
 
-const withAutenticationMiddleware = t.middleware(async (opts) => {
-  return withAuthentication({
-    ctx: opts.ctx,
-    next: opts.next,
+export const publicProcedure = t.procedure.use(withDatabaseMiddleware);
+
+export const protectedProcedure = t.procedure.use(withDatabaseMiddleware).use(async (opts) => {
+  const { session } = opts.ctx;
+
+  if (!session) {
+    throw new TRPCError({ code: "UNAUTHORIZED" });
+  }
+
+  return opts.next({
+    ctx: {
+      session,
+    },
   });
 });
 
-export const publicProcedure = t.procedure.use(withDatabaseMiddleware);
+export const adminProcedure = protectedProcedure.use(async (opts) => {
+  if (!isAdmin(opts.ctx.session)) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "Administrator access is required." });
+  }
 
-export const protectedProcedure = t.procedure
-  .use(withDatabaseMiddleware)
-  .use(withAutenticationMiddleware)
-  .use(async (opts) => {
-    const { session } = opts.ctx;
-
-    if (!session) {
-      throw new TRPCError({ code: "UNAUTHORIZED" });
-    }
-
-    return opts.next({
-      ctx: {
-        session,
-      },
-    });
-  });
+  return opts.next();
+});

apps/api/src/trpc/middlewares/auth.ts

@@ -1,33 +0,0 @@
-import type { Database } from "@basango/db/client";
-import { TRPCError } from "@trpc/server";
-
-import type { Session } from "#api/utils/auth";
-
-export const withAuthentication = async <TReturn>(opts: {
-  ctx: {
-    session?: Session | null;
-    db: Database;
-  };
-  next: (opts: {
-    ctx: {
-      session?: Session | null;
-      db: Database;
-    };
-  }) => Promise<TReturn>;
-}) => {
-  const { ctx, next } = opts;
-
-  if (!ctx.session) {
-    throw new TRPCError({
-      code: "UNAUTHORIZED",
-      message: "Authentication is required to access this resource.",
-    });
-  }
-
-  return next({
-    ctx: {
-      db: ctx.db,
-      session: ctx.session,
-    },
-  });
-};

apps/api/src/trpc/middlewares/db.ts

@@ -1,15 +1,15 @@
 import { type Database, db } from "@basango/db/client";
 
-import type { Session } from "#api/utils/auth";
+import type { AuthSession } from "#api/auth";
 
 export const withDatabase = async <TReturn>(opts: {
   ctx: {
-    session?: Session | null;
+    session?: AuthSession | null;
     db: Database;
   };
   next: (opts: {
     ctx: {
-      session?: Session | null;
+      session?: AuthSession | null;
       db: Database;
     };
   }) => Promise<TReturn>;

apps/api/src/trpc/routers/_app.ts

@@ -2,15 +2,15 @@ import type { inferRouterInputs, inferRouterOutputs } from "@trpc/server";
 
 import { createTRPCRouter } from "#api/trpc/init";
 import { articlesRouter } from "#api/trpc/routers/articles";
-import { authRouter } from "#api/trpc/routers/auth";
 import { categoriesRouter } from "#api/trpc/routers/categories";
+import { operationsRouter } from "#api/trpc/routers/operations";
 import { reportsRouter } from "#api/trpc/routers/reports";
 import { sourcesRouter } from "#api/trpc/routers/sources";
 
 export const appRouter = createTRPCRouter({
   articles: articlesRouter,
-  auth: authRouter,
   categories: categoriesRouter,
+  operations: operationsRouter,
   reports: reportsRouter,
   sources: sourcesRouter,
 });

apps/api/src/trpc/routers/articles.ts

@@ -1,34 +1,40 @@
 import {
   createArticle,
+  getArticleById,
   getArticles,
   getArticlesPublicationGraph,
   getArticlesSourceDistribution,
 } from "@basango/db/queries";
 import {
   createArticleSchema,
+  getArticleSchema,
   getArticlesSchema,
   getDistributionsSchema,
   getPublicationsSchema,
 } from "@basango/domain/models";
 
-import { createTRPCRouter, protectedProcedure } from "#api/trpc/init";
+import { adminProcedure, createTRPCRouter } from "#api/trpc/init";
 
 export const articlesRouter = createTRPCRouter({
-  create: protectedProcedure.input(createArticleSchema).mutation(async ({ ctx, input }) => {
+  create: adminProcedure.input(createArticleSchema).mutation(async ({ ctx, input }) => {
     return createArticle(ctx.db, input);
   }),
 
-  getPublications: protectedProcedure.input(getPublicationsSchema).query(async ({ ctx, input }) => {
+  getById: adminProcedure.input(getArticleSchema).query(async ({ ctx, input }) => {
+    return getArticleById(ctx.db, input.id);
+  }),
+
+  getPublications: adminProcedure.input(getPublicationsSchema).query(async ({ ctx, input }) => {
     return getArticlesPublicationGraph(ctx.db, input);
   }),
 
-  getSourceDistribution: protectedProcedure
+  getSourceDistribution: adminProcedure
     .input(getDistributionsSchema)
     .query(async ({ ctx, input }) => {
       return getArticlesSourceDistribution(ctx.db, input);
     }),
 
-  list: protectedProcedure.input(getArticlesSchema).query(async ({ ctx, input }) => {
+  list: adminProcedure.input(getArticlesSchema).query(async ({ ctx, input }) => {
     return getArticles(ctx.db, input);
   }),
 });

apps/api/src/trpc/routers/auth.ts

@@ -1,86 +0,0 @@
-import { getUserByEmail, getUserById } from "@basango/db/queries";
-import { loginSchema, refreshSessionSchema } from "@basango/domain/models";
-import { verifyPassword } from "@basango/encryption";
-import { TRPCError } from "@trpc/server";
-
-import { createTRPCRouter, protectedProcedure, publicProcedure } from "#api/trpc/init";
-import { createSessionTokens, verifyRefreshToken } from "#api/utils/auth";
-
-export const authRouter = createTRPCRouter({
-  login: publicProcedure.input(loginSchema).mutation(async ({ ctx, input }) => {
-    const user = await getUserByEmail(ctx.db, input.email);
-
-    if (!user || user.isLocked) {
-      throw new TRPCError({
-        code: "UNAUTHORIZED",
-        message: "Account is locked",
-      });
-    }
-
-    const isValidPassword = await verifyPassword(input.password, user.password);
-
-    if (!isValidPassword) {
-      throw new TRPCError({
-        code: "UNAUTHORIZED",
-        message: "Invalid credentials.",
-      });
-    }
-
-    const session = {
-      user: {
-        email: user.email,
-        id: user.id,
-        name: user.name,
-      },
-    };
-
-    const tokens = await createSessionTokens(session);
-
-    return {
-      ...tokens,
-      user: session.user,
-    };
-  }),
-
-  refresh: publicProcedure.input(refreshSessionSchema).mutation(async ({ ctx, input }) => {
-    const session = await verifyRefreshToken(input.refreshToken);
-
-    if (!session) {
-      throw new TRPCError({
-        code: "UNAUTHORIZED",
-        message: "Invalid refresh token.",
-      });
-    }
-
-    const user = await getUserById(ctx.db, {
-      email: session.user.email,
-      id: session.user.id,
-    });
-
-    if (!user || user.isLocked) {
-      throw new TRPCError({
-        code: "UNAUTHORIZED",
-        message: "Invalid refresh token.",
-      });
-    }
-
-    const tokens = await createSessionTokens({
-      user: {
-        email: user.email,
-        id: user.id,
-        name: user.name,
-      },
-    });
-
-    return {
-      ...tokens,
-      user: {
-        email: user.email,
-        id: user.id,
-        name: user.name,
-      },
-    };
-  }),
-
-  session: protectedProcedure.query(({ ctx }) => ctx.session.user),
-});

apps/api/src/trpc/routers/categories.ts

@@ -1,7 +1,7 @@
 import { getCategories } from "@basango/db/queries";
 
-import { createTRPCRouter, protectedProcedure } from "#api/trpc/init";
+import { adminProcedure, createTRPCRouter } from "#api/trpc/init";
 
 export const categoriesRouter = createTRPCRouter({
-  list: protectedProcedure.query(async ({ ctx }) => getCategories(ctx.db)),
+  list: adminProcedure.query(async ({ ctx }) => getCategories(ctx.db)),
 });

apps/api/src/trpc/routers/operations.ts

@@ -0,0 +1,11 @@
+import { getIngestionOverview, listIngestionRuns } from "@basango/db/queries";
+import { ingestionRunsQuerySchema } from "@basango/domain/models";
+
+import { adminProcedure, createTRPCRouter } from "#api/trpc/init";
+
+export const operationsRouter = createTRPCRouter({
+  getIngestionOverview: adminProcedure.query(({ ctx }) => getIngestionOverview(ctx.db)),
+  listIngestionRuns: adminProcedure
+    .input(ingestionRunsQuerySchema)
+    .query(({ ctx, input }) => listIngestionRuns(ctx.db, input)),
+});

apps/api/src/trpc/routers/reports.ts

@@ -1,9 +1,9 @@
 import { getDashboardOverview } from "@basango/db/queries";
 
-import { createTRPCRouter, protectedProcedure } from "#api/trpc/init";
+import { adminProcedure, createTRPCRouter } from "#api/trpc/init";
 
 export const reportsRouter = createTRPCRouter({
-  getDashboardOverview: protectedProcedure.query(async ({ ctx }) => {
+  getDashboardOverview: adminProcedure.query(async ({ ctx }) => {
     return getDashboardOverview(ctx.db);
   }),
 });

apps/api/src/trpc/routers/sources.ts

@@ -14,30 +14,28 @@ import {
   updateSourceSchema,
 } from "@basango/domain/models";
 
-import { createTRPCRouter, protectedProcedure } from "#api/trpc/init";
+import { adminProcedure, createTRPCRouter } from "#api/trpc/init";
 
 export const sourcesRouter = createTRPCRouter({
-  create: protectedProcedure.input(createSourceSchema).mutation(async ({ ctx, input }) => {
+  create: adminProcedure.input(createSourceSchema).mutation(async ({ ctx, input }) => {
     return createSource(ctx.db, input);
   }),
 
-  getById: protectedProcedure.input(getSourceSchema).query(async ({ ctx, input }) => {
+  getById: adminProcedure.input(getSourceSchema).query(async ({ ctx, input }) => {
     return getSourceById(ctx.db, input.id);
   }),
 
-  getCategoryShares: protectedProcedure
-    .input(getCategorySharesSchema)
-    .query(async ({ ctx, input }) => {
-      return getSourceCategoryShares(ctx.db, input);
-    }),
+  getCategoryShares: adminProcedure.input(getCategorySharesSchema).query(async ({ ctx, input }) => {
+    return getSourceCategoryShares(ctx.db, input);
+  }),
 
-  getPublications: protectedProcedure.input(getPublicationsSchema).query(async ({ ctx, input }) => {
+  getPublications: adminProcedure.input(getPublicationsSchema).query(async ({ ctx, input }) => {
     return getSourcePublicationGraph(ctx.db, input);
   }),
 
-  list: protectedProcedure.query(async ({ ctx }) => getSources(ctx.db)),
+  list: adminProcedure.query(async ({ ctx }) => getSources(ctx.db)),
 
-  update: protectedProcedure.input(updateSourceSchema).mutation(async ({ ctx, input }) => {
+  update: adminProcedure.input(updateSourceSchema).mutation(async ({ ctx, input }) => {
     return updateSource(ctx.db, input);
   }),
 });

apps/api/src/utils/auth.ts

@@ -1,150 +0,0 @@
-import { Database } from "@basango/db/client";
-import { getUserById } from "@basango/db/queries";
-import { config } from "@basango/domain/config";
-import { type JWTPayload, SignJWT, jwtVerify } from "jose";
-
-export type Session = {
-  user: {
-    id: string;
-    email: string;
-    name?: string;
-  };
-};
-
-export type VerifiedJWTPayload = JWTPayload & {
-  tokenType: TokenType;
-  user: {
-    id: string;
-    email: string;
-    name?: string;
-  };
-};
-
-type TokenType = "access" | "refresh";
-
-export type SessionTokens = {
-  accessToken: string;
-  refreshToken: string;
-  accessTokenExpiresAt: string;
-  refreshTokenExpiresAt: string;
-};
-
-const encoder = new TextEncoder();
-
-function getSecretKey() {
-  return encoder.encode(config.api.security.jwtSecret);
-}
-
-export async function getSession(db: Database, accessToken?: string): Promise<Session | null> {
-  const session = await verifyAccessToken(accessToken);
-
-  if (!session) {
-    return null;
-  }
-
-  const user = await getUserById(db, {
-    email: session.user.email,
-    id: session.user.id,
-  });
-
-  if (!user || user.isLocked) {
-    return null;
-  }
-
-  return {
-    user: {
-      email: user.email,
-      id: user.id,
-      name: user.name,
-    },
-  };
-}
-
-async function createToken(session: Session, tokenType: TokenType, expiresIn: string) {
-  return new SignJWT({
-    tokenType,
-    user: session.user,
-  })
-    .setProtectedHeader({ alg: "HS256" })
-    .setIssuedAt()
-    .setAudience(config.api.security.audience)
-    .setIssuer(config.api.security.issuer)
-    .setExpirationTime(expiresIn)
-    .sign(getSecretKey());
-}
-
-export async function createSessionTokens(session: Session): Promise<SessionTokens> {
-  const [accessToken, refreshToken] = await Promise.all([
-    createToken(session, "access", config.api.security.accessTokenTtl),
-    createToken(session, "refresh", config.api.security.refreshTokenTtl),
-  ]);
-
-  const issuedAt = Date.now();
-  const accessTokenExpiresAt = new Date(
-    issuedAt + formatTTL(config.api.security.accessTokenTtl),
-  ).toISOString();
-  const refreshTokenExpiresAt = new Date(
-    issuedAt + formatTTL(config.api.security.refreshTokenTtl),
-  ).toISOString();
-
-  return {
-    accessToken,
-    accessTokenExpiresAt,
-    refreshToken,
-    refreshTokenExpiresAt,
-  };
-}
-
-export async function verifyAccessToken(accessToken?: string): Promise<Session | null> {
-  return verifyToken(accessToken, "access");
-}
-
-export async function verifyRefreshToken(refreshToken?: string): Promise<Session | null> {
-  return verifyToken(refreshToken, "refresh");
-}
-
-async function verifyToken(
-  token: string | undefined,
-  expectedType: TokenType,
-): Promise<Session | null> {
-  if (!token) return null;
-
-  try {
-    const { payload } = await jwtVerify<VerifiedJWTPayload>(token, getSecretKey(), {
-      audience: config.api.security.audience,
-      issuer: config.api.security.issuer,
-    });
-
-    if (payload.tokenType !== expectedType) {
-      return null;
-    }
-
-    return {
-      user: {
-        email: payload.user.email,
-        id: payload.user.id,
-        name: payload.user.name,
-      },
-    };
-  } catch (_error: unknown) {
-    return null;
-  }
-}
-
-function formatTTL(ttl: string) {
-  const match = ttl.match(/^(\d+)([smhd])$/);
-  if (!match) return 0;
-  const [, rawValue, rawUnit] = match;
-  if (!rawValue || !rawUnit) {
-    return 0;
-  }
-  const value = Number.parseInt(rawValue, 10);
-  const multipliers = {
-    d: 86_400_000,
-    h: 3_600_000,
-    m: 60_000,
-    s: 1_000,
-  } as const;
-  const unit = rawUnit as keyof typeof multipliers;
-  return value * (multipliers[unit] ?? 1_000);
-}

apps/api/src/utils/password-reset-email.ts

@@ -0,0 +1,61 @@
+import { env } from "@basango/domain/config";
+import { logger } from "@basango/logger";
+
+type PasswordResetEmail = {
+  email: string;
+  name: string;
+  token: string;
+  url: string;
+};
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>'"]/g, (character) => {
+    const entities: Record<string, string> = {
+      "'": "&#039;",
+      '"': "&quot;",
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+    };
+    return entities[character] ?? character;
+  });
+}
+
+export async function sendPasswordResetEmail(input: PasswordResetEmail): Promise<void> {
+  const apiKey = env.BASANGO_RESEND_API_KEY?.trim();
+
+  if (!apiKey) {
+    if (env.NODE_ENV === "production") {
+      throw new Error("BASANGO_RESEND_API_KEY is required to send password reset emails.");
+    }
+
+    logger.info(
+      { email: input.email, resetUrl: input.url },
+      "Password reset email delivery is disabled; use this development reset URL",
+    );
+    return;
+  }
+
+  const safeName = escapeHtml(input.name);
+  const safeResetUrl = escapeHtml(input.url);
+  const response = await fetch("https://api.resend.com/emails", {
+    body: JSON.stringify({
+      from: env.BASANGO_RESEND_FROM_EMAIL ?? "Basango <noreply@basango.io>",
+      html: `<p>Hello ${safeName},</p><p>Use the link below to reset your Basango password. This link expires in 30 minutes and can only be used once.</p><p><a href="${safeResetUrl}">Reset your password</a></p><p>If you did not request this, you can safely ignore this email.</p>`,
+      subject: "Reset your Basango password",
+      text: `Hello ${input.name},\n\nReset your Basango password using this link:\n${input.url}\n\nThis link expires in 30 minutes and can only be used once. If you did not request this, you can safely ignore this email.`,
+      to: [input.email],
+    }),
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json",
+      "Idempotency-Key": `password-reset/${input.token}`,
+    },
+    method: "POST",
+  });
+
+  if (!response.ok) {
+    const responseBody = await response.text();
+    throw new Error(`Password reset email delivery failed (${response.status}): ${responseBody}`);
+  }
+}

apps/crawler/.gitignore

@@ -1 +0,0 @@
-/data/

apps/crawler/README.md

@@ -1,155 +0,0 @@
-# @basango/crawler
-
-A powerful, scalable web crawler application built with Node.js and TypeScript for extracting and processing data from various news sources and websites.
-
-The Basango Crawler is designed to systematically crawl news websites and extract article content. It supports both synchronous and asynchronous crawling modes, with configurable sources, queue-based processing, and robust error handling.
-
-## Features
-
-- **Multi-mode Operation**: Synchronous and asynchronous crawling capabilities
-- **Queue-based Processing**: Uses BullMQ with Redis for scalable job processing
-- **Configurable Sources**: JSON-based configuration for different website sources
-- **HTML & WordPress Support**: Built-in parsers for HTML websites and WordPress APIs
-- **Rate Limiting**: Respects website rate limits and implements backoff strategies
-- **Data Persistence**: SQLite outbox for processed articles and retryable forwarding
-- **Worker Management**: Distributed worker system for parallel processing
-- **Type Safety**: Full TypeScript implementation with Zod schema validation
-
-## Prerequisites
-
-- [Bun](https://bun.sh/) runtime (recommended) or Node.js (v22+)
-- Redis server (for async operations)
-- TypeScript knowledge for configuration
-
-## Installation
-
-```bash
-# Navigate to the crawler directory
-cd basango/apps/crawler
-
-# Install dependencies
-bun install
-```
-
-## Configuration
-
-### 1. Environment Variables
-
-Create a `.env.local` file with the following variables:
-
-```bash
-# Redis configuration for async operations
-BASANGO_CRAWLER_ASYNC_REDIS_URL=redis://localhost:6379/0
-BASANGO_CRAWLER_ASYNC_QUEUE_LISTING=listing
-BASANGO_CRAWLER_ASYNC_QUEUE_DETAILS=details
-BASANGO_CRAWLER_ASYNC_QUEUE_PROCESSING=processing
-
-# Fetch configuration
-BASANGO_CRAWLER_FETCH_MAX_RETRIES=3
-BASANGO_CRAWLER_FETCH_RESPECT_RETRY_AFTER=true
-BASANGO_CRAWLER_FETCH_USER_AGENT=Basango/0.1 (+https://github.com/bernard-ng/basango)
-
-# Crawler behavior
-BASANGO_CRAWLER_UPDATE_DIRECTION=forward
-BASANGO_CRAWLER_SQLITE_PATH=/var/lib/basango-crawler/crawler.db
-
-# TTL settings (in seconds)
-BASANGO_CRAWLER_ASYNC_TTL_FAILURE=3600
-BASANGO_CRAWLER_ASYNC_TTL_RESULT=3600
-```
-
-### 2. Source Configuration
-
-Sources are configured in `config/sources.json`. Example source configuration:
-
-```json
-{
-  "sources": {
-    "html": [
-      {
-        "sourceId": "example.com",
-        "sourceKind": "html",
-        "sourceUrl": "https://example.com",
-        "sourceSelectors": {
-          "articles": ".article-list .article",
-          "articleTitle": "h2.title",
-          "articleLink": "a.permalink",
-          "articleDate": ".publish-date",
-          "articleBody": ".content",
-          "pagination": ".pagination .next"
-        },
-        "requiresDetails": true,
-        "supportsCategories": false
-      }
-    ]
-  }
-}
-```
-
-## Usage
-
-### Synchronous Crawling
-
-Perfect for immediate, one-time crawling tasks:
-
-```bash
-# Crawl a specific source
-bun run crawler:sync -- --sourceId radiookapi.net
-
-# Crawl with page range filter
-bun run crawler:sync -- --sourceId radiookapi.net --pageRange 1:5
-
-# Crawl with date range filter
-bun run crawler:sync -- --sourceId radiookapi.net --dateRange 2024-01-01:2024-01-31
-
-# Crawl specific category (if supported)
-bun run crawler:sync -- --sourceId example.com --category politics
-```
-
-Crawled articles are saved in the local SQLite outbox and forwarded to the backend. Pending
-or failed articles can be retried with `bun run crawler:push -- --sourceId radiookapi.net`.
-
-
-### Asynchronous Crawling
-
-Best for large-scale operations and when you need job queuing:
-
-```bash
-# Schedule an async crawl job
-bun run crawler:async -- --sourceId radiookapi.net
-
-# Schedule with filters
-bun run crawler:async -- --sourceId radiookapi.net --pageRange 1:10 --category economics
-```
-
-### Worker Management
-
-Start workers to process async jobs:
-
-```bash
-# Start workers for all queues
-bun run crawler:worker
-
-# Start workers for specific queues
-bun run crawler:worker -- --queue listing --queue details
-
-# Start workers with short option
-bun run crawler:worker -- -q listing -q processing
-```
-
-## CLI Options
-
-### Crawling Commands
-
-| Option | Description | Example |
-|--------|-------------|---------|
-| `--sourceId` | **Required.** Source identifier from sources.json | `--sourceId radiookapi.net` |
-| `--pageRange` | Page range to crawl (format: start:end) | `--pageRange 1:5` |
-| `--dateRange` | Date range filter (format: YYYY-MM-DD:YYYY-MM-DD) | `--dateRange 2024-01-01:2024-01-31` |
-| `--category` | Category slug to crawl | `--category politics` |
-
-### Worker Commands
-
-| Option | Description | Example |
-|--------|-------------|---------|
-| `--queue`, `-q` | Specify queue(s) to process (can be used multiple times) | `--queue listing --queue details` |

apps/crawler/deploy/.env.example

@@ -1,29 +0,0 @@
-NODE_ENV=production
-BASANGO_LOGGER_LEVEL=info
-BASANGO_LOGGER_PRETTY=false
-
-# Basango API used by crawler workers to read update windows and forward articles.
-BASANGO_API_CRAWLER_ENDPOINT=https://api.example.com
-BASANGO_API_CRAWLER_TOKEN=change-me
-
-# Central Redis shared by scheduler and worker instances.
-BASANGO_CRAWLER_ASYNC_REDIS_URL=redis://redis.example.com:6379/0
-BASANGO_CRAWLER_ASYNC_QUEUE_LISTING=listing
-BASANGO_CRAWLER_ASYNC_QUEUE_DETAILS=details
-BASANGO_CRAWLER_ASYNC_QUEUE_PROCESSING=processing
-BASANGO_CRAWLER_ASYNC_TTL_FAILURE=3600
-BASANGO_CRAWLER_ASYNC_TTL_RESULT=3600
-
-# Comma-separated source shard assigned to this machine.
-BASANGO_CRAWLER_SOURCE_IDS=radiookapi.net,7sur7.cd
-
-# Local data written by sync/push workflows. SQLite path defaults to <data>/crawler.db.
-BASANGO_CRAWLER_ROOT_PATH=/opt/basango-crawler
-BASANGO_CRAWLER_DATA_PATH=/var/lib/basango-crawler
-BASANGO_CRAWLER_SQLITE_PATH=/var/lib/basango-crawler/crawler.db
-
-# Fetch behavior.
-BASANGO_CRAWLER_UPDATE_DIRECTION=forward
-BASANGO_CRAWLER_FETCH_MAX_RETRIES=3
-BASANGO_CRAWLER_FETCH_RESPECT_RETRY_AFTER=true
-BASANGO_CRAWLER_FETCH_USER_AGENT=Basango/0.1 (+https://github.com/bernard-ng/basango)

apps/crawler/deploy/README.md

@@ -1,56 +0,0 @@
-# Basango Crawler Binary Deployment
-
-This deployment runs one standalone `basango-crawler` binary with external `.env` config.
-Crawler results are stored in a local SQLite outbox at `BASANGO_CRAWLER_SQLITE_PATH`
-and forwarded to the shared Basango API.
-
-## Build
-
-```bash
-bun run build:crawler:arm64
-bun run build:crawler:x64
-```
-
-Use `dist/crawler/basango-crawler-linux-arm64` for 64-bit Raspberry Pi 4B/ARM Ubuntu, and `dist/crawler/basango-crawler-linux-x64` for x64 Ubuntu.
-
-## Install On A Node
-
-```bash
-sudo useradd --system --home /opt/basango-crawler --shell /usr/sbin/nologin basango
-sudo mkdir -p /opt/basango-crawler /var/lib/basango-crawler
-sudo cp basango-crawler-linux-arm64 /opt/basango-crawler/basango-crawler
-sudo cp .env /opt/basango-crawler/.env
-sudo chown -R basango:basango /opt/basango-crawler /var/lib/basango-crawler
-sudo chmod 0755 /opt/basango-crawler/basango-crawler
-sudo chmod 0640 /opt/basango-crawler/.env
-```
-
-Copy the systemd files:
-
-```bash
-sudo cp basango-crawler-worker.service /etc/systemd/system/
-sudo cp basango-crawler-schedule.service /etc/systemd/system/
-sudo cp basango-crawler-schedule.timer /etc/systemd/system/
-sudo systemctl daemon-reload
-sudo systemctl enable --now basango-crawler-worker.service
-sudo systemctl enable --now basango-crawler-schedule.timer
-```
-
-## Configure Shards
-
-Set a different source list per node:
-
-```bash
-BASANGO_CRAWLER_SOURCE_IDS=radiookapi.net,7sur7.cd
-```
-
-The scheduler reads this list when `basango-crawler schedule` runs. Repeated `--sourceId` flags override the env shard for manual runs.
-
-## Operate
-
-```bash
-sudo journalctl -u basango-crawler-worker -f
-sudo journalctl -u basango-crawler-schedule -n 100
-sudo systemctl list-timers basango-crawler-schedule.timer
-/opt/basango-crawler/basango-crawler push --limit 100
-```

apps/crawler/deploy/basango-crawler-schedule.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Schedule Basango crawler jobs for this node
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-WorkingDirectory=/opt/basango-crawler
-EnvironmentFile=/opt/basango-crawler/.env
-ExecStart=/opt/basango-crawler/basango-crawler schedule
-User=basango
-Group=basango
-StateDirectory=basango-crawler

apps/crawler/deploy/basango-crawler-schedule.timer

@@ -1,12 +0,0 @@
-[Unit]
-Description=Run Basango crawler scheduler periodically
-
-[Timer]
-OnBootSec=2min
-OnUnitActiveSec=30min
-RandomizedDelaySec=5min
-Persistent=true
-Unit=basango-crawler-schedule.service
-
-[Install]
-WantedBy=timers.target

apps/crawler/deploy/basango-crawler-worker.service

@@ -1,18 +0,0 @@
-[Unit]
-Description=Basango crawler worker
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/basango-crawler
-EnvironmentFile=/opt/basango-crawler/.env
-ExecStart=/opt/basango-crawler/basango-crawler worker --queue listing --queue details
-Restart=always
-RestartSec=10
-User=basango
-Group=basango
-StateDirectory=basango-crawler
-
-[Install]
-WantedBy=multi-user.target

apps/crawler/package.json

@@ -1,34 +0,0 @@
-{
-  "dependencies": {
-    "@basango/domain": "workspace:*",
-    "@basango/encryption": "workspace:*",
-    "@basango/logger": "workspace:*",
-    "bullmq": "^4.18.3",
-    "date-fns": "catalog:",
-    "ioredis": "^5.8.2",
-    "node-html-parser": "^7.0.1",
-    "turndown": "^7.2.2",
-    "zod": "catalog:"
-  },
-  "devDependencies": {
-    "@types/turndown": "^5.0.6"
-  },
-  "imports": {
-    "#crawler/*": "./src/*"
-  },
-  "name": "@basango/crawler",
-  "private": true,
-  "scripts": {
-    "build:binary": "bun run build:binary:arm64 && bun run build:binary:x64",
-    "build:binary:arm64": "bun build --compile --define BASANGO_CRAWLER_BINARY=true --external pino --target=bun-linux-arm64 src/cli.ts ../../node_modules/bullmq/dist/cjs/commands/*.lua ../../node_modules/bullmq/dist/cjs/commands/includes/*.lua --outfile ../../dist/crawler/basango-crawler-linux-arm64",
-    "build:binary:x64": "bun build --compile --define BASANGO_CRAWLER_BINARY=true --external pino --target=bun-linux-x64 src/cli.ts ../../node_modules/bullmq/dist/cjs/commands/*.lua ../../node_modules/bullmq/dist/cjs/commands/includes/*.lua --outfile ../../dist/crawler/basango-crawler-linux-x64",
-    "clean": "rm -rf .turbo node_modules",
-    "crawler:async": "bun run src/cli.ts schedule",
-    "crawler:push": "bun run src/cli.ts push",
-    "crawler:sync": "bun run src/cli.ts sync",
-    "crawler:worker": "bun run src/cli.ts worker",
-    "dev": "bun run src/cli.ts worker",
-    "typecheck": "tsc --noEmit"
-  },
-  "type": "module"
-}

apps/crawler/src/articles/article-draft.ts

@@ -1,11 +0,0 @@
-import type { ArticleMetadata } from "@basango/domain/models";
-
-export interface ArticleDraft {
-  body: string;
-  categories?: string[];
-  link: string;
-  metadata?: ArticleMetadata;
-  publishedAt: Date;
-  sourceId: string;
-  title: string;
-}

apps/crawler/src/articles/article-forwarder.ts

@@ -1,86 +0,0 @@
-import { config } from "@basango/domain/config";
-import type { Article } from "@basango/domain/models";
-import { logger } from "@basango/logger";
-
-import { HttpError, SyncHttpClient } from "#crawler/http/http-client";
-
-export interface ForwardResult {
-  ok: boolean;
-  retryable: boolean;
-  status?: number;
-  message?: string;
-}
-
-const isRetryableStatus = (status: number): boolean => {
-  return status === 408 || status === 425 || status === 429 || status >= 500;
-};
-
-const stringifyResponseBody = (data: unknown): string | undefined => {
-  if (!data) return undefined;
-  if (typeof data === "string") return data;
-
-  try {
-    return JSON.stringify(data);
-  } catch {
-    return undefined;
-  }
-};
-
-export class ArticleForwarder {
-  private readonly client: SyncHttpClient;
-  private readonly endpoint: string;
-  private readonly token: string;
-
-  constructor() {
-    this.client = new SyncHttpClient(config.crawler.fetch.client);
-    this.endpoint = config.crawler.backend.endpoint;
-    this.token = config.crawler.backend.token;
-  }
-
-  async forward(payload: Partial<Article>): Promise<ForwardResult> {
-    try {
-      const response = await this.client.post(`${this.endpoint}/articles`, {
-        headers: {
-          Authorization: this.token,
-          ...(payload.hash ? { "Idempotency-Key": payload.hash } : {}),
-        },
-        json: payload,
-      });
-
-      if (response.ok) {
-        const data = await response.json();
-        logger.info({ ...data }, "Article forwarded");
-        return { ok: true, retryable: false, status: response.status };
-      }
-
-      logger.error({ status: response.status, url: payload.link }, "Forwarding failed");
-      return {
-        message: `Forwarding failed with HTTP ${response.status}`,
-        ok: false,
-        retryable: isRetryableStatus(response.status),
-        status: response.status,
-      };
-    } catch (error) {
-      if (error instanceof HttpError) {
-        const data = await error.response.json().catch(() => ({}));
-        logger.error({ ...data, url: payload.link }, "Error forwarding article");
-        const body = stringifyResponseBody(data);
-        return {
-          message: body
-            ? `Forwarding failed with HTTP ${error.status}: ${body}`
-            : `Forwarding failed with HTTP ${error.status}`,
-          ok: false,
-          retryable: isRetryableStatus(error.status),
-          status: error.status,
-        };
-      }
-
-      logger.error({ err: error, url: payload.link }, "Error forwarding article");
-      return {
-        message: error instanceof Error ? error.message : "Error forwarding article",
-        ok: false,
-        retryable: true,
-      };
-    }
-  }
-}

apps/crawler/src/articles/article-outbox.ts

@@ -1,424 +0,0 @@
-import { Database } from "bun:sqlite";
-import fs from "node:fs";
-import path from "node:path";
-
-import type { Article } from "@basango/domain/models";
-
-export type ArticleOutboxStatus = "pending" | "forwarded" | "failed";
-
-export interface ArticleOutboxSaveResult {
-  status?: ArticleOutboxStatus;
-}
-
-export interface OutboxArticle {
-  attempts: number;
-  body: string;
-  categories: string[];
-  claimedAt: Date | undefined;
-  claimedBy: string | undefined;
-  createdAt: Date;
-  forwardedAt: Date | undefined;
-  hash: string;
-  lastError: string | undefined;
-  link: string;
-  metadata: Article["metadata"] | undefined;
-  payload: Partial<Article>;
-  publishedAt: Date;
-  retryable: boolean;
-  sourceId: string;
-  status: ArticleOutboxStatus;
-  title: string;
-  updatedAt: Date;
-}
-
-export interface ClaimArticleBatchOptions {
-  claimedBy: string;
-  claimTtlMs?: number;
-  limit?: number;
-  sourceId?: string;
-}
-
-export interface ArticleOutboxOptions {
-  filePath: string;
-  create?: boolean;
-}
-
-interface ArticleRow {
-  hash: string;
-  source_id: string;
-  link: string;
-  title: string;
-  body: string;
-  categories: string;
-  metadata: string | null;
-  published_at: string;
-  payload: string;
-  status: ArticleOutboxStatus;
-  attempts: number;
-  retryable: number;
-  last_error: string | null;
-  created_at: string;
-  updated_at: string;
-  forwarded_at: string | null;
-  claimed_at: string | null;
-  claimed_by: string | null;
-}
-
-export interface ListOutboxArticlesOptions {
-  sourceId?: string;
-  limit?: number;
-}
-
-const isoDate = (value: Date | string | number | undefined): string => {
-  if (value === undefined) {
-    throw new Error("Article publishedAt is required for SQLite outbox storage");
-  }
-
-  const date = value instanceof Date ? value : new Date(value);
-  if (Number.isNaN(date.getTime())) {
-    throw new Error("Article publishedAt must be a valid date");
-  }
-
-  return date.toISOString();
-};
-
-const now = (): string => new Date().toISOString();
-
-const serializeArticle = (article: Partial<Article>): string => {
-  return JSON.stringify({
-    ...article,
-    publishedAt: isoDate(article.publishedAt),
-  });
-};
-
-const parseJson = <T>(value: string | null, fallback: T): T => {
-  if (!value) return fallback;
-
-  try {
-    return JSON.parse(value) as T;
-  } catch {
-    return fallback;
-  }
-};
-
-const rowToOutboxArticle = (row: ArticleRow): OutboxArticle => {
-  const payload = parseJson<Partial<Article> & { publishedAt?: string }>(row.payload, {});
-
-  return {
-    attempts: row.attempts,
-    body: row.body,
-    categories: parseJson<string[]>(row.categories, []),
-    claimedAt: row.claimed_at ? new Date(row.claimed_at) : undefined,
-    claimedBy: row.claimed_by ?? undefined,
-    createdAt: new Date(row.created_at),
-    forwardedAt: row.forwarded_at ? new Date(row.forwarded_at) : undefined,
-    hash: row.hash,
-    lastError: row.last_error ?? undefined,
-    link: row.link,
-    metadata: parseJson<Article["metadata"] | undefined>(row.metadata, undefined),
-    payload: {
-      ...payload,
-      publishedAt: payload.publishedAt ? new Date(payload.publishedAt) : new Date(row.published_at),
-    },
-    publishedAt: new Date(row.published_at),
-    retryable: row.retryable === 1,
-    sourceId: row.source_id,
-    status: row.status,
-    title: row.title,
-    updatedAt: new Date(row.updated_at),
-  };
-};
-
-const resolveHash = (article: Partial<Article> | string): string | undefined => {
-  return typeof article === "string" ? article : article.hash;
-};
-
-export class ArticleOutbox {
-  private readonly db: Database;
-
-  constructor(options: ArticleOutboxOptions) {
-    const filePath = options.filePath.trim();
-    if (!filePath) {
-      throw new Error("ArticleOutbox requires a non-empty file path");
-    }
-
-    const create = options.create ?? true;
-    if (!create && !fs.existsSync(filePath)) {
-      throw new Error(`SQLite outbox does not exist: ${filePath}`);
-    }
-
-    if (create) {
-      fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    }
-
-    this.db = new Database(filePath, { create });
-    this.migrate();
-  }
-
-  static exists(filePath: string): boolean {
-    return fs.existsSync(filePath);
-  }
-
-  save(article: Partial<Article>): ArticleOutboxSaveResult {
-    return {
-      status: this.upsertArticle(article),
-    };
-  }
-
-  private upsertArticle(article: Partial<Article>): ArticleOutboxStatus {
-    if (!article.hash || !article.sourceId || !article.link || !article.title || !article.body) {
-      throw new Error("Cannot save incomplete article to SQLite outbox");
-    }
-
-    const publishedAt = isoDate(article.publishedAt);
-    const timestamp = now();
-    const categories = JSON.stringify(article.categories ?? []);
-    const metadata = article.metadata ? JSON.stringify(article.metadata) : null;
-    const payload = serializeArticle(article);
-
-    this.db
-      .prepare(`
-        INSERT INTO articles (
-          hash,
-          source_id,
-          link,
-          title,
-          body,
-          categories,
-          metadata,
-          published_at,
-          payload,
-          status,
-          attempts,
-          retryable,
-          last_error,
-          created_at,
-          updated_at,
-          forwarded_at
-        )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, 1, NULL, ?, ?, NULL)
-        ON CONFLICT(hash) DO UPDATE SET
-          source_id = excluded.source_id,
-          link = excluded.link,
-          title = excluded.title,
-          body = excluded.body,
-          categories = excluded.categories,
-          metadata = excluded.metadata,
-          published_at = excluded.published_at,
-          payload = excluded.payload,
-          status = CASE
-            WHEN articles.status = 'forwarded' THEN 'forwarded'
-            ELSE 'pending'
-          END,
-          last_error = CASE
-            WHEN articles.status = 'forwarded' THEN articles.last_error
-            ELSE NULL
-          END,
-          retryable = CASE
-            WHEN articles.status = 'forwarded' THEN articles.retryable
-            ELSE 1
-          END,
-          updated_at = excluded.updated_at,
-          forwarded_at = CASE
-            WHEN articles.status = 'forwarded' THEN articles.forwarded_at
-            ELSE NULL
-          END
-      `)
-      .run(
-        article.hash,
-        article.sourceId,
-        article.link,
-        article.title,
-        article.body,
-        categories,
-        metadata,
-        publishedAt,
-        payload,
-        timestamp,
-        timestamp,
-      );
-
-    const row = this.db
-      .prepare("SELECT status FROM articles WHERE hash = ?")
-      .get(article.hash) as Pick<ArticleRow, "status"> | null;
-
-    return row?.status ?? "pending";
-  }
-
-  listPending(options: ListOutboxArticlesOptions = {}): OutboxArticle[] {
-    const limit = options.limit ?? 100;
-    if (options.sourceId) {
-      const rows = this.db
-        .prepare(`
-          SELECT * FROM articles
-          WHERE status IN ('pending', 'failed') AND source_id = ?
-            AND retryable = 1
-          ORDER BY created_at ASC
-          LIMIT ?
-        `)
-        .all(options.sourceId, limit) as ArticleRow[];
-
-      return rows.map(rowToOutboxArticle);
-    }
-
-    const rows = this.db
-      .prepare(`
-        SELECT * FROM articles
-        WHERE status IN ('pending', 'failed')
-          AND retryable = 1
-        ORDER BY created_at ASC
-        LIMIT ?
-      `)
-      .all(limit) as ArticleRow[];
-
-    return rows.map(rowToOutboxArticle);
-  }
-
-  claim(options: ClaimArticleBatchOptions): OutboxArticle[] {
-    const limit = options.limit ?? 100;
-    const claimedAt = now();
-    const expiresBefore = new Date(
-      Date.now() - (options.claimTtlMs ?? 15 * 60 * 1000),
-    ).toISOString();
-
-    if (options.sourceId) {
-      const rows = this.db
-        .prepare(`
-          UPDATE articles
-          SET claimed_at = ?,
-              claimed_by = ?,
-              updated_at = ?
-          WHERE hash IN (
-            SELECT hash FROM articles
-            WHERE status IN ('pending', 'failed')
-              AND retryable = 1
-              AND source_id = ?
-              AND (claimed_at IS NULL OR claimed_at < ?)
-            ORDER BY created_at ASC
-            LIMIT ?
-          )
-          RETURNING *
-        `)
-        .all(
-          claimedAt,
-          options.claimedBy,
-          claimedAt,
-          options.sourceId,
-          expiresBefore,
-          limit,
-        ) as ArticleRow[];
-
-      return rows.map(rowToOutboxArticle);
-    }
-
-    const rows = this.db
-      .prepare(`
-        UPDATE articles
-        SET claimed_at = ?,
-            claimed_by = ?,
-            updated_at = ?
-        WHERE hash IN (
-          SELECT hash FROM articles
-          WHERE status IN ('pending', 'failed')
-            AND retryable = 1
-            AND (claimed_at IS NULL OR claimed_at < ?)
-          ORDER BY created_at ASC
-          LIMIT ?
-        )
-        RETURNING *
-      `)
-      .all(claimedAt, options.claimedBy, claimedAt, expiresBefore, limit) as ArticleRow[];
-
-    return rows.map(rowToOutboxArticle);
-  }
-
-  markForwarded(article: Partial<Article> | string): void {
-    const hash = resolveHash(article);
-    if (!hash) return;
-
-    const timestamp = now();
-    this.db
-      .prepare(`
-        UPDATE articles
-        SET status = 'forwarded',
-            last_error = NULL,
-            retryable = 0,
-            updated_at = ?,
-            forwarded_at = ?,
-            claimed_at = NULL,
-            claimed_by = NULL
-        WHERE hash = ?
-      `)
-      .run(timestamp, timestamp, hash);
-  }
-
-  markFailed(article: Partial<Article> | string, error: unknown, retryable = true): void {
-    const hash = resolveHash(article);
-    if (!hash) return;
-
-    const message = error instanceof Error ? error.message : String(error);
-    this.db
-      .prepare(`
-        UPDATE articles
-        SET status = 'failed',
-            attempts = attempts + 1,
-            retryable = ?,
-            last_error = ?,
-            updated_at = ?,
-            claimed_at = NULL,
-            claimed_by = NULL
-        WHERE hash = ?
-      `)
-      .run(retryable ? 1 : 0, message, now(), hash);
-  }
-
-  getArticle(hash: string): OutboxArticle | undefined {
-    const row = this.db
-      .prepare("SELECT * FROM articles WHERE hash = ?")
-      .get(hash) as ArticleRow | null;
-
-    return row ? rowToOutboxArticle(row) : undefined;
-  }
-
-  close(): void {
-    this.db.close();
-  }
-
-  private migrate(): void {
-    this.db.exec("PRAGMA journal_mode = WAL");
-    this.db.exec("PRAGMA synchronous = NORMAL");
-    this.db.exec("PRAGMA busy_timeout = 5000");
-    this.db.exec("PRAGMA foreign_keys = ON");
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS articles (
-        hash TEXT PRIMARY KEY,
-        source_id TEXT NOT NULL,
-        link TEXT NOT NULL UNIQUE,
-        title TEXT NOT NULL,
-        body TEXT NOT NULL,
-        categories TEXT NOT NULL DEFAULT '[]',
-        metadata TEXT,
-        published_at TEXT NOT NULL,
-        payload TEXT NOT NULL,
-        status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'forwarded', 'failed')),
-        attempts INTEGER NOT NULL DEFAULT 0,
-        retryable INTEGER NOT NULL DEFAULT 1,
-        last_error TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL,
-        forwarded_at TEXT,
-        claimed_at TEXT,
-        claimed_by TEXT
-      )
-    `);
-    this.db.exec(
-      "CREATE INDEX IF NOT EXISTS articles_status_created_at_idx ON articles(status, created_at)",
-    );
-    this.db.exec(
-      "CREATE INDEX IF NOT EXISTS articles_source_status_idx ON articles(source_id, status)",
-    );
-    this.db.exec(
-      "CREATE INDEX IF NOT EXISTS articles_claimed_at_created_at_idx ON articles(claimed_at, created_at)",
-    );
-  }
-}

apps/crawler/src/articles/ingest-article.ts

@@ -1,83 +0,0 @@
-import type { Article } from "@basango/domain/models";
-import { md5 } from "@basango/encryption";
-import { logger } from "@basango/logger";
-
-import { type ArticleDraft } from "#crawler/articles/article-draft";
-import { ArticleForwarder } from "#crawler/articles/article-forwarder";
-import type { ArticleOutbox } from "#crawler/articles/article-outbox";
-
-const sanitize = (text: string): string => {
-  if (!text) return text;
-
-  let s = text.replace(/\u00A0/g, " ");
-  s = s.replace(" ", " ");
-  s = s.replace(" ", " ");
-  s = s.replace(/\u200B/g, "");
-  s = s.replace(/\u200C/g, "");
-  s = s.replace(/\u200D/g, "");
-  s = s.replace(/\uFEFF/g, "");
-  s = s.replace(/\r\n/g, "\n");
-  s = s.replace(/\n{2,}/g, "\n");
-
-  return s.trim();
-};
-
-export const normalizeArticle = (payload: Partial<Article> | ArticleDraft): Article => {
-  if (!payload.body || !payload.link || !payload.title) {
-    throw new Error("Cannot ingest incomplete article record");
-  }
-
-  if (!payload.publishedAt || Number.isNaN(new Date(payload.publishedAt).getTime())) {
-    throw new Error("Cannot ingest article record without a valid publishedAt date");
-  }
-
-  const hash = "hash" in payload && payload.hash ? payload.hash : md5(payload.link);
-
-  return {
-    ...payload,
-    body: sanitize(payload.body),
-    categories: (payload.categories ?? []).map(sanitize),
-    hash,
-    title: sanitize(payload.title),
-  } as Article;
-};
-
-export interface IngestArticleOptions {
-  articleOutbox: ArticleOutbox;
-}
-
-export const ingestArticle = async (
-  payload: Partial<Article> | ArticleDraft,
-  options: IngestArticleOptions,
-): Promise<Article> => {
-  const article = normalizeArticle(payload);
-
-  let alreadyForwarded = false;
-  try {
-    const result = options.articleOutbox.save(article);
-    if (result?.status === "forwarded") {
-      alreadyForwarded = true;
-    }
-  } catch (error) {
-    logger.error({ err: error }, "Failed to save article to SQLite outbox");
-    throw new Error("Failed to save article to outbox");
-  }
-
-  if (alreadyForwarded) {
-    logger.info({ url: article.link }, "article already forwarded");
-    return article;
-  }
-
-  const articleForwarder = new ArticleForwarder();
-  const result = await articleForwarder.forward(article);
-  if (!result.ok) {
-    const error = new Error(result.message ?? "Failed to forward article");
-    options.articleOutbox.markFailed(article, error, result.retryable);
-    throw error;
-  }
-
-  options.articleOutbox.markForwarded(article);
-
-  logger.info({ url: article.link }, "article successfully ingested");
-  return article;
-};

apps/crawler/src/cli.ts

@@ -1,288 +0,0 @@
-#!/usr/bin/env bun
-
-import os from "node:os";
-import { parseArgs } from "node:util";
-
-import { logger } from "@basango/logger";
-
-import { ArticleForwarder } from "#crawler/articles/article-forwarder";
-import { ArticleOutbox } from "#crawler/articles/article-outbox";
-import { resolveCrawlerSqlitePath } from "#crawler/config/paths";
-import { createQueueManager } from "#crawler/execution/async/queue-manager";
-import { scheduleAsyncCrawl } from "#crawler/execution/async/scheduler";
-import { startWorker } from "#crawler/execution/async/worker";
-import type { CrawlingOptions } from "#crawler/execution/crawl-runtime";
-import { runSyncCrawl } from "#crawler/execution/sync-crawl-runner";
-
-const VERSION = "0.0.0";
-
-const USAGE = `
-Usage: basango-crawler <command> [options]
-
-Commands:
-  worker    Process crawler queues
-  schedule  Schedule async crawls for one or more sources
-  sync      Run a synchronous crawl for one source
-  push      Push pending/failed SQLite articles to the backend
-  version   Print version information
-
-Common crawl options:
-  --sourceId <id>       Source identifier. Can be repeated for schedule.
-  --pageRange <range>   Optional page range filter (e.g. 1:5)
-  --dateRange <range>   Optional date range filter (e.g. 2024-01-01:2024-01-31)
-  --category <slug>     Optional category to crawl
-
-Worker options:
-  --queue, -q <name>    Queue to process. Can be repeated.
-
-Push options:
-  --sourceId <id>       Optional source filter
-  --limit <count>       Max articles to push in one run (default: 100)
-`;
-
-interface ScheduleOptions extends Omit<CrawlingOptions, "sourceId"> {
-  sourceIds: string[];
-}
-
-interface PushOptions {
-  sourceId?: string;
-  limit: number;
-}
-
-const splitSourceIds = (value: string | undefined): string[] => {
-  if (!value) return [];
-  return value
-    .split(",")
-    .map((item) => item.trim())
-    .filter(Boolean);
-};
-
-export const resolveScheduleSourceIds = (explicit: string[] = []): string[] => {
-  if (explicit.length > 0) {
-    return explicit;
-  }
-
-  return splitSourceIds(process.env.BASANGO_CRAWLER_SOURCE_IDS);
-};
-
-export const parseScheduleOptions = (args: string[]): ScheduleOptions => {
-  const { values } = parseArgs({
-    allowPositionals: false,
-    args,
-    options: {
-      category: { type: "string" },
-      dateRange: { type: "string" },
-      pageRange: { type: "string" },
-      sourceId: { multiple: true, type: "string" },
-    },
-  });
-  const sourceIdValues = values.sourceId;
-  const sourceIds = resolveScheduleSourceIds(
-    Array.isArray(sourceIdValues)
-      ? sourceIdValues
-      : typeof sourceIdValues === "string"
-        ? [sourceIdValues]
-        : [],
-  );
-
-  return {
-    category: values.category,
-    dateRange: values.dateRange,
-    pageRange: values.pageRange,
-    sourceIds,
-  };
-};
-
-const parseCrawlingOptions = (args: string[]): CrawlingOptions => {
-  const { values } = parseArgs({
-    allowPositionals: false,
-    args,
-    options: {
-      category: { type: "string" },
-      dateRange: { type: "string" },
-      pageRange: { type: "string" },
-      sourceId: { type: "string" },
-    },
-  });
-
-  if (!values.sourceId) {
-    throw new Error("--sourceId is required");
-  }
-
-  return {
-    category: values.category,
-    dateRange: values.dateRange,
-    pageRange: values.pageRange,
-    sourceId: values.sourceId,
-  };
-};
-
-const parseWorkerOptions = (args: string[]): { queue?: string[] } => {
-  const { values } = parseArgs({
-    allowPositionals: false,
-    args,
-    options: {
-      queue: { multiple: true, short: "q", type: "string" },
-    },
-  });
-
-  return {
-    queue: values.queue?.length ? values.queue : undefined,
-  };
-};
-
-export const parsePushOptions = (args: string[]): PushOptions => {
-  const { values } = parseArgs({
-    allowPositionals: false,
-    args,
-    options: {
-      limit: { type: "string" },
-      sourceId: { type: "string" },
-    },
-  });
-
-  const limit = values.limit ? Number(values.limit) : 100;
-  if (!Number.isInteger(limit) || limit < 1) {
-    throw new Error("--limit must be a positive integer");
-  }
-
-  return {
-    limit,
-    sourceId: values.sourceId,
-  };
-};
-
-const runWorker = async (args: string[]): Promise<void> => {
-  const options = parseWorkerOptions(args);
-  const manager = createQueueManager();
-  const handle = startWorker({
-    queueManager: manager,
-    queueNames: options.queue,
-  });
-
-  const shutdown = async (signal: NodeJS.Signals) => {
-    logger.info({ signal }, "Received shutdown signal, draining workers");
-    try {
-      await handle.close();
-    } finally {
-      await manager.close();
-      process.exit(0);
-    }
-  };
-
-  process.once("SIGINT", (signal) => void shutdown(signal));
-  process.once("SIGTERM", (signal) => void shutdown(signal));
-  logger.info({ queueNames: options.queue }, "Crawler workers started");
-
-  await new Promise(() => undefined);
-};
-
-const runSchedule = async (args: string[]): Promise<void> => {
-  const options = parseScheduleOptions(args);
-  if (options.sourceIds.length === 0) {
-    throw new Error(
-      "No sources provided. Pass --sourceId or set BASANGO_CRAWLER_SOURCE_IDS=source-a,source-b",
-    );
-  }
-
-  for (const sourceId of options.sourceIds) {
-    const id = await scheduleAsyncCrawl({
-      category: options.category,
-      dateRange: options.dateRange,
-      pageRange: options.pageRange,
-      sourceId,
-    });
-    logger.info({ id, sourceId }, "Scheduled asynchronous crawl job");
-  }
-};
-
-const runPush = async (args: string[]): Promise<void> => {
-  const options = parsePushOptions(args);
-  const sqlitePath = resolveCrawlerSqlitePath();
-  if (!ArticleOutbox.exists(sqlitePath)) {
-    throw new Error(`SQLite outbox does not exist: ${sqlitePath}`);
-  }
-
-  const outbox = new ArticleOutbox({ create: false, filePath: sqlitePath });
-  const forwarder = new ArticleForwarder();
-
-  let forwardedCount = 0;
-  let failedCount = 0;
-  try {
-    const claimId = `${os.hostname()}:${process.pid}:${Date.now()}`;
-    const articles = outbox.claim({
-      ...options,
-      claimedBy: claimId,
-    });
-
-    logger.info(
-      { claimed: articles.length, claimId, sourceId: options.sourceId, sqlitePath },
-      "Pushing articles from SQLite outbox",
-    );
-
-    for (const article of articles) {
-      const forwarded = await forwarder.forward(article.payload);
-      if (forwarded.ok) {
-        outbox.markForwarded(article.hash);
-        forwardedCount += 1;
-      } else {
-        outbox.markFailed(
-          article.hash,
-          new Error(forwarded.message ?? "Failed to forward article"),
-          forwarded.retryable,
-        );
-        failedCount += 1;
-      }
-    }
-  } finally {
-    outbox.close();
-  }
-
-  logger.info(
-    { failed: failedCount, forwarded: forwardedCount, sourceId: options.sourceId },
-    "Push completed",
-  );
-
-  if (failedCount > 0) {
-    throw new Error(`Failed to push ${failedCount} article(s)`);
-  }
-};
-
-export const runCli = async (args: string[] = process.argv.slice(2)): Promise<number> => {
-  const [command, ...rest] = args;
-
-  try {
-    switch (command) {
-      case "worker":
-        await runWorker(rest);
-        return 0;
-      case "schedule":
-        await runSchedule(rest);
-        return 0;
-      case "sync":
-        await runSyncCrawl(parseCrawlingOptions(rest));
-        return 0;
-      case "push":
-        await runPush(rest);
-        return 0;
-      case "version":
-        console.log(`basango-crawler ${VERSION}`);
-        return 0;
-      case undefined:
-      case "help":
-      case "--help":
-      case "-h":
-        console.log(USAGE);
-        return command === undefined ? 1 : 0;
-      default:
-        throw new Error(`Unknown command: ${command}`);
-    }
-  } catch (error) {
-    logger.error({ err: error }, "Crawler command failed");
-    return 1;
-  }
-};
-
-if (import.meta.main) {
-  process.exitCode = await runCli();
-}

apps/crawler/src/config/paths.ts

@@ -1,23 +0,0 @@
-import path from "node:path";
-
-import { config } from "@basango/domain/config";
-
-export const resolveCrawlerDataPath = (): string => {
-  const dataPath = config.crawler.paths.data?.trim();
-  if (dataPath) {
-    return path.resolve(dataPath);
-  }
-
-  const rootPath = config.crawler.paths.root?.trim();
-  return path.resolve(rootPath || process.cwd(), "data");
-};
-
-export const resolveCrawlerSqlitePath = (): string => {
-  const sqlitePath =
-    process.env.BASANGO_CRAWLER_SQLITE_PATH?.trim() || config.crawler.paths.sqlite?.trim();
-  if (sqlitePath) {
-    return path.resolve(sqlitePath);
-  }
-
-  return path.join(resolveCrawlerDataPath(), "crawler.db");
-};

apps/crawler/src/config/ranges.ts

@@ -1,75 +0,0 @@
-import { DEFAULT_DATE_FORMAT } from "@basango/domain/constants";
-import {
-  DateSpecSchema,
-  type PageRange,
-  PageRangeSchema,
-  PageSpecSchema,
-  type TimestampRange,
-  TimestampRangeSchema,
-} from "@basango/domain/models";
-import { format, fromUnixTime, getUnixTime, isMatch, parse } from "date-fns";
-
-const parseDate = (value: string, format: string): Date => {
-  if (!isMatch(value, format)) {
-    throw new Error(`Invalid date '${value}' for format '${format}'`);
-  }
-
-  const parsed = parse(value, format, new Date());
-  if (Number.isNaN(parsed.getTime())) {
-    throw new Error(`Invalid date '${value}' for format '${format}'`);
-  }
-
-  return parsed;
-};
-
-export const createPageRange = (spec: string | undefined): PageRange | undefined => {
-  if (!spec) return undefined;
-  const parsed = PageSpecSchema.parse(spec);
-  return PageRangeSchema.parse(parsed);
-};
-
-export const createTimestampRange = (
-  spec: string | undefined,
-  options: {
-    format?: string;
-    separator?: string;
-  } = {},
-): TimestampRange | undefined => {
-  if (!spec) return undefined;
-  const { format = DEFAULT_DATE_FORMAT, separator = ":" } = options;
-  if (!separator) {
-    throw new Error("Separator cannot be empty");
-  }
-
-  const normalized = spec.replace(separator, ":");
-  const parsedSpec = DateSpecSchema.parse(normalized);
-  const startDate = parseDate(parsedSpec.startRaw, format);
-  const endDate = parseDate(parsedSpec.endRaw, format);
-
-  return TimestampRangeSchema.parse({
-    end: getUnixTime(endDate),
-    start: getUnixTime(startDate),
-  });
-};
-
-export const formatTimestampRange = (range: TimestampRange, fmt = DEFAULT_DATE_FORMAT): string => {
-  const start = format(fromUnixTime(range.start), fmt);
-  const end = format(fromUnixTime(range.end), fmt);
-  return `${start}:${end}`;
-};
-
-export const formatPageRange = (range: PageRange): string => {
-  return `${range.start}:${range.end}`;
-};
-
-export const isTimestampInRange = (range: TimestampRange, timestamp: number): boolean => {
-  return range.start <= timestamp && timestamp <= range.end;
-};
-
-export const createAbsoluteUrl = (base: string, href: string): string => {
-  try {
-    return new URL(href, base.endsWith("/") ? base : `${base}/`).toString();
-  } catch {
-    return href;
-  }
-};

apps/crawler/src/config/redis.ts

@@ -1,15 +0,0 @@
-import type { RedisOptions } from "ioredis";
-
-export const parseRedisUrl = (url: string): RedisOptions => {
-  if (!url.startsWith("redis://")) {
-    return {};
-  }
-
-  const parsed = new URL(url);
-  return {
-    db: Number(parsed.pathname?.replace("/", "") || 0),
-    host: parsed.hostname,
-    password: parsed.password || undefined,
-    port: Number(parsed.port || 6379),
-  };
-};

apps/crawler/src/config/sources.ts

@@ -1,18 +0,0 @@
-import {
-  type AnySourceOptions,
-  type HtmlSourceOptions,
-  type WordPressSourceOptions,
-  config,
-} from "@basango/domain/config";
-
-export const resolveSourceConfig = (id: string): AnySourceOptions => {
-  const source =
-    config.crawler.sources.html.find((s: HtmlSourceOptions) => s.sourceId === id) ||
-    config.crawler.sources.wordpress.find((s: WordPressSourceOptions) => s.sourceId === id);
-
-  if (source === undefined) {
-    throw new Error(`Source '${id}' not found in configuration`);
-  }
-
-  return source;
-};

apps/crawler/src/errors.ts

@@ -1,39 +0,0 @@
-/**
- * Error thrown when an article is invalid or cannot be processed.
- */
-export class InvalidArticleError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "InvalidArticleError";
-  }
-}
-
-/**
- * Error thrown when a source kind is not supported by the crawler.
- */
-export class UnsupportedSourceKindError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "UnsupportedSourceKindError";
-  }
-}
-
-/**
- * Error thrown when a source's selectors are invalid or missing.
- */
-export class InvalidSourceSelectorsError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "InvalidSourceSelectorsError";
-  }
-}
-
-/**
- * Error thrown when an article's publication date is outside the specified date range.
- */
-export class ArticleOutOfDateRangeError extends Error {
-  constructor(message: string, _meta: Record<string, unknown>) {
-    super(message);
-    this.name = "ArticleOutOfDateRangeError";
-  }
-}

apps/crawler/src/execution/async/bullmq.ts

@@ -1,15 +0,0 @@
-import type { JobsOptions as BullJobsOptions, Job } from "bullmq";
-import * as bullmq from "bullmq/dist/cjs/index.js";
-
-type BullMqModule = typeof import("bullmq");
-const cjsBullmq = bullmq as unknown as BullMqModule;
-
-export const Queue: BullMqModule["Queue"] = cjsBullmq.Queue;
-export const QueueEvents: BullMqModule["QueueEvents"] = cjsBullmq.QueueEvents;
-export const Worker: BullMqModule["Worker"] = cjsBullmq.Worker;
-
-export type JobInstance = Job;
-export type JobsOptions = BullJobsOptions;
-export type QueueEventsInstance = InstanceType<BullMqModule["QueueEvents"]>;
-export type QueueInstance = InstanceType<BullMqModule["Queue"]>;
-export type WorkerInstance = InstanceType<BullMqModule["Worker"]>;

apps/crawler/src/execution/async/handlers/collect-article.ts

@@ -1,54 +0,0 @@
-import logger from "@basango/logger";
-
-import { formatPageRange, formatTimestampRange } from "#crawler/config/ranges";
-import { resolveSourceConfig } from "#crawler/config/sources";
-import {
-  ArticleOutOfDateRangeError,
-  InvalidArticleError,
-  UnsupportedSourceKindError,
-} from "#crawler/errors";
-import { DetailsTaskPayload } from "#crawler/execution/async/queue-schemas";
-import {
-  closeArticleOutbox,
-  createArticleOutbox,
-  resolveCrawlerConfig,
-} from "#crawler/execution/crawl-runtime";
-import { HtmlCrawler } from "#crawler/sources/html/html-crawler";
-import { WordPressCrawler } from "#crawler/sources/wordpress/wordpress-crawler";
-
-export const collectArticle = async (payload: DetailsTaskPayload): Promise<unknown> => {
-  const source = resolveSourceConfig(payload.sourceId);
-  const settings = resolveCrawlerConfig(source, {
-    category: payload.category,
-    dateRange: payload.dateRange ? formatTimestampRange(payload.dateRange) : undefined,
-    pageRange: payload.pageRange ? formatPageRange(payload.pageRange) : undefined,
-    sourceId: payload.sourceId,
-  });
-  const articleOutbox = createArticleOutbox(source);
-
-  try {
-    if (source.sourceKind === "html") {
-      const crawler = new HtmlCrawler(settings, { articleOutbox });
-      const html = await crawler.crawl(payload.url);
-
-      return await crawler.fetchOne(html, settings.dateRange, payload.url);
-    }
-
-    if (source.sourceKind === "wordpress") {
-      const crawler = new WordPressCrawler(settings, { articleOutbox });
-
-      return await crawler.fetchOne(payload.data ?? {}, settings.dateRange);
-    }
-
-    throw new UnsupportedSourceKindError(`Unsupported source kind`);
-  } catch (error) {
-    if (error instanceof ArticleOutOfDateRangeError || error instanceof InvalidArticleError) {
-      logger.info({ error, url: payload.url }, "Skipping article");
-      return { reason: error.name, skipped: true, url: payload.url };
-    }
-
-    throw error;
-  } finally {
-    closeArticleOutbox(articleOutbox);
-  }
-};

apps/crawler/src/execution/async/handlers/collect-html-listing.ts

@@ -1,61 +0,0 @@
-import logger from "@basango/logger";
-
-import { createTimestampRange } from "#crawler/config/ranges";
-import { resolveSourceConfig } from "#crawler/config/sources";
-import { collectWordPressListing } from "#crawler/execution/async/handlers/collect-wordpress-listing";
-import { QueueManager, createQueueManager } from "#crawler/execution/async/queue-manager";
-import { DetailsTaskPayload, ListingTaskPayload } from "#crawler/execution/async/queue-schemas";
-import { resolveCrawlerConfig } from "#crawler/execution/crawl-runtime";
-import { HtmlCrawler } from "#crawler/sources/html/html-crawler";
-import { resolveSourceUpdateDates } from "#crawler/sources/source-update-window";
-import type { HtmlSourceOptions } from "#domain/config";
-
-export const collectHtmlListing = async (
-  payload: ListingTaskPayload,
-  queueManager?: QueueManager,
-): Promise<number> => {
-  const manager = queueManager ?? createQueueManager();
-  const shouldCloseManager = queueManager === undefined;
-
-  try {
-    const source = resolveSourceConfig(payload.sourceId) as HtmlSourceOptions;
-    if (source.sourceKind !== "html") {
-      return await collectWordPressListing(payload, manager);
-    }
-
-    const settings = resolveCrawlerConfig(source, payload);
-    await resolveSourceUpdateDates(settings);
-
-    const crawler = new HtmlCrawler(settings);
-    const pageRange = settings.pageRange ?? (await crawler.getPagination());
-
-    let queued = 0;
-    for (let page = pageRange.start; page <= pageRange.end; page += 1) {
-      const target = crawler.buildEndpointUrl(page) ?? `${source.sourceUrl}`;
-
-      try {
-        const items = await crawler.fetchLinks(target, source.sourceSelectors.articles);
-        for (const node of items) {
-          const url = crawler.extractLink(node);
-          if (!url) continue;
-
-          await manager.enqueueArticle({
-            category: payload.category,
-            dateRange: createTimestampRange(payload.dateRange),
-            sourceId: payload.sourceId,
-            url,
-          } as DetailsTaskPayload);
-          queued += 1;
-        }
-      } catch (error) {
-        logger.error({ error, target }, "Failed to crawl page");
-      }
-    }
-
-    return queued;
-  } finally {
-    if (shouldCloseManager) {
-      await manager.close();
-    }
-  }
-};

apps/crawler/src/execution/async/handlers/collect-wordpress-listing.ts

@@ -1,62 +0,0 @@
-import logger from "@basango/logger";
-
-import { createTimestampRange } from "#crawler/config/ranges";
-import { resolveSourceConfig } from "#crawler/config/sources";
-import { collectHtmlListing } from "#crawler/execution/async/handlers/collect-html-listing";
-import { QueueManager, createQueueManager } from "#crawler/execution/async/queue-manager";
-import { DetailsTaskPayload, ListingTaskPayload } from "#crawler/execution/async/queue-schemas";
-import { resolveCrawlerConfig } from "#crawler/execution/crawl-runtime";
-import { resolveSourceUpdateDates } from "#crawler/sources/source-update-window";
-import { WordPressCrawler } from "#crawler/sources/wordpress/wordpress-crawler";
-import type { WordPressSourceOptions } from "#domain/config";
-
-export const collectWordPressListing = async (
-  payload: ListingTaskPayload,
-  queueManager?: QueueManager,
-): Promise<number> => {
-  const manager = queueManager ?? createQueueManager();
-  const shouldCloseManager = queueManager === undefined;
-
-  try {
-    const source = resolveSourceConfig(payload.sourceId) as WordPressSourceOptions;
-    if (source.sourceKind !== "wordpress") {
-      return await collectHtmlListing(payload, manager);
-    }
-
-    const settings = resolveCrawlerConfig(source, payload);
-    await resolveSourceUpdateDates(settings);
-
-    const crawler = new WordPressCrawler(settings);
-    const pageRange = settings.pageRange ?? (await crawler.getPagination());
-
-    let queued = 0;
-    for (let page = pageRange.start; page <= pageRange.end; page += 1) {
-      const url = crawler.buildEndpointUrl(page);
-
-      try {
-        const entries = await crawler.fetchLinks(url);
-        for (const data of entries) {
-          const url = data.link;
-          if (!url) continue;
-
-          await manager.enqueueArticle({
-            category: payload.category,
-            data,
-            dateRange: createTimestampRange(payload.dateRange),
-            sourceId: payload.sourceId,
-            url,
-          } as DetailsTaskPayload);
-          queued += 1;
-        }
-      } catch (error) {
-        logger.error({ error, page }, "Failed to fetch WordPress page");
-      }
-    }
-
-    return queued;
-  } finally {
-    if (shouldCloseManager) {
-      await manager.close();
-    }
-  }
-};

apps/crawler/src/execution/async/queue-manager.ts

@@ -1,119 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-
-import { type CrawlerAsyncOptions, config } from "@basango/domain/config";
-import IORedis from "ioredis";
-
-import { parseRedisUrl } from "#crawler/config/redis";
-import { type JobsOptions, Queue } from "#crawler/execution/async/bullmq";
-import {
-  DetailsTaskPayload,
-  DetailsTaskPayloadSchema,
-  ListingTaskPayload,
-  ListingTaskPayloadSchema,
-} from "#crawler/execution/async/queue-schemas";
-
-export interface QueueBackend<T = unknown> {
-  add: (name: string, data: T, opts?: JobsOptions) => Promise<{ id: string }>;
-  close?: () => Promise<void>;
-}
-
-export type QueueFactory = (
-  queueName: string,
-  options: CrawlerAsyncOptions,
-  connection?: IORedis,
-) => QueueBackend;
-
-const defaultQueueFactory: QueueFactory = (queueName, options, connection) => {
-  const redisConnection =
-    connection ??
-    new IORedis(options.redisUrl, {
-      ...parseRedisUrl(options.redisUrl),
-      maxRetriesPerRequest: null,
-    });
-
-  const queue = new Queue(queueName, {
-    connection: redisConnection,
-    prefix: options.prefix,
-  });
-  return {
-    add: async (name, data, opts) => {
-      const job = await queue.add(name, data, {
-        removeOnComplete: options.ttl.result === 0 ? true : { age: options.ttl.result },
-        removeOnFail: options.ttl.failure === 0 ? true : { age: options.ttl.failure },
-        ...opts,
-      });
-      return { id: job.id ?? randomUUID() };
-    },
-    close: () => queue.close(),
-  };
-};
-
-const createStableJobId = (prefix: string, payload: unknown): string => {
-  const hash = createHash("sha1").update(JSON.stringify(payload)).digest("hex");
-  return `${prefix}-${hash}`;
-};
-
-export interface CreateQueueManagerOptions {
-  queueFactory?: QueueFactory;
-  connection?: IORedis;
-}
-
-export interface QueueManager {
-  readonly options: CrawlerAsyncOptions;
-  readonly connection: IORedis;
-  enqueueListing: (payload: ListingTaskPayload) => Promise<{ id: string }>;
-  enqueueArticle: (payload: DetailsTaskPayload) => Promise<{ id: string }>;
-  iterQueueNames: () => string[];
-  queueName: (suffix: string) => string;
-  close: () => Promise<void>;
-}
-
-export const createQueueManager = (options: CreateQueueManagerOptions = {}): QueueManager => {
-  const asyncOptions = config.crawler.fetch.async;
-
-  const connection =
-    options.connection ??
-    new IORedis(asyncOptions.redisUrl, {
-      ...parseRedisUrl(asyncOptions.redisUrl),
-      maxRetriesPerRequest: null,
-    });
-  const factory = options.queueFactory ?? defaultQueueFactory;
-  const queues = new Map<string, QueueBackend>();
-
-  const ensureQueue = (queueName: string) => {
-    const existing = queues.get(queueName);
-    if (existing) return existing;
-
-    const queue = factory(queueName, asyncOptions, connection);
-    queues.set(queueName, queue);
-    return queue;
-  };
-
-  return {
-    close: async () => {
-      await Promise.all([...queues.values()].map((queue) => queue.close?.()));
-      await connection.quit();
-    },
-    connection,
-    enqueueArticle: (payload) => {
-      const data = DetailsTaskPayloadSchema.parse(payload);
-      const queue = ensureQueue(asyncOptions.queues.details);
-      return queue.add("collect_article", data, {
-        jobId: createStableJobId("article", {
-          sourceId: data.sourceId,
-          url: data.url,
-        }),
-      });
-    },
-    enqueueListing: (payload) => {
-      const data = ListingTaskPayloadSchema.parse(payload);
-      const queue = ensureQueue(asyncOptions.queues.listing);
-      return queue.add("collect_listing", data, {
-        jobId: createStableJobId("listing", data),
-      });
-    },
-    iterQueueNames: () => [asyncOptions.queues.listing, asyncOptions.queues.details],
-    options: asyncOptions,
-    queueName: (suffix: string) => `${asyncOptions.prefix}:${suffix}`,
-  };
-};

apps/crawler/src/execution/async/queue-schemas.ts

@@ -1,22 +0,0 @@
-import { PageRangeSchema, TimestampRangeSchema } from "@basango/domain/models";
-import z from "zod";
-
-export const ListingTaskPayloadSchema = z.object({
-  category: z.string().optional(),
-  dateRange: z.string().optional(),
-  pageRange: z.string().optional(),
-  sourceId: z.string(),
-});
-
-export const DetailsTaskPayloadSchema = z.object({
-  category: z.string().optional(),
-  data: z.any().optional(),
-  dateRange: TimestampRangeSchema.optional(),
-  page: z.number().int().nonnegative().optional(),
-  pageRange: PageRangeSchema.optional(),
-  sourceId: z.string(),
-  url: z.url(),
-});
-
-export type ListingTaskPayload = z.infer<typeof ListingTaskPayloadSchema>;
-export type DetailsTaskPayload = z.infer<typeof DetailsTaskPayloadSchema>;

apps/crawler/src/execution/async/scheduler.ts

@@ -1,51 +0,0 @@
-import { logger } from "@basango/logger";
-
-import { collectArticle as collectArticle1 } from "#crawler/execution/async/handlers/collect-article";
-import { collectHtmlListing } from "#crawler/execution/async/handlers/collect-html-listing";
-import { createQueueManager } from "#crawler/execution/async/queue-manager";
-import {
-  DetailsTaskPayloadSchema,
-  ListingTaskPayloadSchema,
-} from "#crawler/execution/async/queue-schemas";
-import { CrawlingOptions } from "#crawler/execution/crawl-runtime";
-
-export const collectListing = async (payload: unknown): Promise<number> => {
-  const data = ListingTaskPayloadSchema.parse(payload);
-  logger.debug({ data }, "Collecting listing");
-
-  const count = await collectHtmlListing(data);
-  logger.info({ count }, "Listing collection completed");
-
-  return count;
-};
-
-export const collectArticle = async (payload: unknown): Promise<unknown> => {
-  const data = DetailsTaskPayloadSchema.parse(payload);
-  logger.info({ data }, "Collecting article");
-
-  const result = await collectArticle1(data);
-  logger.info({ url: data.url }, "Article collection completed");
-
-  return result;
-};
-
-export const scheduleAsyncCrawl = async (options: CrawlingOptions): Promise<string> => {
-  const payload = ListingTaskPayloadSchema.parse({
-    category: options.category,
-    dateRange: options.dateRange,
-    pageRange: options.pageRange,
-    sourceId: options.sourceId,
-  });
-
-  const manager = createQueueManager();
-  logger.info({ payload }, "Scheduling listing collection job");
-
-  try {
-    const job = await manager.enqueueListing(payload);
-    logger.info({ job }, "Scheduled listing collection job");
-
-    return job.id;
-  } finally {
-    await manager.close();
-  }
-};

apps/crawler/src/execution/async/worker.ts

@@ -1,82 +0,0 @@
-import IORedis from "ioredis";
-
-import {
-  type JobInstance,
-  QueueEvents,
-  type QueueEventsInstance,
-  Worker,
-  type WorkerInstance,
-} from "#crawler/execution/async/bullmq";
-import { QueueFactory, QueueManager } from "#crawler/execution/async/queue-manager";
-import { collectArticle, collectListing } from "#crawler/execution/async/scheduler";
-
-export interface WorkerOptions {
-  queueNames?: string[];
-  connection?: IORedis;
-  queueFactory?: QueueFactory;
-  concurrency?: number;
-  onError?: (error: Error) => void;
-  queueManager: QueueManager;
-}
-
-export interface WorkerHandle {
-  readonly workers: WorkerInstance[];
-  readonly events: QueueEventsInstance[];
-  close: () => Promise<void>;
-}
-
-export const startWorker = (options: WorkerOptions): WorkerHandle => {
-  const manager = options.queueManager;
-  const queueNames = options.queueNames ?? manager.iterQueueNames();
-  const workers: WorkerInstance[] = [];
-  const events: QueueEventsInstance[] = [];
-
-  const connection = manager.connection;
-
-  for (const queueName of queueNames) {
-    const worker = new Worker(
-      queueName,
-      async (job: JobInstance) => {
-        switch (job.name) {
-          case "collect_listing":
-            return collectListing(job.data);
-          case "collect_article":
-            return collectArticle(job.data);
-          default:
-            throw new Error(`Unknown job name: ${job.name}`);
-        }
-      },
-      {
-        concurrency: options.concurrency ?? 5,
-        connection,
-        prefix: manager.options.prefix,
-      },
-    );
-
-    if (options.onError) {
-      worker.on("failed", (_: JobInstance | undefined, err: Error) => options.onError?.(err));
-      worker.on("error", (err: Error) => options.onError?.(err));
-    }
-
-    const queueEvents = new QueueEvents(queueName, {
-      connection,
-      prefix: manager.options.prefix,
-    });
-
-    workers.push(worker);
-    events.push(queueEvents);
-  }
-
-  return {
-    close: async () => {
-      await Promise.all(workers.map((worker) => worker.close()));
-      await Promise.all(events.map((event) => event.close()));
-
-      if (!options.queueManager) {
-        await manager.close();
-      }
-    },
-    events,
-    workers,
-  };
-};

apps/crawler/src/execution/crawl-runtime.ts

@@ -1,40 +0,0 @@
-import { AnySourceOptions, CrawlerFetchingOptions, config } from "@basango/domain/config";
-import { logger } from "@basango/logger";
-
-import { ArticleOutbox } from "#crawler/articles/article-outbox";
-import { resolveCrawlerSqlitePath } from "#crawler/config/paths";
-import { createPageRange, createTimestampRange } from "#crawler/config/ranges";
-
-export interface CrawlingOptions {
-  sourceId: string;
-  pageRange?: string | undefined;
-  dateRange?: string | undefined;
-  category?: string | undefined;
-}
-
-export const resolveCrawlerConfig = (
-  source: AnySourceOptions,
-  options: CrawlingOptions,
-): CrawlerFetchingOptions => {
-  return {
-    ...config.crawler.fetch.crawler,
-    category: options.category,
-    dateRange: createTimestampRange(options.dateRange),
-    pageRange: createPageRange(options.pageRange),
-    source,
-  };
-};
-
-export const createArticleOutbox = (_source: AnySourceOptions): ArticleOutbox => {
-  return new ArticleOutbox({
-    filePath: resolveCrawlerSqlitePath(),
-  });
-};
-
-export const closeArticleOutbox = (articleOutbox: ArticleOutbox): void => {
-  try {
-    articleOutbox.close();
-  } catch (error) {
-    logger.warn({ err: error }, "Failed to close SQLite article outbox");
-  }
-};

apps/crawler/src/execution/sync-crawl-runner.ts

@@ -1,32 +0,0 @@
-import { logger } from "@basango/logger";
-
-import { resolveSourceConfig } from "#crawler/config/sources";
-import {
-  CrawlingOptions,
-  closeArticleOutbox,
-  createArticleOutbox,
-  resolveCrawlerConfig,
-} from "#crawler/execution/crawl-runtime";
-import { HtmlCrawler } from "#crawler/sources/html/html-crawler";
-import { resolveSourceUpdateDates } from "#crawler/sources/source-update-window";
-import { WordPressCrawler } from "#crawler/sources/wordpress/wordpress-crawler";
-
-export const runSyncCrawl = async (options: CrawlingOptions): Promise<void> => {
-  const source = resolveSourceConfig(options.sourceId);
-  const settings = resolveCrawlerConfig(source, options);
-  const articleOutbox = createArticleOutbox(source);
-  await resolveSourceUpdateDates(settings);
-
-  const crawler =
-    source.sourceKind === "wordpress"
-      ? new WordPressCrawler(settings, { articleOutbox })
-      : new HtmlCrawler(settings, { articleOutbox });
-
-  try {
-    await crawler.fetch();
-  } finally {
-    closeArticleOutbox(articleOutbox);
-  }
-
-  logger.info({ ...options }, "Synchronous crawl completed");
-};

apps/crawler/src/http/http-client.ts

@@ -1,243 +0,0 @@
-import { setTimeout as delay } from "node:timers/promises";
-
-import type { CrawlerHttpOptions } from "@basango/domain/config";
-import {
-  DEFAULT_RETRY_AFTER_HEADER,
-  DEFAULT_TRANSIENT_HTTP_STATUSES,
-  DEFAULT_USER_AGENT,
-} from "@basango/domain/constants";
-
-import { UserAgents } from "#crawler/http/user-agent";
-
-export type HttpHeaders = Record<string, string>;
-export type HttpParams = Record<string, string | number | boolean | null | undefined>;
-export type HttpData = unknown;
-
-export interface HttpClientOptions {
-  userAgentProvider?: UserAgents;
-  defaultHeaders?: HttpHeaders;
-  fetchImpl?: typeof fetch;
-  sleep?: (ms: number) => Promise<void>;
-}
-
-export interface HttpRequestOptions {
-  headers?: HttpHeaders;
-  params?: HttpParams;
-  data?: HttpData;
-  json?: HttpData;
-  retryAfterHeader?: string;
-}
-
-export class HttpError extends Error {
-  readonly status: number;
-  readonly response: Response;
-
-  constructor(message: string, response: Response) {
-    super(message);
-    this.status = response.status;
-    this.response = response;
-  }
-}
-
-/**
- * Default sleep function using setTimeout.
- * @param ms - Milliseconds to sleep
- */
-const defaultSleep = (ms: number): Promise<void> => {
-  return delay(ms).then(() => undefined);
-};
-
-/**
- * Builds a URL with query parameters.
- * @param url - The base URL
- * @param params - The query parameters to append
- */
-const buildUrl = (url: string, params?: HttpParams): string => {
-  if (!params || Object.keys(params).length === 0) {
-    return url;
-  }
-
-  const target = new URL(url);
-  for (const [key, value] of Object.entries(params)) {
-    if (value === undefined || value === null) continue;
-    target.searchParams.set(key, String(value));
-  }
-
-  return target.toString();
-};
-
-/**
- * Computes the backoff time in milliseconds based on the configuration and attempt number.
- * @param config - Fetch client configuration
- * @param attempt - Current attempt number
- */
-const computeBackoff = (config: CrawlerHttpOptions, attempt: number): number => {
-  const base = Math.min(
-    config.backoffInitial * config.backoffMultiplier ** attempt,
-    config.backoffMax,
-  );
-  const jitter = Math.random() * base * 0.25;
-  return (base + jitter) * 1000;
-};
-
-const parseRetryAfter = (header: string): number => {
-  const numeric = Number.parseInt(header, 10);
-  if (!Number.isNaN(numeric)) {
-    return Math.max(0, numeric * 1000);
-  }
-
-  const parsed = Date.parse(header);
-  if (Number.isNaN(parsed)) {
-    return 0;
-  }
-
-  const delta = parsed - Date.now();
-  return delta > 0 ? delta : 0;
-};
-
-/**
- * Base HTTP client providing common functionality.
- *
- * @author Bernard Ngandu <bernard@devscast.tech>
- */
-export class BaseHttpClient {
-  protected readonly options: CrawlerHttpOptions;
-  protected readonly fetchImpl: typeof fetch;
-  protected readonly sleep: (ms: number) => Promise<void>;
-  protected readonly headers: HttpHeaders;
-
-  constructor(options: CrawlerHttpOptions, clientOptions: HttpClientOptions = {}) {
-    this.options = options;
-    const provider =
-      clientOptions.userAgentProvider ??
-      new UserAgents(options.rotate, options.userAgent ?? DEFAULT_USER_AGENT);
-    const userAgent = provider.get() ?? options.userAgent ?? DEFAULT_USER_AGENT;
-
-    const baseHeaders: HttpHeaders = { "User-Agent": userAgent };
-    if (clientOptions.defaultHeaders) {
-      Object.assign(baseHeaders, clientOptions.defaultHeaders);
-    }
-
-    this.headers = baseHeaders;
-    this.fetchImpl = clientOptions.fetchImpl ?? fetch;
-    this.sleep = clientOptions.sleep ?? defaultSleep;
-  }
-
-  protected buildHeaders(headers?: HttpHeaders): HeadersInit {
-    return { ...this.headers, ...(headers ?? {}) };
-  }
-
-  protected async maybeDelay(
-    attempt: number,
-    response?: Response,
-    retryAfterHeader: string = DEFAULT_RETRY_AFTER_HEADER,
-  ): Promise<void> {
-    let waitMs = 0;
-
-    if (response) {
-      const retryAfter = response.headers.get(retryAfterHeader);
-      if (retryAfter && this.options.respectRetryAfter) {
-        waitMs = parseRetryAfter(retryAfter);
-      }
-    }
-
-    if (waitMs === 0) {
-      waitMs = computeBackoff(this.options, attempt);
-    }
-
-    if (waitMs > 0) {
-      await this.sleep(waitMs);
-    }
-  }
-}
-
-/**
- * Synchronous HTTP client with retry and timeout capabilities.
- *
- * @author Bernard Ngandu <bernard@devscast.tech>
- */
-export class SyncHttpClient extends BaseHttpClient {
-  async request(method: string, url: string, options: HttpRequestOptions = {}): Promise<Response> {
-    const retryAfterHeader = options.retryAfterHeader ?? DEFAULT_RETRY_AFTER_HEADER;
-    const target = buildUrl(url, options.params);
-
-    const maxAttempts = this.options.maxRetries + 1;
-    let attempt = 0;
-    let lastError: unknown;
-
-    while (attempt < maxAttempts) {
-      const controller = new AbortController();
-      let timeoutHandle: ReturnType<typeof setTimeout> | undefined;
-      try {
-        timeoutHandle = setTimeout(() => controller.abort(), this.options.timeout * 1000);
-
-        const headers = this.buildHeaders(options.headers);
-        const init: RequestInit = {
-          body: options.data as BodyInit | undefined,
-          headers,
-          method,
-          redirect: this.options.followRedirects ? "follow" : "manual",
-          signal: controller.signal,
-        };
-
-        if (options.json !== undefined) {
-          init.body = JSON.stringify(options.json);
-          (init.headers as Record<string, string>)["Content-Type"] ??= "application/json";
-        }
-
-        const response = await this.fetchImpl(target, init);
-
-        if (
-          DEFAULT_TRANSIENT_HTTP_STATUSES.includes(response.status as number) &&
-          attempt < this.options.maxRetries
-        ) {
-          await this.maybeDelay(attempt, response, retryAfterHeader);
-          attempt += 1;
-          continue;
-        }
-
-        if (!response.ok) {
-          throw new HttpError(`HTTP ${response.status} ${response.statusText}`, response);
-        }
-
-        return response;
-      } catch (error) {
-        if (error instanceof HttpError) {
-          lastError = error;
-          throw error;
-        }
-
-        if (error instanceof DOMException && error.name === "AbortError") {
-          lastError = error;
-          if (attempt >= this.options.maxRetries) {
-            throw error;
-          }
-        } else {
-          lastError = error;
-          if (attempt >= this.options.maxRetries) {
-            throw error;
-          }
-        }
-
-        await this.maybeDelay(attempt);
-        attempt += 1;
-      } finally {
-        if (timeoutHandle) {
-          clearTimeout(timeoutHandle);
-        }
-      }
-    }
-
-    throw lastError instanceof Error ? lastError : new Error("HTTP request failed after retries");
-  }
-
-  get(url: string, options?: Omit<HttpRequestOptions, "data" | "json">): Promise<Response> {
-    return this.request("GET", url, options);
-  }
-
-  post(url: string, options: HttpRequestOptions = {}): Promise<Response> {
-    return this.request("POST", url, options);
-  }
-}
-
-export type HttpClient = SyncHttpClient;

apps/crawler/src/http/open-graph.ts

@@ -1,116 +0,0 @@
-import { config } from "@basango/domain/config";
-import { DEFAULT_OPEN_GRAPH_USER_AGENT } from "@basango/domain/constants";
-import { ArticleMetadata } from "@basango/domain/models";
-import { parse } from "node-html-parser";
-
-import { createAbsoluteUrl } from "#crawler/config/ranges";
-import { SyncHttpClient } from "#crawler/http/http-client";
-import { UserAgents } from "#crawler/http/user-agent";
-
-/**
- * Picks the first non-empty value from the provided array.
- * @param values - An array of string values
- */
-const pick = (values: Array<string | null | undefined>): string | undefined => {
-  for (const value of values) {
-    if (value && value.trim().length > 0) {
-      return value.trim();
-    }
-  }
-  return undefined;
-};
-
-/**
- * Extracts the content of a meta tag given its property or name.
- * @param root - The root HTML element
- * @param property - The property or name of the meta tag to extract
- */
-const extract = (root: ReturnType<typeof parse>, property: string): string | null => {
-  const selector = `meta[property='${property}'], meta[name='${property}']`;
-  const node = root.querySelector(selector);
-  if (!node) {
-    return null;
-  }
-  return node.getAttribute("content") ?? null;
-};
-
-/**
- * OpenGraph consumer for extracting Open Graph metadata from HTML pages.
- * Uses a synchronous HTTP client to fetch the HTML content.
- *
- * @author Bernard Ngandu <bernard@devscast.tech>
- */
-export class OpenGraph {
-  private readonly client: Pick<SyncHttpClient, "get">;
-
-  constructor() {
-    const settings = config.crawler.fetch.client;
-    const provider = new UserAgents(true, DEFAULT_OPEN_GRAPH_USER_AGENT);
-
-    this.client = new SyncHttpClient(settings, {
-      defaultHeaders: { "User-Agent": provider.og() },
-      userAgentProvider: provider,
-    });
-  }
-
-  /**
-   * Consume a URL and extract Open Graph metadata.
-   * @param url - The URL to fetch and parse
-   */
-  async consumeUrl(url: string): Promise<ArticleMetadata | undefined> {
-    try {
-      const response = await this.client.get(url);
-      const html = await response.text();
-      return OpenGraph.consumeHtml(html, url);
-    } catch {
-      return undefined;
-    }
-  }
-
-  /**
-   * Consume HTML content and extract Open Graph metadata.
-   * @param html - HTML content as a string
-   * @param url - Optional URL of the page
-   */
-  static consumeHtml(html: string, url: string): ArticleMetadata | undefined {
-    if (!html) {
-      return undefined;
-    }
-
-    const root = parse(html);
-    const title = pick([extract(root, "og:title"), root.querySelector("title")?.text]);
-    const description = pick([extract(root, "og:description"), extract(root, "description")]);
-    const image = pick([
-      extract(root, "og:image"),
-      root.querySelector("img")?.getAttribute("src") ?? null,
-    ]);
-    const canonical = pick([
-      extract(root, "og:url"),
-      root.querySelector("link[rel='canonical']")?.getAttribute("href") ?? null,
-      url ?? null,
-    ]);
-    const author = pick([extract(root, "article:author"), extract(root, "og:article:author")]);
-    const publishedAt = pick([
-      extract(root, "article:published_time"),
-      extract(root, "og:article:published_time"),
-    ]);
-    const updatedAt = pick([
-      extract(root, "article:modified_time"),
-      extract(root, "og:article:modified_time"),
-    ]);
-
-    if (!title && !description && !image && !canonical) {
-      return undefined;
-    }
-
-    return {
-      author,
-      description,
-      image: createAbsoluteUrl(url, image ?? "") || undefined,
-      publishedAt,
-      title,
-      updatedAt,
-      url: createAbsoluteUrl(url, canonical ?? "") || undefined,
-    } as ArticleMetadata;
-  }
-}

apps/crawler/src/http/user-agent.ts

@@ -1,41 +0,0 @@
-import { DEFAULT_OPEN_GRAPH_USER_AGENT, DEFAULT_USER_AGENT } from "@basango/domain/constants";
-
-/**
- * User agent provider with optional rotation.
- * Allows fetching a random user agent from a predefined list
- * or using a fallback user agent.
- *
- * @author Bernard Ngandu <bernard@devscast.tech>
- */
-export class UserAgents {
-  public static readonly USER_AGENTS: string[] = [
-    "Mozilla/5.0 (iPhone; CPU iPhone OS 10_4_8; like Mac OS X) AppleWebKit/603.39 (KHTML, like Gecko) Chrome/52.0.3638.271 Mobile Safari/537.5",
-    "Mozilla/50.0 (Linux; U; Linux x86_64; en-US) Gecko/20130401 Firefox/52.7",
-    "Mozilla/5.0 (Linux; U; Android 5.0; SM-P815 Build/LRX22G) AppleWebKit/600.4 (KHTML, like Gecko) Chrome/48.0.1562.260 Mobile Safari/600.0",
-    "Mozilla/5.0 (Windows; U; Windows NT 6.3;) AppleWebKit/533.34 (KHTML, like Gecko) Chrome/51.0.1883.215 Safari/533",
-    "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.3; x64; en-US Trident/4.0)",
-    "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_10_3) Gecko/20100101 Firefox/63.4",
-    "Mozilla/5.0 (Linux; Linux x86_64; en-US) AppleWebKit/603.50 (KHTML, like Gecko) Chrome/55.0.2226.116 Safari/601",
-    "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 7_8_3; en-US) Gecko/20100101 Firefox/68.9",
-    "Mozilla/5.0 (iPhone; CPU iPhone OS 8_9_8; like Mac OS X) AppleWebKit/603.34 (KHTML, like Gecko) Chrome/47.0.1126.107 Mobile Safari/602.7",
-    "Mozilla/5.0 (iPod; CPU iPod OS 8_2_0; like Mac OS X) AppleWebKit/601.40 (KHTML, like Gecko) Chrome/47.0.1590.178 Mobile Safari/535.2",
-  ];
-
-  private readonly rotate: boolean;
-  private readonly fallback: string;
-
-  constructor(rotate: boolean = true, fallback: string = DEFAULT_USER_AGENT) {
-    this.rotate = rotate;
-    this.fallback = fallback;
-  }
-
-  og(): string {
-    return DEFAULT_OPEN_GRAPH_USER_AGENT;
-  }
-
-  get(): string {
-    if (!this.rotate) return this.fallback;
-    const idx = Math.floor(Math.random() * UserAgents.USER_AGENTS.length);
-    return UserAgents.USER_AGENTS[idx]!;
-  }
-}

apps/crawler/src/runs/crawl-run-events.ts

@@ -1,23 +0,0 @@
-export type CrawlRunEventType =
-  | "crawler.heartbeat"
-  | "crawl.preparing"
-  | "crawl.started"
-  | "crawl.source.started"
-  | "crawl.article.persisted"
-  | "crawl.article.forwarded"
-  | "crawl.source.done"
-  | "crawl.done"
-  | "crawl.failed";
-
-export interface CrawlRunEvent {
-  articlesForwarded?: number;
-  articlesPersisted?: number;
-  durationMs?: number;
-  error?: string;
-  event: CrawlRunEventType;
-  nodeId?: string;
-  runId?: string;
-  sourceId?: string;
-  sources?: string[];
-  timestamp?: Date;
-}

apps/crawler/src/runs/crawl-run-reporter.ts

@@ -1,25 +0,0 @@
-import { logger } from "@basango/logger";
-
-import type { CrawlRunEvent } from "#crawler/runs/crawl-run-events";
-
-export interface CrawlRunReporter {
-  emit(event: CrawlRunEvent): Promise<void> | void;
-}
-
-export class NoopCrawlRunReporter implements CrawlRunReporter {
-  emit(): void {
-    // Intentionally empty until dashboard/API event transport is wired.
-  }
-}
-
-export class LoggingCrawlRunReporter implements CrawlRunReporter {
-  emit(event: CrawlRunEvent): void {
-    logger.info(
-      {
-        ...event,
-        timestamp: (event.timestamp ?? new Date()).toISOString(),
-      },
-      "Crawler run event",
-    );
-  }
-}