From git clone
to deploying your next Multi-tenant app.__

# Clone the repository
$ git clone https://github.com/ottabase/ottabase.git my-saas
$ cd my-saas

# Install all dependencies (pnpm workspaces handles everything)
$ pnpm install

# Build shared packages first - required before first dev run
$ pnpm build:pkg

$ pnpm dev

  ┌─────────────────────────────────────────────┐
  │  Vite dev server    → localhost:3003          │
  │  Wrangler worker    → localhost:3004          │
  └─────────────────────────────────────────────┘

# Or start them separately for more control:
$ pnpm dev:fe   # Vite only
$ pnpm dev:be   # Wrangler only

# Any app, any Wrangler environment - always local:
$ pnpm otta start otta-landing
$ pnpm otta start otta-web --env stage
$ pnpm otta new web my-app      # scaffold another app

# GUI path (default): open http://localhost:3003 → /__bootstrap__ wizard

# API path (CI / automation) - from repo root; path matches template app .env.local
$ SECRET=$(grep BOOTSTRAP_OWNER_SECRET apps/otta-web/.env.local | cut -d= -f2)
$ BASE=http://localhost:3004/__bootstrap__/api

# 1. Initialise - migrations, tables
$ curl -s -X POST $BASE/init -H "X-Bootstrap-Secret: $SECRET"

# 2. Seed - default roles and permissions
$ curl -s -X POST $BASE/seed -H "X-Bootstrap-Secret: $SECRET"

# 3. Create owner account
$ curl -s -X POST $BASE/create-owner \
    -H "X-Bootstrap-Secret: $SECRET" \
    -H "Content-Type: application/json" \
    -d '{"email":"you@example.com","password":"SecurePass1!","name":"You"}'

# 4. Finalise platform state
$ curl -s -X POST $BASE/finalize -H "X-Bootstrap-Secret: $SECRET"

# Done. Open localhost:3003 and log in.

# The first deploy, from your machine: resources, ids, build, deploy, secrets
$ pnpm otta deploy otta-web --owner-email you@my-saas.com --owner-password '…'
  ✓ D1, KV, R2 and queue created; their ids in wrangler.production.jsonc
  ✓ Built the packages it uses, then the app; deployed, tagged with the commit
  ✓ Secrets set; database bootstrapped with you as the owner
  ✓ https://otta-web-production.my-account.workers.dev

# Every push after that: connect the app in Cloudflare Workers Builds,
# deploy command:
$ pnpm otta deploy otta-web --ci

# A custom domain (optional): Cloudflare → Workers → Domains, then
$ pnpm otta deploy otta-web --url https://my-saas.com

import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
import { BaseModel } from '@ottabase/ottaorm';

// 1. Define the schema (Drizzle + SQLite)
export const projectsTable = sqliteTable('projects', {
  id:    text('id').primaryKey(),
  name:  text('name').notNull(),
  status: text('status').default('draft'),
  orgId: text('org_id'),
});

// 2. Define the model (fat model pattern)
export class Project extends BaseModel {
  static entity = 'projects';
  static table  = projectsTable;

  // Domain method - logic lives here, not in a service
  async publish() {
    this.set('status', 'published');
    return this.save();
  }
}

// 3. Export the table in ottabase/db/schema.ts
// 4. Register in worker/lib/db-utils.ts → initDbConnection
// 5. registerPolicy(...) + add to GENERIC_CRUD_ALLOWLIST
// 6. POST /api/ottaorm/init to create the table

import { createModelHooks } from '@ottabase/ottaorm/client';
import type { Project } from '../models/Project';

export const {
  useList:         useProjects,       // GET /api/ottaorm/projects
  useDetail:       useProject,        // GET /api/ottaorm/projects/:id
  useCreate:       useCreateProject,  // POST /api/ottaorm/projects
  useUpdate:       useUpdateProject,  // PUT /api/ottaorm/projects/:id
  useDelete:       useDeleteProject,  // DELETE /api/ottaorm/projects/:id
  useInfiniteList: useProjectsInfinite,
} = createModelHooks<Project>({ entityName: 'projects' });

import { initRLS, registerPolicy, RLSPolicies } from '@ottabase/ottaorm';

// Once: register policies. No policy, no access.
initRLS();
registerPolicy({ model: 'projects', policy: RLSPolicies.TenantScoped(false) });

// Per request: build the context from the VERIFIED session.
// memberOrganizationIds is required whenever organizationId is set.
const ctx = await getSecurityContext(request, session, env);
//    { userId, organizationId, appId, memberOrganizationIds, platformAdmin }

// The secure CRUD path merges the RLS filter last.
const res = await executeSecureCrudRequest(crudRequest, ctx);
// No policy → denied. Unresolved membership → denied.

# Local development
$ curl -X POST http://localhost:3004/api/ottaorm/init
  { "created": ["projects"], "updated": [], "unchanged": 11 }

# Production (run after deploy)
$ curl -X POST https://otta-web-production.my-account.workers.dev/api/ottaorm/init \
    -H "Authorization: Bearer $MIGRATION_SECRET"
# …or click Admin → Migrate

# Capabilities:
#   ✓ Create new tables
#   ✓ Add new columns (with DEFAULT values)
#   ✗ Rename or drop columns (use custom migration)

AGENTS.MD                  the rules every agent reads first
.claude/skills/
  ottabase-create-model    model + every registration step
  ottabase-crud            allowlist · createModelHooks · ModelCrud
  ottabase-form            model-driven forms, custom forms
  ottabase-rbac            permission + scope, fail-closed context
  ottabase-migration       auto vs custom migrations
  ottabase-theme           Brand Engine tokens, kits, dark mode
  ottabase-update          take a newer Ottabase and Pro, keep every local change
  …                        upload · email · queue · cron · component
                           package · testing · cloudflare

$ pnpm docs:llms
  ✓ llms.txt        index
  ✓ llms-full.txt   every guide and README, one file