Initial commit

2026-03-25 21:01:31 +03:00
commit a46a860f4e
111 changed files with 21805 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,41 @@
+# Dependencies
+**/node_modules/
+
+# Build outputs
+**/dist/
+**/dist-ssr/
+**/coverage/
+**/.cache/
+**/*.tsbuildinfo
+
+# Environment files
+**/.env
+**/.env.local
+**/.env.*.local
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor / IDE
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+# Generated OpenAPI (local runs; commit only if you want to publish the spec)
+openapi.generated.json
+openapi.llm.json
+tools/api-format-to-openapi/demo-output/
--- a/README.md
+++ b/README.md
@@ -0,0 +1,68 @@
+This repository keeps the current LLM-first CRUD generation architecture as the primary working baseline.
+
+It is not a new generator engine and it is not a compiler platform. The repository remains:
+
+- an AI generation context
+- an active generated and maintained fullstack CRUD project
+- `server/` as the active backend target output path
+- `client/` as the active frontend target output path
+- an LLM-first orchestration baseline with CLI-first framework bootstrap
+- a compact rule set that strengthens the existing pipeline with:
+  - `domain-summary.json`
+  - a physical root-level realm artifact
+  - a lightweight automated validation gate
+
+## Active knowledge blocks
+
+The active prompt corpus is intentionally normalized to six stable blocks:
+
+1. [prompts/general-prompt.md](prompts/general-prompt.md)
+2. [prompts/auth-rules.md](prompts/auth-rules.md)
+3. [prompts/backend-rules.md](prompts/backend-rules.md)
+4. [prompts/frontend-rules.md](prompts/frontend-rules.md)
+5. [prompts/runtime-rules.md](prompts/runtime-rules.md)
+6. [prompts/validation-rules.md](prompts/validation-rules.md)
+
+## Baseline contracts
+
+- `domain/*.dsl` is the source of truth for the domain model.
+- [domain-summary.json](domain-summary.json) is a derived artifact for LLM stabilization and validation.
+- [toir-realm.json](toir-realm.json) is the physical Keycloak bootstrap artifact baseline.
+- `server/` and `client/` are the active target output paths for this repository.
+- `server/` must remain a valid NestJS workspace baseline.
+- `client/` must remain a valid Vite React TypeScript workspace baseline.
+
+## Scaffold baseline
+
+- Generation remains LLM-first for orchestration and domain-derived feature code.
+- Framework bootstrap is CLI-first:
+  - backend baseline starts from official Nest CLI conventions
+  - frontend baseline starts from official Vite React TypeScript conventions
+- If `server/` or `client/` drift away from a valid workspace, repair the workspace baseline before generating more feature code.
+- Do not replace the framework workspace with a hand-written minimal skeleton.
+
+## Anti-regression contract
+
+- The active prompts define forbidden generation patterns, required invariants, and recovery rules for future agents.
+- Buildability is part of the baseline contract, not an optional follow-up.
+- Validation targets `domain/*.dsl` as reusable source inputs, while TOiR names remain project defaults/examples.
+
+## Repository layout
+
+- [docs/repository-structure.md](docs/repository-structure.md) explains the normalized folder structure.
+- Active prompts live in `prompts/`.
+- Helper scripts live in `tools/`.
+
+## Commands
+
+```bash
+npm run generate:domain-summary
+npm run validate:generation
+npm run validate:generation:runtime
+```
+
+`npm run validate:generation` now checks both contract shape and workspace validity. When dependencies are installed, it also verifies `npm run build` in `server/` and `client/`. If dependencies are missing, it reports build verification as skipped instead of pretending the baseline is fully green.
+
+## AID export (OpenAPI + app generator)
+
+HTTP-экспортёры для интеграции с AID: **`POST /aid/export/openapi`** (api-format → OpenAPI 3.0) и **`POST /aid/export/app`** (DSL → бандл файлов или `--apply`). Подробно: **[docs/AID_EXPORT_README.md](docs/AID_EXPORT_README.md)**.
--- a/client/.env.example
+++ b/client/.env.example
@@ -0,0 +1,5 @@
+VITE_API_URL=http://localhost:3000
+VITE_KEYCLOAK_URL=https://sso.greact.ru
+VITE_KEYCLOAK_REALM=toir
+VITE_KEYCLOAK_CLIENT_ID=toir-frontend
+
--- a/client/.eslintrc.cjs
+++ b/client/.eslintrc.cjs
@@ -0,0 +1,18 @@
+module.exports = {
+  root: true,
+  env: { browser: true, es2020: true },
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:react-hooks/recommended',
+  ],
+  ignorePatterns: ['dist', '.eslintrc.cjs'],
+  parser: '@typescript-eslint/parser',
+  plugins: ['react-refresh'],
+  rules: {
+    'react-refresh/only-export-components': [
+      'warn',
+      { allowConstantExport: true },
+    ],
+  },
+}
--- a/client/.gitignore
+++ b/client/.gitignore
@@ -0,0 +1,34 @@
+# Dependencies
+node_modules/
+
+# Build
+dist/
+dist-ssr/
+
+# Environment
+.env
+.env.local
+.env.*.local
+*.local
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor / IDE
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
--- a/client/README.md
+++ b/client/README.md
@@ -0,0 +1,30 @@
+# React + TypeScript + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/README.md) uses [Babel](https://babeljs.io/) for Fast Refresh
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend updating the configuration to enable type aware lint rules:
+
+- Configure the top-level `parserOptions` property like this:
+
+```js
+export default {
+  // other rules...
+  parserOptions: {
+    ecmaVersion: 'latest',
+    sourceType: 'module',
+    project: ['./tsconfig.json', './tsconfig.node.json'],
+    tsconfigRootDir: __dirname,
+  },
+}
+```
+
+- Replace `plugin:@typescript-eslint/recommended` to `plugin:@typescript-eslint/recommended-type-checked` or `plugin:@typescript-eslint/strict-type-checked`
+- Optionally add `plugin:@typescript-eslint/stylistic-type-checked`
+- Install [eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react) and add `plugin:react/recommended` & `plugin:react/jsx-runtime` to the `extends` list
--- a/client/index.html
+++ b/client/index.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Vite + React + TS</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
--- a/client/package-lock.json
+++ b/client/package-lock.json
--- a/client/package.json
+++ b/client/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "client",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@emotion/react": "^11.14.0",
+    "@emotion/styled": "^11.14.1",
+    "@mui/material": "^7.3.9",
+    "keycloak-js": "^26.2.3",
+    "ra-data-simple-rest": "^5.14.4",
+    "react": "^18.2.0",
+    "react-admin": "^5.14.4",
+    "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "@types/react": "^18.2.55",
+    "@types/react-dom": "^18.2.19",
+    "@typescript-eslint/eslint-plugin": "^6.21.0",
+    "@typescript-eslint/parser": "^6.21.0",
+    "@vitejs/plugin-react": "^4.2.1",
+    "eslint": "^8.56.0",
+    "eslint-plugin-react-hooks": "^4.6.0",
+    "eslint-plugin-react-refresh": "^0.4.5",
+    "typescript": "^5.2.2",
+    "vite": "^5.1.0"
+  }
+}
--- a/client/public/vite.svg
+++ b/client/public/vite.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -0,0 +1,49 @@
+import { Admin, Resource } from 'react-admin';
+import dataProvider from './dataProvider';
+import authProvider from './auth/authProvider';
+
+import { EquipmentTypeList } from './resources/equipment-type/EquipmentTypeList';
+import { EquipmentTypeCreate } from './resources/equipment-type/EquipmentTypeCreate';
+import { EquipmentTypeEdit } from './resources/equipment-type/EquipmentTypeEdit';
+import { EquipmentTypeShow } from './resources/equipment-type/EquipmentTypeShow';
+
+import { EquipmentList } from './resources/equipment/EquipmentList';
+import { EquipmentCreate } from './resources/equipment/EquipmentCreate';
+import { EquipmentEdit } from './resources/equipment/EquipmentEdit';
+import { EquipmentShow } from './resources/equipment/EquipmentShow';
+
+import { RepairOrderList } from './resources/repair-order/RepairOrderList';
+import { RepairOrderCreate } from './resources/repair-order/RepairOrderCreate';
+import { RepairOrderEdit } from './resources/repair-order/RepairOrderEdit';
+import { RepairOrderShow } from './resources/repair-order/RepairOrderShow';
+
+const App = () => (
+  <Admin dataProvider={dataProvider} authProvider={authProvider} requireAuth>
+    <Resource
+      name="equipment-types"
+      options={{ label: 'Виды оборудования' }}
+      list={EquipmentTypeList}
+      create={EquipmentTypeCreate}
+      edit={EquipmentTypeEdit}
+      show={EquipmentTypeShow}
+    />
+    <Resource
+      name="equipment"
+      options={{ label: 'Оборудование' }}
+      list={EquipmentList}
+      create={EquipmentCreate}
+      edit={EquipmentEdit}
+      show={EquipmentShow}
+    />
+    <Resource
+      name="repair-orders"
+      options={{ label: 'Заявки на ремонт' }}
+      list={RepairOrderList}
+      create={RepairOrderCreate}
+      edit={RepairOrderEdit}
+      show={RepairOrderShow}
+    />
+  </Admin>
+);
+
+export default App;
--- a/client/src/assets/react.svg
+++ b/client/src/assets/react.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>
--- a/client/src/auth/authProvider.ts
+++ b/client/src/auth/authProvider.ts
@@ -0,0 +1,45 @@
+import { AuthProvider } from 'react-admin';
+import {
+  forceReauthentication,
+  getIdentity,
+  getRealmRoles,
+  getValidAccessToken,
+  initKeycloak,
+  logoutFromKeycloak,
+} from './keycloak';
+
+const authProvider: AuthProvider = {
+  login: async () => {
+    await initKeycloak();
+  },
+
+  logout: async () => {
+    await logoutFromKeycloak();
+  },
+
+  checkAuth: async () => {
+    await getValidAccessToken();
+  },
+
+  checkError: async (error) => {
+    const status = error?.status;
+
+    if (status === 401) {
+      await forceReauthentication();
+      return Promise.reject(error);
+    }
+
+    if (status === 403) {
+      return Promise.resolve();
+    }
+
+    return Promise.resolve();
+  },
+
+  getIdentity: async () => getIdentity(),
+
+  getPermissions: async () => getRealmRoles(),
+};
+
+export default authProvider;
+
--- a/client/src/auth/keycloak.ts
+++ b/client/src/auth/keycloak.ts
@@ -0,0 +1,96 @@
+import Keycloak, { KeycloakTokenParsed } from 'keycloak-js';
+import { env } from '../config/env';
+
+interface RealmAccessTokenParsed extends KeycloakTokenParsed {
+  realm_access?: {
+    roles: string[];
+  };
+}
+
+const keycloak = new Keycloak({
+  url: env.keycloakUrl,
+  realm: env.keycloakRealm,
+  clientId: env.keycloakClientId,
+});
+
+let keycloakInitPromise: Promise<void> | null = null;
+let refreshInFlight: Promise<void> | null = null;
+
+export function getKeycloak() {
+  return keycloak;
+}
+
+export async function initKeycloak() {
+  if (!keycloakInitPromise) {
+    keycloakInitPromise = keycloak
+      .init({
+        onLoad: 'login-required',
+        pkceMethod: 'S256',
+        checkLoginIframe: false,
+      })
+      .then((authenticated) => {
+        if (!authenticated) {
+          return keycloak.login({ redirectUri: window.location.href });
+        }
+      });
+  }
+
+  await keycloakInitPromise;
+}
+
+async function refreshAccessToken(minValiditySeconds = 30) {
+  if (!refreshInFlight) {
+    refreshInFlight = keycloak
+      .updateToken(minValiditySeconds)
+      .then(() => undefined)
+      .finally(() => {
+        refreshInFlight = null;
+      });
+  }
+
+  await refreshInFlight;
+}
+
+export async function getValidAccessToken(minValiditySeconds = 30): Promise<string> {
+  await initKeycloak();
+
+  if (!keycloak.authenticated) {
+    await keycloak.login({ redirectUri: window.location.href });
+    throw new Error('User is not authenticated');
+  }
+
+  await refreshAccessToken(minValiditySeconds);
+
+  if (!keycloak.token) {
+    throw new Error('Missing access token');
+  }
+
+  return keycloak.token;
+}
+
+export async function forceReauthentication() {
+  keycloak.clearToken();
+  await keycloak.login({ redirectUri: window.location.href });
+}
+
+export async function logoutFromKeycloak() {
+  await keycloak.logout({ redirectUri: window.location.origin });
+}
+
+export function getRealmRoles(): string[] {
+  const parsed = keycloak.tokenParsed as RealmAccessTokenParsed | undefined;
+  const roles = parsed?.realm_access?.roles;
+  return Array.isArray(roles) ? roles : [];
+}
+
+export function getIdentity() {
+  const parsed = keycloak.tokenParsed as RealmAccessTokenParsed | undefined;
+  const id = parsed?.sub ?? 'unknown';
+  const fullName =
+    parsed?.name ??
+    parsed?.preferred_username ??
+    parsed?.email ??
+    'Unknown User';
+
+  return { id, fullName };
+}
--- a/client/src/config/env.ts
+++ b/client/src/config/env.ts
@@ -0,0 +1,24 @@
+const REQUIRED_ENV_KEYS = [
+  'VITE_API_URL',
+  'VITE_KEYCLOAK_URL',
+  'VITE_KEYCLOAK_REALM',
+  'VITE_KEYCLOAK_CLIENT_ID',
+] as const;
+
+type RequiredEnvKey = (typeof REQUIRED_ENV_KEYS)[number];
+
+function readRequiredEnv(key: RequiredEnvKey): string {
+  const value = import.meta.env[key];
+  if (!value || !value.trim()) {
+    throw new Error(`Missing required environment variable: ${key}`);
+  }
+  return value;
+}
+
+export const env = {
+  apiUrl: readRequiredEnv('VITE_API_URL'),
+  keycloakUrl: readRequiredEnv('VITE_KEYCLOAK_URL'),
+  keycloakRealm: readRequiredEnv('VITE_KEYCLOAK_REALM'),
+  keycloakClientId: readRequiredEnv('VITE_KEYCLOAK_CLIENT_ID'),
+} as const;
+
--- a/client/src/dataProvider.ts
+++ b/client/src/dataProvider.ts
@@ -0,0 +1,146 @@
+import { DataProvider, fetchUtils } from 'react-admin';
+import { getValidAccessToken } from './auth/keycloak';
+import { env } from './config/env';
+
+const apiUrl = env.apiUrl;
+
+const httpClient = async (url: string, options: fetchUtils.Options = {}) => {
+  const token = await getValidAccessToken();
+  const headers = new Headers(options.headers ?? { Accept: 'application/json' });
+  headers.set('Authorization', `Bearer ${token}`);
+
+  return fetchUtils.fetchJson(url, {
+    ...options,
+    headers,
+  });
+};
+
+function buildQueryString(query: Record<string, unknown>) {
+  const search = new URLSearchParams();
+  Object.entries(query).forEach(([key, val]) => {
+    if (val === undefined || val === null || val === '') return;
+    if (Array.isArray(val)) {
+      val.forEach((v) => {
+        if (v === undefined || v === null || v === '') return;
+        search.append(key, String(v));
+      });
+      return;
+    }
+    search.set(key, String(val));
+  });
+  return search.toString();
+}
+
+const dataProvider: DataProvider = {
+  getList: async (resource, params) => {
+    const { page, perPage } = params.pagination!;
+    const { field, order } = params.sort!;
+    const start = (page - 1) * perPage;
+    const end = page * perPage;
+
+    const query: Record<string, unknown> = {
+      _start: start,
+      _end: end,
+      _sort: field,
+      _order: order,
+      ...(params.filter ?? {}),
+    };
+
+    const queryString = buildQueryString(query);
+    const url = `${apiUrl}/${resource}?${queryString}`;
+    const { json, headers } = await httpClient(url);
+
+    const contentRange = headers.get('Content-Range');
+    const total = contentRange
+      ? parseInt(contentRange.split('/').pop() || '0', 10)
+      : json.length;
+
+    return { data: json, total };
+  },
+
+  getOne: async (resource, params) => {
+    const { json } = await httpClient(`${apiUrl}/${resource}/${params.id}`);
+    return { data: json };
+  },
+
+  getMany: async (resource, params) => {
+    const query = params.ids.map((id) => `id=${id}`).join('&');
+    const { json } = await httpClient(`${apiUrl}/${resource}?${query}`);
+    return { data: json };
+  },
+
+  getManyReference: async (resource, params) => {
+    const { page, perPage } = params.pagination!;
+    const { field, order } = params.sort!;
+    const start = (page - 1) * perPage;
+    const end = page * perPage;
+
+    const query: Record<string, unknown> = {
+      _start: start,
+      _end: end,
+      _sort: field,
+      _order: order,
+      [params.target]: params.id,
+      ...(params.filter ?? {}),
+    };
+
+    const queryString = buildQueryString(query);
+    const url = `${apiUrl}/${resource}?${queryString}`;
+    const { json, headers } = await httpClient(url);
+
+    const contentRange = headers.get('Content-Range');
+    const total = contentRange
+      ? parseInt(contentRange.split('/').pop() || '0', 10)
+      : json.length;
+
+    return { data: json, total };
+  },
+
+  create: async (resource, params) => {
+    const { json } = await httpClient(`${apiUrl}/${resource}`, {
+      method: 'POST',
+      body: JSON.stringify(params.data),
+    });
+    return { data: json };
+  },
+
+  update: async (resource, params) => {
+    const { json } = await httpClient(`${apiUrl}/${resource}/${params.id}`, {
+      method: 'PATCH',
+      body: JSON.stringify(params.data),
+    });
+    return { data: json };
+  },
+
+  updateMany: async (resource, params) => {
+    const responses = await Promise.all(
+      params.ids.map((id) =>
+        httpClient(`${apiUrl}/${resource}/${id}`, {
+          method: 'PATCH',
+          body: JSON.stringify(params.data),
+        })
+      )
+    );
+    return { data: responses.map(({ json }) => json.id) };
+  },
+
+  delete: async (resource, params) => {
+    const { json } = await httpClient(`${apiUrl}/${resource}/${params.id}`, {
+      method: 'DELETE',
+    });
+    return { data: json };
+  },
+
+  deleteMany: async (resource, params) => {
+    const responses = await Promise.all(
+      params.ids.map((id) =>
+        httpClient(`${apiUrl}/${resource}/${id}`, {
+          method: 'DELETE',
+        })
+      )
+    );
+    return { data: responses.map(({ json }) => json.id) };
+  },
+};
+
+export default dataProvider;
--- a/client/src/main.tsx
+++ b/client/src/main.tsx
@@ -0,0 +1,26 @@
+import React from 'react';
+import ReactDOM from 'react-dom/client';
+import App from './App';
+import { initKeycloak } from './auth/keycloak';
+
+const root = ReactDOM.createRoot(document.getElementById('root')!);
+
+async function bootstrap() {
+  await initKeycloak();
+
+  root.render(
+    <React.StrictMode>
+      <App />
+    </React.StrictMode>,
+  );
+}
+
+bootstrap().catch((error) => {
+  console.error('Failed to initialize authentication', error);
+
+  root.render(
+    <React.StrictMode>
+      <div>Authentication initialization failed. Check your environment variables.</div>
+    </React.StrictMode>,
+  );
+});
--- a/client/src/resources/equipment-type/EquipmentTypeCreate.tsx
+++ b/client/src/resources/equipment-type/EquipmentTypeCreate.tsx
@@ -0,0 +1,14 @@
+import { Create, SimpleForm, TextInput, NumberInput } from 'react-admin';
+
+
+export const EquipmentTypeCreate = () => (
+  <Create>
+    <SimpleForm>
+      <TextInput source="code" label="Код вида оборудования" isRequired />
+      <TextInput source="name" label="Наименование вида" isRequired />
+      <TextInput source="manufacturer" label="Производитель"  />
+      <NumberInput source="maintenanceIntervalHours" label="Периодичность ТО, моточасов" />
+      <NumberInput source="overhaulIntervalHours" label="Периодичность КР, моточасов" />
+    </SimpleForm>
+  </Create>
+);
--- a/client/src/resources/equipment-type/EquipmentTypeEdit.tsx
+++ b/client/src/resources/equipment-type/EquipmentTypeEdit.tsx
@@ -0,0 +1,14 @@
+import { Edit, SimpleForm, TextInput, NumberInput } from 'react-admin';
+
+
+export const EquipmentTypeEdit = () => (
+  <Edit>
+    <SimpleForm>
+      <TextInput source="code" label="Код вида оборудования" disabled />
+      <TextInput source="name" label="Наименование вида" isRequired />
+      <TextInput source="manufacturer" label="Производитель"  />
+      <NumberInput source="maintenanceIntervalHours" label="Периодичность ТО, моточасов" />
+      <NumberInput source="overhaulIntervalHours" label="Периодичность КР, моточасов" />
+    </SimpleForm>
+  </Edit>
+);
--- a/client/src/resources/equipment-type/EquipmentTypeList.tsx
+++ b/client/src/resources/equipment-type/EquipmentTypeList.tsx
@@ -0,0 +1,38 @@
+import {
+  List,
+  Datagrid,
+  TextField,
+  TextInput,
+  TopToolbar,
+  FilterButton,
+  CreateButton,
+  ExportButton,
+  NumberField
+} from 'react-admin';
+
+
+const equipmentTypeFilters = [
+  <TextInput key="q" source="q" label="Поиск" alwaysOn />,
+  <TextInput key="name" source="name" label="Наименование вида" />,
+  <TextInput key="manufacturer" source="manufacturer" label="Производитель" />
+];
+
+const EquipmentTypeListActions = () => (
+  <TopToolbar>
+    <FilterButton filters={equipmentTypeFilters} />
+    <CreateButton />
+    <ExportButton />
+  </TopToolbar>
+);
+
+export const EquipmentTypeList = () => (
+  <List actions={<EquipmentTypeListActions />} filters={equipmentTypeFilters} sort={{ field: 'code', order: 'ASC' }}>
+    <Datagrid rowClick="show">
+      <TextField source="code" label="Код вида оборудования" />
+      <TextField source="name" label="Наименование вида" />
+      <TextField source="manufacturer" label="Производитель" />
+      <NumberField source="maintenanceIntervalHours" label="Периодичность ТО, моточасов" />
+      <NumberField source="overhaulIntervalHours" label="Периодичность КР, моточасов" />
+    </Datagrid>
+  </List>
+);
--- a/client/src/resources/equipment-type/EquipmentTypeShow.tsx
+++ b/client/src/resources/equipment-type/EquipmentTypeShow.tsx
@@ -0,0 +1,13 @@
+import { Show, SimpleShowLayout, TextField, NumberField } from 'react-admin';
+
+export const EquipmentTypeShow = () => (
+  <Show>
+    <SimpleShowLayout>
+      <TextField source="code" label="Код вида оборудования" />
+      <TextField source="name" label="Наименование вида" />
+      <TextField source="manufacturer" label="Производитель" />
+      <NumberField source="maintenanceIntervalHours" label="Периодичность ТО, моточасов" />
+      <NumberField source="overhaulIntervalHours" label="Периодичность КР, моточасов" />
+    </SimpleShowLayout>
+  </Show>
+);
--- a/client/src/resources/equipment/EquipmentCreate.tsx
+++ b/client/src/resources/equipment/EquipmentCreate.tsx
@@ -0,0 +1,28 @@
+import { Create, SimpleForm, TextInput, NumberInput, DateInput, SelectInput, ReferenceInput, AutocompleteInput } from 'react-admin';
+
+const statusChoices = [
+  { id: 'Active', name: 'В эксплуатации' },
+  { id: 'Repair', name: 'В ремонте' },
+  { id: 'Reserve', name: 'В резерве' },
+  { id: 'WriteOff', name: 'Списано' },
+];
+
+export const EquipmentCreate = () => (
+  <Create>
+    <SimpleForm>
+      <TextInput source="inventoryNumber" label="Инвентарный номер" isRequired />
+      <TextInput source="serialNumber" label="Заводской (серийный) номер"  />
+      <TextInput source="name" label="Наименование единицы оборудования" isRequired />
+      <ReferenceInput source="equipmentTypeCode" reference="equipment-types">
+        <AutocompleteInput label="Вид оборудования" optionText={(record) => record.code ? `${record.code} — ${record.name ?? record.code}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+      </ReferenceInput>
+      <SelectInput source="status" label="Текущий статус" choices={statusChoices} emptyText="Не выбрано" />
+      <TextInput source="location" label="Место эксплуатации / скважина / куст"  />
+      <DateInput source="commissionedAt" label="Дата ввода в эксплуатацию" />
+      <NumberInput source="totalEngineHours" label="Общая наработка, моточасов" />
+      <NumberInput source="engineHoursSinceLastRepair" label="Наработка с последнего ремонта, моточасов" />
+      <DateInput source="lastRepairAt" label="Дата последнего ремонта" />
+      <TextInput source="notes" label="Примечания"  />
+    </SimpleForm>
+  </Create>
+);
--- a/client/src/resources/equipment/EquipmentEdit.tsx
+++ b/client/src/resources/equipment/EquipmentEdit.tsx
@@ -0,0 +1,29 @@
+import { Edit, SimpleForm, TextInput, NumberInput, DateInput, SelectInput, ReferenceInput, AutocompleteInput } from 'react-admin';
+
+const statusChoices = [
+  { id: 'Active', name: 'В эксплуатации' },
+  { id: 'Repair', name: 'В ремонте' },
+  { id: 'Reserve', name: 'В резерве' },
+  { id: 'WriteOff', name: 'Списано' },
+];
+
+export const EquipmentEdit = () => (
+  <Edit>
+    <SimpleForm>
+      <TextInput source="id" label="id" disabled />
+      <TextInput source="inventoryNumber" label="Инвентарный номер" isRequired />
+      <TextInput source="serialNumber" label="Заводской (серийный) номер"  />
+      <TextInput source="name" label="Наименование единицы оборудования" isRequired />
+      <ReferenceInput source="equipmentTypeCode" reference="equipment-types">
+        <AutocompleteInput label="Вид оборудования" optionText={(record) => record.code ? `${record.code} — ${record.name ?? record.code}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+      </ReferenceInput>
+      <SelectInput source="status" label="Текущий статус" choices={statusChoices} emptyText="Не выбрано" />
+      <TextInput source="location" label="Место эксплуатации / скважина / куст"  />
+      <DateInput source="commissionedAt" label="Дата ввода в эксплуатацию" />
+      <NumberInput source="totalEngineHours" label="Общая наработка, моточасов" />
+      <NumberInput source="engineHoursSinceLastRepair" label="Наработка с последнего ремонта, моточасов" />
+      <DateInput source="lastRepairAt" label="Дата последнего ремонта" />
+      <TextInput source="notes" label="Примечания"  />
+    </SimpleForm>
+  </Edit>
+);
--- a/client/src/resources/equipment/EquipmentList.tsx
+++ b/client/src/resources/equipment/EquipmentList.tsx
@@ -0,0 +1,66 @@
+import {
+  List,
+  Datagrid,
+  TextField,
+  TextInput,
+  TopToolbar,
+  FilterButton,
+  CreateButton,
+  ExportButton,
+  NumberField,
+  DateField,
+  SelectField,
+  ReferenceField,
+  SelectArrayInput,
+  ReferenceInput,
+  AutocompleteInput
+} from 'react-admin';
+
+const statusChoices = [
+  { id: 'Active', name: 'В эксплуатации' },
+  { id: 'Repair', name: 'В ремонте' },
+  { id: 'Reserve', name: 'В резерве' },
+  { id: 'WriteOff', name: 'Списано' },
+];
+
+const equipmentFilters = [
+  <TextInput key="q" source="q" label="Поиск" alwaysOn />,
+  <TextInput key="inventoryNumber" source="inventoryNumber" label="Инвентарный номер" />,
+  <TextInput key="serialNumber" source="serialNumber" label="Заводской (серийный) номер" />,
+  <TextInput key="name" source="name" label="Наименование единицы оборудования" />,
+  <ReferenceInput key="equipmentTypeCode" source="equipmentTypeCode" reference="equipment-types" label="Вид оборудования">
+    <AutocompleteInput optionText={(record) => record.code ? `${record.code} — ${record.name ?? record.code}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+  </ReferenceInput>,
+  <SelectArrayInput key="status" source="status" label="Текущий статус" choices={statusChoices} />,
+  <TextInput key="location" source="location" label="Место эксплуатации / скважина / куст" />,
+  <TextInput key="notes" source="notes" label="Примечания" />
+];
+
+const EquipmentListActions = () => (
+  <TopToolbar>
+    <FilterButton filters={equipmentFilters} />
+    <CreateButton />
+    <ExportButton />
+  </TopToolbar>
+);
+
+export const EquipmentList = () => (
+  <List actions={<EquipmentListActions />} filters={equipmentFilters} sort={{ field: 'inventoryNumber', order: 'ASC' }}>
+    <Datagrid rowClick="show">
+      <TextField source="id" label="id" />
+      <TextField source="inventoryNumber" label="Инвентарный номер" />
+      <TextField source="serialNumber" label="Заводской (серийный) номер" />
+      <TextField source="name" label="Наименование единицы оборудования" />
+      <ReferenceField source="equipmentTypeCode" reference="equipment-types" label="Вид оборудования" link="show">
+        <TextField source="code" />
+      </ReferenceField>
+      <SelectField source="status" label="Текущий статус" choices={statusChoices} />
+      <TextField source="location" label="Место эксплуатации / скважина / куст" />
+      <DateField source="commissionedAt" label="Дата ввода в эксплуатацию" />
+      <NumberField source="totalEngineHours" label="Общая наработка, моточасов" />
+      <NumberField source="engineHoursSinceLastRepair" label="Наработка с последнего ремонта, моточасов" />
+      <DateField source="lastRepairAt" label="Дата последнего ремонта" />
+      <TextField source="notes" label="Примечания" />
+    </Datagrid>
+  </List>
+);
--- a/client/src/resources/equipment/EquipmentShow.tsx
+++ b/client/src/resources/equipment/EquipmentShow.tsx
@@ -0,0 +1,28 @@
+import { Show, SimpleShowLayout, TextField, NumberField, DateField, SelectField, ReferenceField } from 'react-admin';
+
+const statusChoices = [
+  { id: 'Active', name: 'В эксплуатации' },
+  { id: 'Repair', name: 'В ремонте' },
+  { id: 'Reserve', name: 'В резерве' },
+  { id: 'WriteOff', name: 'Списано' },
+];
+export const EquipmentShow = () => (
+  <Show>
+    <SimpleShowLayout>
+      <TextField source="id" label="id" />
+      <TextField source="inventoryNumber" label="Инвентарный номер" />
+      <TextField source="serialNumber" label="Заводской (серийный) номер" />
+      <TextField source="name" label="Наименование единицы оборудования" />
+      <ReferenceField source="equipmentTypeCode" reference="equipment-types" label="Вид оборудования" link="show">
+        <TextField source="code" />
+      </ReferenceField>
+      <SelectField source="status" label="Текущий статус" choices={statusChoices} />
+      <TextField source="location" label="Место эксплуатации / скважина / куст" />
+      <DateField source="commissionedAt" label="Дата ввода в эксплуатацию" />
+      <NumberField source="totalEngineHours" label="Общая наработка, моточасов" />
+      <NumberField source="engineHoursSinceLastRepair" label="Наработка с последнего ремонта, моточасов" />
+      <DateField source="lastRepairAt" label="Дата последнего ремонта" />
+      <TextField source="notes" label="Примечания" />
+    </SimpleShowLayout>
+  </Show>
+);
--- a/client/src/resources/repair-order/RepairOrderCreate.tsx
+++ b/client/src/resources/repair-order/RepairOrderCreate.tsx
@@ -0,0 +1,38 @@
+import { Create, SimpleForm, TextInput, NumberInput, DateInput, SelectInput, ReferenceInput, AutocompleteInput } from 'react-admin';
+
+const repairKindChoices = [
+  { id: 'TO', name: 'Техническое обслуживание' },
+  { id: 'TR', name: 'Текущий ремонт' },
+  { id: 'TRE', name: 'Текущий расширенный ремонт' },
+  { id: 'KR', name: 'Капитальный ремонт' },
+  { id: 'AR', name: 'Аварийный ремонт' },
+  { id: 'MP', name: 'Метрологическая поверка' },
+];
+
+const statusChoices = [
+  { id: 'Draft', name: 'Черновик' },
+  { id: 'Approved', name: 'Утверждена' },
+  { id: 'InWork', name: 'В работе' },
+  { id: 'Done', name: 'Выполнена' },
+  { id: 'Cancelled', name: 'Отменена' },
+];
+
+export const RepairOrderCreate = () => (
+  <Create>
+    <SimpleForm>
+      <TextInput source="number" label="Номер заявки" isRequired />
+      <ReferenceInput source="equipmentId" reference="equipment">
+        <AutocompleteInput label="Оборудование" optionText={(record) => record.inventoryNumber ? `${record.inventoryNumber} — ${record.name ?? record.inventoryNumber}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+      </ReferenceInput>
+      <SelectInput source="repairKind" label="Вид ремонта" choices={repairKindChoices} emptyText="Не выбрано" />
+      <SelectInput source="status" label="Статус" choices={statusChoices} emptyText="Не выбрано" />
+      <DateInput source="plannedAt" label="Плановая дата начала" />
+      <DateInput source="startedAt" label="Фактическая дата начала" />
+      <DateInput source="completedAt" label="Фактическая дата завершения" />
+      <TextInput source="contractor" label="Подрядная организация (если внешний ремонт)"  />
+      <NumberInput source="engineHoursAtRepair" label="Наработка на момент ремонта, моточасов" />
+      <TextInput source="description" label="Описание работ / дефекта"  />
+      <TextInput source="notes" label="Примечания"  />
+    </SimpleForm>
+  </Create>
+);
--- a/client/src/resources/repair-order/RepairOrderEdit.tsx
+++ b/client/src/resources/repair-order/RepairOrderEdit.tsx
@@ -0,0 +1,39 @@
+import { Edit, SimpleForm, TextInput, NumberInput, DateInput, SelectInput, ReferenceInput, AutocompleteInput } from 'react-admin';
+
+const repairKindChoices = [
+  { id: 'TO', name: 'Техническое обслуживание' },
+  { id: 'TR', name: 'Текущий ремонт' },
+  { id: 'TRE', name: 'Текущий расширенный ремонт' },
+  { id: 'KR', name: 'Капитальный ремонт' },
+  { id: 'AR', name: 'Аварийный ремонт' },
+  { id: 'MP', name: 'Метрологическая поверка' },
+];
+
+const statusChoices = [
+  { id: 'Draft', name: 'Черновик' },
+  { id: 'Approved', name: 'Утверждена' },
+  { id: 'InWork', name: 'В работе' },
+  { id: 'Done', name: 'Выполнена' },
+  { id: 'Cancelled', name: 'Отменена' },
+];
+
+export const RepairOrderEdit = () => (
+  <Edit>
+    <SimpleForm>
+      <TextInput source="id" label="id" disabled />
+      <TextInput source="number" label="Номер заявки" isRequired />
+      <ReferenceInput source="equipmentId" reference="equipment">
+        <AutocompleteInput label="Оборудование" optionText={(record) => record.inventoryNumber ? `${record.inventoryNumber} — ${record.name ?? record.inventoryNumber}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+      </ReferenceInput>
+      <SelectInput source="repairKind" label="Вид ремонта" choices={repairKindChoices} emptyText="Не выбрано" />
+      <SelectInput source="status" label="Статус" choices={statusChoices} emptyText="Не выбрано" />
+      <DateInput source="plannedAt" label="Плановая дата начала" />
+      <DateInput source="startedAt" label="Фактическая дата начала" />
+      <DateInput source="completedAt" label="Фактическая дата завершения" />
+      <TextInput source="contractor" label="Подрядная организация (если внешний ремонт)"  />
+      <NumberInput source="engineHoursAtRepair" label="Наработка на момент ремонта, моточасов" />
+      <TextInput source="description" label="Описание работ / дефекта"  />
+      <TextInput source="notes" label="Примечания"  />
+    </SimpleForm>
+  </Edit>
+);
--- a/client/src/resources/repair-order/RepairOrderList.tsx
+++ b/client/src/resources/repair-order/RepairOrderList.tsx
@@ -0,0 +1,77 @@
+import {
+  List,
+  Datagrid,
+  TextField,
+  TextInput,
+  TopToolbar,
+  FilterButton,
+  CreateButton,
+  ExportButton,
+  NumberField,
+  DateField,
+  SelectField,
+  ReferenceField,
+  SelectArrayInput,
+  SelectInput,
+  ReferenceInput,
+  AutocompleteInput
+} from 'react-admin';
+
+const repairKindChoices = [
+  { id: 'TO', name: 'Техническое обслуживание' },
+  { id: 'TR', name: 'Текущий ремонт' },
+  { id: 'TRE', name: 'Текущий расширенный ремонт' },
+  { id: 'KR', name: 'Капитальный ремонт' },
+  { id: 'AR', name: 'Аварийный ремонт' },
+  { id: 'MP', name: 'Метрологическая поверка' },
+];
+
+const statusChoices = [
+  { id: 'Draft', name: 'Черновик' },
+  { id: 'Approved', name: 'Утверждена' },
+  { id: 'InWork', name: 'В работе' },
+  { id: 'Done', name: 'Выполнена' },
+  { id: 'Cancelled', name: 'Отменена' },
+];
+
+const repairOrderFilters = [
+  <TextInput key="q" source="q" label="Поиск" alwaysOn />,
+  <TextInput key="number" source="number" label="Номер заявки" />,
+  <ReferenceInput key="equipmentId" source="equipmentId" reference="equipment" label="Оборудование">
+    <AutocompleteInput optionText={(record) => record.inventoryNumber ? `${record.inventoryNumber} — ${record.name ?? record.inventoryNumber}` : (record.name ?? record.id)} filterToQuery={(searchText) => ({ q: searchText })} />
+  </ReferenceInput>,
+  <SelectInput key="repairKind" source="repairKind" label="Вид ремонта" choices={repairKindChoices} emptyText="Все" />,
+  <SelectArrayInput key="status" source="status" label="Статус" choices={statusChoices} />,
+  <TextInput key="contractor" source="contractor" label="Подрядная организация (если внешний ремонт)" />,
+  <TextInput key="description" source="description" label="Описание работ / дефекта" />,
+  <TextInput key="notes" source="notes" label="Примечания" />
+];
+
+const RepairOrderListActions = () => (
+  <TopToolbar>
+    <FilterButton filters={repairOrderFilters} />
+    <CreateButton />
+    <ExportButton />
+  </TopToolbar>
+);
+
+export const RepairOrderList = () => (
+  <List actions={<RepairOrderListActions />} filters={repairOrderFilters} sort={{ field: 'number', order: 'ASC' }}>
+    <Datagrid rowClick="show">
+      <TextField source="id" label="id" />
+      <TextField source="number" label="Номер заявки" />
+      <ReferenceField source="equipmentId" reference="equipment" label="Оборудование" link="show">
+        <TextField source="inventoryNumber" />
+      </ReferenceField>
+      <SelectField source="repairKind" label="Вид ремонта" choices={repairKindChoices} />
+      <SelectField source="status" label="Статус" choices={statusChoices} />
+      <DateField source="plannedAt" label="Плановая дата начала" />
+      <DateField source="startedAt" label="Фактическая дата начала" />
+      <DateField source="completedAt" label="Фактическая дата завершения" />
+      <TextField source="contractor" label="Подрядная организация (если внешний ремонт)" />
+      <NumberField source="engineHoursAtRepair" label="Наработка на момент ремонта, моточасов" />
+      <TextField source="description" label="Описание работ / дефекта" />
+      <TextField source="notes" label="Примечания" />
+    </Datagrid>
+  </List>
+);
--- a/client/src/resources/repair-order/RepairOrderShow.tsx
+++ b/client/src/resources/repair-order/RepairOrderShow.tsx
@@ -0,0 +1,38 @@
+import { Show, SimpleShowLayout, TextField, NumberField, DateField, SelectField, ReferenceField } from 'react-admin';
+
+const repairKindChoices = [
+  { id: 'TO', name: 'Техническое обслуживание' },
+  { id: 'TR', name: 'Текущий ремонт' },
+  { id: 'TRE', name: 'Текущий расширенный ремонт' },
+  { id: 'KR', name: 'Капитальный ремонт' },
+  { id: 'AR', name: 'Аварийный ремонт' },
+  { id: 'MP', name: 'Метрологическая поверка' },
+];
+
+const statusChoices = [
+  { id: 'Draft', name: 'Черновик' },
+  { id: 'Approved', name: 'Утверждена' },
+  { id: 'InWork', name: 'В работе' },
+  { id: 'Done', name: 'Выполнена' },
+  { id: 'Cancelled', name: 'Отменена' },
+];
+export const RepairOrderShow = () => (
+  <Show>
+    <SimpleShowLayout>
+      <TextField source="id" label="id" />
+      <TextField source="number" label="Номер заявки" />
+      <ReferenceField source="equipmentId" reference="equipment" label="Оборудование" link="show">
+        <TextField source="inventoryNumber" />
+      </ReferenceField>
+      <SelectField source="repairKind" label="Вид ремонта" choices={repairKindChoices} />
+      <SelectField source="status" label="Статус" choices={statusChoices} />
+      <DateField source="plannedAt" label="Плановая дата начала" />
+      <DateField source="startedAt" label="Фактическая дата начала" />
+      <DateField source="completedAt" label="Фактическая дата завершения" />
+      <TextField source="contractor" label="Подрядная организация (если внешний ремонт)" />
+      <NumberField source="engineHoursAtRepair" label="Наработка на момент ремонта, моточасов" />
+      <TextField source="description" label="Описание работ / дефекта" />
+      <TextField source="notes" label="Примечания" />
+    </SimpleShowLayout>
+  </Show>
+);
--- a/client/src/vite-env.d.ts
+++ b/client/src/vite-env.d.ts
@@ -0,0 +1,12 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_API_URL: string;
+  readonly VITE_KEYCLOAK_URL: string;
+  readonly VITE_KEYCLOAK_REALM: string;
+  readonly VITE_KEYCLOAK_CLIENT_ID: string;
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv;
+}
--- a/client/tsconfig.json
+++ b/client/tsconfig.json
@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src"],
+  "references": [{ "path": "./tsconfig.node.json" }]
+}
--- a/client/tsconfig.node.json
+++ b/client/tsconfig.node.json
@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "composite": true,
+    "skipLibCheck": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "strict": true
+  },
+  "include": ["vite.config.ts"]
+}
--- a/client/vite.config.ts
+++ b/client/vite.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// https://vitejs.dev/config/
+export default defineConfig({
+  plugins: [react()],
+})
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,16 @@
+services:
+  postgres:
+    image: postgres:16
+    container_name: toir-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: toir
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+
+volumes:
+  postgres-data:
--- a/docs/AID_EXPORT_README.md
+++ b/docs/AID_EXPORT_README.md
@@ -0,0 +1,164 @@
+# AID: экспорт OpenAPI и генератор приложения
+
+В репозитории добавлены **сервисы-экспортёры** для интеграции с **AID** (или любым другим клиентом по HTTP): автоматическое получение **OpenAPI 3.0** из доменного **api-format** и выдача **сгенерированного fullstack-приложения** из **DSL** без ручного копирования файлов.
+
+---
+
+## Что сделано
+
+| Компонент | Назначение |
+|-----------|------------|
+| **`POST /aid/export/openapi`** (NestJS) | На вход JSON **api-format** → на выход документ **OpenAPI 3.0** в поле `openapi`. |
+| **`POST /aid/export/app`** (NestJS) | На вход текст **DSL** → либо JSON-бандл всех сгенерированных файлов (`files`), либо запись в рабочую копию репозитория (`apply: true`, опционально). |
+| **`tools/api-format-to-openapi/`** | CLI и промпт для LLM: тот же конвертер, что вызывает Nest. |
+| **`generation/generate.mjs`** | Новый флаг **`--print-bundle-json`**: вывод в stdout JSON с `entityCount`, `enumCount`, `files` — без записи на диск (аналог «сухого» экспорта для AID). |
+| **`server/src/aid-export/`** | Модуль Nest: контроллер, сервис, краткая справка в `README.md` рядом с кодом. |
+
+Ветка с этими изменениями: **`add_aid_exporters`**.
+
+---
+
+## Требования к запуску
+
+1. Репозиторий клонирован целиком (есть `generation/`, `tools/`, `server/`, `client/`).
+2. Backend запускается из каталога **`server/`** (`npm run start` / `start:dev`), чтобы относительные пути `../generation/generate.mjs` и `../tools/api-format-to-openapi/convert.mjs` были корректны.
+3. Для режима OpenAPI через LLM на сервере нужны **`OPENAI_API_KEY`** (и при необходимости `OPENAI_MODEL`, `OPENAI_BASE_URL`).
+
+---
+
+## Переменные окружения (`server/.env`)
+
+| Переменная | Зачем |
+|------------|--------|
+| `AID_EXPORT_API_KEY` | Если задана, к **`/aid/export/*`** нужен заголовок **`X-AID-Export-Key`** с тем же значением. |
+| `AID_GENERATOR_ALLOW_APPLY` | Должна быть **`1`** или **`true`**, иначе **`POST /aid/export/app`** с **`apply: true`** вернёт **403** (защита от случайной перезаписи репозитория на сервере). |
+| `OPENAI_API_KEY` | Для `POST /aid/export/openapi` с **`"mode": "llm"`**. |
+
+Остальное как для обычного бэкенда (`DATABASE_URL`, `PORT` и т.д.).
+
+---
+
+## HTTP API (интеграция с AID)
+
+Базовый URL: `http://<host>:<port>` (например `http://localhost:3000`).
+
+### 1. OpenAPI из api-format
+
+**`POST /aid/export/openapi`**
+
+```http
+Content-Type: application/json
+X-AID-Export-Key: <если задан AID_EXPORT_API_KEY>
+```
+
+```json
+{
+  "apiFormat": {
+    "apiFormatVersion": "1",
+    "info": { "title": "API", "version": "1.0.0" },
+    "server": { "basePath": "/api" },
+    "resources": []
+  },
+  "mode": "deterministic"
+}
+```
+
+- **`mode`**: `deterministic` (по умолчанию) — маппинг в коде для схемы версии `1`; **`llm`** — вызов OpenAI по промпту из `tools/api-format-to-openapi/prompts/llm-system.md`.
+
+**Ответ:** `{ "openapi": { "openapi": "3.0.3", ... } }`
+
+Пример входа для теста: `tools/api-format-to-openapi/examples/api-format.example.json` (подставьте как значение `apiFormat`).
+
+### 2. Генератор приложения из DSL
+
+**`POST /aid/export/app`**
+
+```json
+{
+  "dsl": "domain TOiR {\n  ...\n}\n",
+  "apply": false
+}
+```
+
+- **`apply: false`** (рекомендуется для AID): в ответе **`files`** — объект «путь от корня репо → текст файла». Диск на сервере не меняется.
+- **`apply: true`**: выполняется запись файлов как у `npm run generate:from-dsl` с `--apply`; нужен **`AID_GENERATOR_ALLOW_APPLY=1`**.
+
+**Ответ (бандл):** `{ "applied": false, "entityCount": N, "enumCount": M, "files": { ... } }`  
+**Ответ (apply):** `{ "applied": true, "message": "Generated ..." }`
+
+Эталон DSL: `examples/TOiR.domain.dsl`.
+
+---
+
+## CLI (без Nest)
+
+### Пошаговая демонстрация в терминале
+
+```bash
+cd tools/api-format-to-openapi
+npm run demo
+# или с паузой после каждого шага (Enter):
+npm run demo:pause
+```
+
+Показывает входной **api-format**, логику маппинга, запуск конвертера и структуру **OpenAPI**; результат — `demo-output/openapi.json`.
+
+### api-format → OpenAPI
+
+```bash
+cd tools/api-format-to-openapi
+node convert.mjs --in examples/api-format.example.json --out ../../openapi.generated.json
+```
+
+LLM:
+
+```bash
+set OPENAI_API_KEY=sk-...
+node convert.mjs --mode llm --in your-api-format.json --out ../../openapi.llm.json
+```
+
+Подробнее: **`tools/api-format-to-openapi/README.md`**.
+
+### DSL → JSON-бандл
+
+Из **корня репозитория**:
+
+```bash
+node generation/generate.mjs --print-bundle-json --dsl examples/TOiR.domain.dsl > bundle.json
+```
+
+Из **`server/`**:
+
+```bash
+npm run generate:bundle-json > ../bundle.json
+```
+
+Применить генератор к файлам на диске (как раньше):
+
+```bash
+cd server
+npm run generate:from-dsl
+```
+
+---
+
+## Типичный сценарий для AID
+
+1. AID уже сформировал **api-format** (как у вас принято после DTO).
+2. AID вызывает **`POST /aid/export/openapi`** → получает **OpenAPI 3.0** → сохраняет в проект / отдаёт в Swagger / в реестр.
+3. Для кода: AID передаёт **DSL** в **`POST /aid/export/app`** с **`apply: false`** → забирает **`files`** → применяет у себя (git apply, распаковка, PR).
+4. Запись **`apply: true`** на общем сервере используйте только в доверенной среде и с **`AID_GENERATOR_ALLOW_APPLY`**.
+
+---
+
+## Где смотреть код и короткую справку
+
+- Полное описание эндпоинтов рядом с реализацией: **`server/src/aid-export/README.md`**
+- Общий dev-workflow (в т.ч. упоминание AID): **`generation/dev-workflow.md`**
+
+---
+
+## Ограничения и дальнейшие шаги
+
+- Пример **api-format** в репозитории — **учебный**; под ваш продакшен-формат может понадобиться расширить маппинг в `convert.mjs` или отточить промпт **`llm-system.md`**.
+- Ответ **`/aid/export/app`** с большим числом сущностей может быть объёмным; при необходимости добавьте сжатие, отдельное хранилище артефактов или пагинацию по файлам — контракт с AID лучше зафиксировать отдельно.
--- a/docs/repository-structure.md
+++ b/docs/repository-structure.md
@@ -0,0 +1,35 @@
+# Repository Structure
+
+`KIS-TOiR` keeps the existing LLM-first generation philosophy and organizes the repository by meaning:
+
+- `domain/`
+  - canonical DSL inputs
+  - DSL specification
+- `prompts/`
+  - active prompt corpus used to drive generation
+- `docs/`
+  - overview and repository-level architecture notes
+- `tools/`
+  - helper scripts for summary generation and validation
+- `server/`
+  - active backend target output
+- `client/`
+  - active frontend target output
+
+The repository keeps LLM-first generation orchestration, but framework bootstrap is CLI-first:
+
+- `server/` must remain a valid NestJS workspace baseline
+- `client/` must remain a valid Vite React TypeScript workspace baseline
+- repair a broken workspace before applying more domain-derived generation changes
+- future agents must treat forbidden generation patterns in `prompts/` as contract violations, not suggestions
+
+Root-level files stay limited to repository-level artifacts such as:
+
+- `README.md`
+- `package.json`
+- `docker-compose.yml`
+- `domain-summary.json`
+- `toir-realm.json`
+- `.gitignore`
+
+The repository does not introduce a new generator engine or compiler platform. It keeps the current LLM-first pipeline and makes it cleaner, more explicit, and easier to navigate.
--- a/domain-summary.json
+++ b/domain-summary.json
@@ -0,0 +1,324 @@
+{
+  "sourceFiles": [
+    "domain/TOiR.domain.dsl"
+  ],
+  "entities": [
+    {
+      "name": "EquipmentType",
+      "primaryKey": "code",
+      "fields": [
+        {
+          "name": "code",
+          "type": "string",
+          "required": true,
+          "unique": true,
+          "default": null
+        },
+        {
+          "name": "name",
+          "type": "string",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "manufacturer",
+          "type": "string",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "maintenanceIntervalHours",
+          "type": "integer",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "overhaulIntervalHours",
+          "type": "integer",
+          "required": false,
+          "unique": false,
+          "default": null
+        }
+      ],
+      "foreignKeys": []
+    },
+    {
+      "name": "Equipment",
+      "primaryKey": "id",
+      "fields": [
+        {
+          "name": "id",
+          "type": "uuid",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "inventoryNumber",
+          "type": "string",
+          "required": true,
+          "unique": true,
+          "default": null
+        },
+        {
+          "name": "serialNumber",
+          "type": "string",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "name",
+          "type": "string",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "equipmentTypeCode",
+          "type": "string",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "status",
+          "type": "EquipmentStatus",
+          "required": true,
+          "unique": false,
+          "default": "Active"
+        },
+        {
+          "name": "location",
+          "type": "string",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "commissionedAt",
+          "type": "date",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "totalEngineHours",
+          "type": "decimal",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "engineHoursSinceLastRepair",
+          "type": "decimal",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "lastRepairAt",
+          "type": "date",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "notes",
+          "type": "text",
+          "required": false,
+          "unique": false,
+          "default": null
+        }
+      ],
+      "foreignKeys": [
+        {
+          "field": "equipmentTypeCode",
+          "references": {
+            "entity": "EquipmentType",
+            "field": "code"
+          }
+        }
+      ]
+    },
+    {
+      "name": "RepairOrder",
+      "primaryKey": "id",
+      "fields": [
+        {
+          "name": "id",
+          "type": "uuid",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "number",
+          "type": "string",
+          "required": true,
+          "unique": true,
+          "default": null
+        },
+        {
+          "name": "equipmentId",
+          "type": "uuid",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "repairKind",
+          "type": "RepairKind",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "status",
+          "type": "RepairOrderStatus",
+          "required": true,
+          "unique": false,
+          "default": "Draft"
+        },
+        {
+          "name": "plannedAt",
+          "type": "date",
+          "required": true,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "startedAt",
+          "type": "date",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "completedAt",
+          "type": "date",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "contractor",
+          "type": "string",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "engineHoursAtRepair",
+          "type": "decimal",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "description",
+          "type": "text",
+          "required": false,
+          "unique": false,
+          "default": null
+        },
+        {
+          "name": "notes",
+          "type": "text",
+          "required": false,
+          "unique": false,
+          "default": null
+        }
+      ],
+      "foreignKeys": [
+        {
+          "field": "equipmentId",
+          "references": {
+            "entity": "Equipment",
+            "field": "id"
+          }
+        }
+      ]
+    }
+  ],
+  "enums": [
+    {
+      "name": "EquipmentStatus",
+      "values": [
+        {
+          "name": "Active",
+          "label": "В эксплуатации"
+        },
+        {
+          "name": "Repair",
+          "label": "В ремонте"
+        },
+        {
+          "name": "Reserve",
+          "label": "В резерве"
+        },
+        {
+          "name": "WriteOff",
+          "label": "Списано"
+        }
+      ]
+    },
+    {
+      "name": "RepairKind",
+      "values": [
+        {
+          "name": "TO",
+          "label": "Техническое обслуживание"
+        },
+        {
+          "name": "TR",
+          "label": "Текущий ремонт"
+        },
+        {
+          "name": "TRE",
+          "label": "Текущий расширенный ремонт"
+        },
+        {
+          "name": "KR",
+          "label": "Капитальный ремонт"
+        },
+        {
+          "name": "AR",
+          "label": "Аварийный ремонт"
+        },
+        {
+          "name": "MP",
+          "label": "Метрологическая поверка"
+        }
+      ]
+    },
+    {
+      "name": "RepairOrderStatus",
+      "values": [
+        {
+          "name": "Draft",
+          "label": "Черновик"
+        },
+        {
+          "name": "Approved",
+          "label": "Утверждена"
+        },
+        {
+          "name": "InWork",
+          "label": "В работе"
+        },
+        {
+          "name": "Done",
+          "label": "Выполнена"
+        },
+        {
+          "name": "Cancelled",
+          "label": "Отменена"
+        }
+      ]
+    }
+  ]
+}
--- a/domain/TOiR.domain.dsl
+++ b/domain/TOiR.domain.dsl
@@ -0,0 +1,236 @@
+/*
+  КИС ТОиР — демонстрационная схема доменной модели
+  Сущности: Equipment (Оборудование), EquipmentType (Вид оборудования), RepairOrder (Заявка на ремонт)
+*/
+
+enum EquipmentStatus {
+  value Active {
+    label "В эксплуатации";
+  }
+  value Repair {
+    label "В ремонте";
+  }
+  value Reserve {
+    label "В резерве";
+  }
+  value WriteOff {
+    label "Списано";
+  }
+}
+
+enum RepairKind {
+  value TO {
+    label "Техническое обслуживание";
+  }
+  value TR {
+    label "Текущий ремонт";
+  }
+  value TRE {
+    label "Текущий расширенный ремонт";
+  }
+  value KR {
+    label "Капитальный ремонт";
+  }
+  value AR {
+    label "Аварийный ремонт";
+  }
+  value MP {
+    label "Метрологическая поверка";
+  }
+}
+
+enum RepairOrderStatus {
+  value Draft {
+    label "Черновик";
+  }
+  value Approved {
+    label "Утверждена";
+  }
+  value InWork {
+    label "В работе";
+  }
+  value Done {
+    label "Выполнена";
+  }
+  value Cancelled {
+    label "Отменена";
+  }
+}
+
+entity EquipmentType {
+  description "Вид (марка) оборудования — нормативный справочник НСИ";
+
+  attribute code {
+    key primary;
+    description "Код вида оборудования";
+    type string;
+    is required;
+    is unique;
+  }
+
+  attribute name {
+    description "Наименование вида";
+    type string;
+    is required;
+  }
+
+  attribute manufacturer {
+    description "Производитель";
+    type string;
+  }
+
+  attribute maintenanceIntervalHours {
+    description "Периодичность ТО, моточасов";
+    type integer;
+  }
+
+  attribute overhaulIntervalHours {
+    description "Периодичность КР, моточасов";
+    type integer;
+  }
+}
+
+entity Equipment {
+  description "Единица оборудования — объект ремонта и технического обслуживания";
+
+  attribute id {
+    type uuid;
+    key primary;
+  }
+
+  attribute inventoryNumber {
+    description "Инвентарный номер";
+    type string;
+    is required;
+    is unique;
+  }
+
+  attribute serialNumber {
+    description "Заводской (серийный) номер";
+    type string;
+  }
+
+  attribute name {
+    description "Наименование единицы оборудования";
+    type string;
+    is required;
+  }
+
+  attribute equipmentTypeCode {
+    type string;
+    key foreign {
+      relates EquipmentType.code;
+    }
+    is required;
+  }
+
+  attribute status {
+    description "Текущий статус";
+    type EquipmentStatus;
+    default Active;
+    is required;
+  }
+
+  attribute location {
+    description "Место эксплуатации / скважина / куст";
+    type string;
+  }
+
+  attribute commissionedAt {
+    description "Дата ввода в эксплуатацию";
+    type date;
+  }
+
+  attribute totalEngineHours {
+    description "Общая наработка, моточасов";
+    type decimal;
+  }
+
+  attribute engineHoursSinceLastRepair {
+    description "Наработка с последнего ремонта, моточасов";
+    type decimal;
+  }
+
+  attribute lastRepairAt {
+    description "Дата последнего ремонта";
+    type date;
+  }
+
+  attribute notes {
+    description "Примечания";
+    type text;
+  }
+}
+
+entity RepairOrder {
+  description "Заявка на ремонт — формируется по ППР или по факту обнаруженного дефекта";
+
+  attribute id {
+    type uuid;
+    key primary;
+  }
+
+  attribute number {
+    description "Номер заявки";
+    type string;
+    is required;
+    is unique;
+  }
+
+  attribute equipmentId {
+    type uuid;
+    key foreign {
+      relates Equipment.id;
+    }
+    is required;
+  }
+
+  attribute repairKind {
+    description "Вид ремонта";
+    type RepairKind;
+    is required;
+  }
+
+  attribute status {
+    type RepairOrderStatus;
+    default Draft;
+    is required;
+  }
+
+  attribute plannedAt {
+    description "Плановая дата начала";
+    type date;
+    is required;
+  }
+
+  attribute startedAt {
+    description "Фактическая дата начала";
+    type date;
+  }
+
+  attribute completedAt {
+    description "Фактическая дата завершения";
+    type date;
+  }
+
+  attribute contractor {
+    description "Подрядная организация (если внешний ремонт)";
+    type string;
+  }
+
+  attribute engineHoursAtRepair {
+    description "Наработка на момент ремонта, моточасов";
+    type decimal;
+  }
+
+  attribute description {
+    description "Описание работ / дефекта";
+    type text;
+  }
+
+  attribute notes {
+    description "Примечания";
+    type text;
+  }
+}
+
--- a/domain/dsl-spec.md
+++ b/domain/dsl-spec.md
@@ -0,0 +1,217 @@
+# DSL Language Specification
+
+This document describes the single DSL (Domain Specific Language) used to specify fullstack CRUD applications. The only required DSL input is `domain/*.dsl`.
+
+`domain-summary.json` is a derived artifact generated from this DSL to stabilize LLM-first generation and feed the lightweight validation gate. It must never replace the DSL as the source of truth. The active prompt corpus that consumes this contract lives in `prompts/`.
+
+---
+
+# DSL Responsibility
+
+The domain DSL defines only:
+
+- domain model
+- relations
+- enums
+
+The domain DSL is the single source of truth for:
+
+- entities
+- attributes
+- primary keys
+- foreign keys
+- enums
+
+The following layers are always derived from the domain DSL and must not be authored as standalone authoritative DSL inputs:
+
+- DTO
+- API
+- UI
+
+Optional extension mechanism:
+
+```text
+overrides/
+  api-overrides.dsl
+  ui-overrides.dsl
+```
+
+Override rules:
+
+- Overrides are optional.
+- The generator must work without them.
+- Overrides may refine derived API or UI behavior, but they must not duplicate or redefine entities, attributes, primary keys, foreign keys, relations, or enums.
+
+---
+
+# DSL Grammar Concepts
+
+## entity
+
+An **entity** is a domain object that becomes a database table and a first-class resource in the backend and frontend.
+
+```
+entity Equipment {
+  attribute id { type uuid; key primary; }
+  attribute name { type string; is required; }
+}
+```
+
+- **Domain:** Defines the canonical model; one entity = one Prisma model, one NestJS module, one React Admin resource.
+- **Naming:** PascalCase (e.g. `Equipment`, `EquipmentType`, `RepairOrder`).
+
+---
+
+## attribute
+
+An **attribute** is a field of an entity. It has a type and optional modifiers.
+
+```
+attribute name {
+  description "Наименование";
+  type string;
+  is required;
+  is unique;
+}
+```
+
+**Modifiers:**
+
+- `type` — required; one of: `string`, `uuid`, `integer`, `decimal`, `date`, `text`, or an enum name.
+- `key primary` — this attribute is the primary key.
+- `key foreign { relates Entity.field }` — foreign key to another entity's field.
+- `is required` — non-nullable.
+- `is unique` — unique constraint.
+- `default Value` — default value (for enums or literals).
+- `description "..."` — human-readable description.
+
+---
+
+## enum
+
+An **enum** defines a fixed set of values. Used for attributes that can only take one of these values.
+
+```
+enum EquipmentStatus {
+  value Active { label "В эксплуатации"; }
+  value Repair { label "В ремонте"; }
+}
+```
+
+- **value** — identifier used in data and code.
+- **label** — optional display label for UI.
+
+---
+
+## primary key
+
+Exactly one attribute per entity must be marked as primary key.
+
+```
+attribute id {
+  type uuid;
+  key primary;
+}
+```
+
+Or for a natural key:
+
+```
+attribute code {
+  type string;
+  key primary;
+  is required;
+  is unique;
+}
+```
+
+---
+
+## foreign key
+
+A **foreign key** links to another entity's primary key. The attribute type must match the referenced primary key type.
+
+```
+attribute equipmentTypeCode {
+  type string;
+  key foreign {
+    relates EquipmentType.code;
+  }
+  is required;
+}
+```
+
+- `relates Entity.attribute` — references `Entity`'s `attribute` (must be primary key).
+- FK type must equal referenced PK type (e.g. `string` → `EquipmentType.code`, `uuid` → `Equipment.id`).
+
+---
+
+## required
+
+- **is required** — attribute is non-nullable in the domain model and drives requiredness in derived DTO/API/UI artifacts.
+- Absence of `is required` means the attribute is optional (nullable).
+
+---
+
+## default
+
+- **default Value** — applied when no value is provided (e.g. enum defaults like `default Active`).
+- Value must exist in the enum when the attribute type is an enum.
+
+---
+
+# DSL → System Component Mapping
+
+## DSL → Prisma
+
+| DSL Concept  | Prisma Result               |
+| ------------ | --------------------------- |
+| entity       | model                       |
+| attribute    | field                       |
+| enum         | enum                        |
+| key primary  | @id or @id @default(uuid()) |
+| key foreign  | relation + references       |
+| type string  | String                      |
+| type uuid    | String @id @default(uuid()) |
+| type integer | Int                         |
+| type decimal | Decimal                     |
+| type date    | DateTime                    |
+| type text    | String                      |
+
+---
+
+## DSL → NestJS
+
+| DSL Concept    | NestJS Result                         |
+| -------------- | ------------------------------------- |
+| entity         | One module (e.g. equipment.module.ts) |
+| entity         | Controller with CRUD endpoints        |
+| entity         | Service with Prisma CRUD              |
+| entity + attribute metadata | create-{entity}.dto.ts     |
+| entity + attribute metadata | update-{entity}.dto.ts     |
+| entity + attribute metadata | Response DTO / API shape   |
+
+API paths are derived from entity name: PascalCase → kebab-case, pluralized (e.g. `Equipment` → `/equipment`, `RepairOrder` → `/repair-orders`).
+
+---
+
+## DSL → React Admin
+
+| DSL Concept           | React Admin Result                  |
+| --------------------- | ----------------------------------- |
+| entity                | Resource (name = kebab-case plural) |
+| attribute             | Form field / column                 |
+| type string           | TextInput, TextField                |
+| type integer/decimal  | NumberInput, NumberField            |
+| type date             | DateInput, DateField                |
+| enum                  | SelectInput with choices            |
+| foreign key           | ReferenceInput, ReferenceField      |
+
+---
+
+# Derived Layer Mapping
+
+- **Create DTO** — derived from domain attributes and must not include generated primary keys (for example no `id` for uuid PKs).
+- **Update DTO** — derived from the same domain attributes with all fields optional for partial updates.
+- **API response shape** — derived from domain attributes and must expose React Admin-compatible identifiers when needed.
+- **UI field mapping** — derived from attribute types, descriptions, enums, and foreign keys without a separate UI DSL.
--- a/generation/generate.mjs
+++ b/generation/generate.mjs
@@ -0,0 +1,751 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Always resolve repo root relative to this script location
+// <repo>/generation/generate.mjs -> root is parent folder of generation/
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.resolve(__dirname, '..');
+
+function readFile(p) {
+  return fs.readFileSync(p, 'utf8');
+}
+
+function writeFile(p, content) {
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, content, 'utf8');
+}
+
+function toKebab(s) {
+  return s
+    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+    .replace(/_/g, '-')
+    .toLowerCase();
+}
+
+function pluralize(resource) {
+  // Minimal heuristic; can be improved later.
+  if (resource === 'equipment') return 'equipment';
+  if (resource.endsWith('s')) return `${resource}es`;
+  return `${resource}s`;
+}
+
+function upperFirst(s) {
+  return s ? s[0].toUpperCase() + s.slice(1) : s;
+}
+
+function lowerFirst(s) {
+  return s ? s[0].toLowerCase() + s.slice(1) : s;
+}
+
+function toIdentifierFromKebab(kebab) {
+  // "repair-order" -> "repairOrder"
+  return kebab.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+function parseBlocks(text, kind) {
+  // kind: 'enum' | 'entity'
+  const blocks = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(new RegExp(`^\\s*${kind}\\s+([A-Za-z_][A-Za-z0-9_]*)\\s*\\{\\s*$`));
+    if (!m) continue;
+    const name = m[1];
+    let depth = 0;
+    const start = i;
+    let end = i;
+    for (let j = i; j < lines.length; j++) {
+      const l = lines[j];
+      if (l.includes('{')) depth += (l.match(/\{/g) || []).length;
+      if (l.includes('}')) depth -= (l.match(/\}/g) || []).length;
+      if (depth === 0 && j > i) {
+        end = j;
+        break;
+      }
+    }
+    const body = lines.slice(start + 1, end).join('\n');
+    blocks.push({ name, body, startLine: start, endLine: end });
+    i = end;
+  }
+  return blocks;
+}
+
+function parseEnum(body) {
+  const values = [];
+  const labels = {};
+  const re = /value\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{([\s\S]*?)\}/gm;
+  let m;
+  while ((m = re.exec(body))) {
+    values.push(m[1]);
+    const label = (m[2].match(/label\s+"([^"]+)"/m) || [])[1];
+    labels[m[1]] = label || m[1];
+  }
+  return { values, labels };
+}
+
+function parseEntity(body) {
+  const attrs = [];
+  const entityLabel = (body.match(/description\s+"([^"]+)"/m) || [])[1];
+  const lines = body.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^\s*attribute\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{\s*$/);
+    if (!m) continue;
+    const name = m[1];
+    let depth = 0;
+    const start = i;
+    let end = i;
+    for (let j = i; j < lines.length; j++) {
+      const l = lines[j];
+      if (l.includes('{')) depth += (l.match(/\{/g) || []).length;
+      if (l.includes('}')) depth -= (l.match(/\}/g) || []).length;
+      if (depth === 0 && j > i) {
+        end = j;
+        break;
+      }
+    }
+    const abody = lines.slice(start + 1, end).join('\n');
+    const type = (abody.match(/^\s*type\s+([A-Za-z_][A-Za-z0-9_]*)\s*;/m) || [])[1];
+    const isRequired = /^\s*is required\s*;/m.test(abody);
+    const isUnique = /^\s*is unique\s*;/m.test(abody);
+    const isPrimary = /^\s*key primary\s*;/m.test(abody);
+    const defaultValue = (abody.match(/^\s*default\s+([A-Za-z_][A-Za-z0-9_]*)\s*;/m) || [])[1];
+    const foreignRel = (abody.match(/relates\s+([A-Za-z_][A-Za-z0-9_]*)\.([A-Za-z_][A-Za-z0-9_]*)\s*;/m) || []).slice(1);
+    const description = (abody.match(/description\s+"([^"]+)"/m) || [])[1];
+
+    attrs.push({
+      name,
+      type,
+      label: description || name,
+      isRequired,
+      isUnique,
+      isPrimary,
+      defaultValue,
+      foreign: foreignRel.length ? { entity: foreignRel[0], field: foreignRel[1] } : null,
+    });
+    i = end;
+  }
+
+  const pk = attrs.find((a) => a.isPrimary);
+  if (!pk) throw new Error('Entity missing primary key attribute');
+
+  return { attributes: attrs, primaryKey: pk.name, label: entityLabel };
+}
+
+function parseDomainDSL(dslText) {
+  const enums = {};
+  const entities = {};
+
+  for (const b of parseBlocks(dslText, 'enum')) {
+    enums[b.name] = parseEnum(b.body);
+  }
+  for (const b of parseBlocks(dslText, 'entity')) {
+    entities[b.name] = parseEntity(b.body);
+  }
+  return { enums, entities };
+}
+
+function getEntityAttrNames(entity) {
+  return new Set(entity.attributes.map((a) => a.name));
+}
+
+function getBestSortField(entity, pk) {
+  const attrs = getEntityAttrNames(entity);
+  if (attrs.has('inventoryNumber')) return 'inventoryNumber';
+  if (attrs.has('number')) return 'number';
+  if (attrs.has('code')) return 'code';
+  if (attrs.has('name')) return 'name';
+  return pk;
+}
+
+function getReferenceDisplayExpr(foreignEntity) {
+  const attrs = getEntityAttrNames(foreignEntity);
+  if (attrs.has('inventoryNumber')) {
+    return "(record) => record.inventoryNumber ? `${record.inventoryNumber} — ${record.name ?? record.inventoryNumber}` : (record.name ?? record.id)";
+  }
+  if (attrs.has('code')) {
+    return "(record) => record.code ? `${record.code} — ${record.name ?? record.code}` : (record.name ?? record.id)";
+  }
+  if (attrs.has('number')) {
+    return "(record) => record.number ? `${record.number} — ${record.name ?? record.number}` : (record.name ?? record.id)";
+  }
+  if (attrs.has('name')) {
+    return "(record) => record.name ?? record.id";
+  }
+  return "(record) => record.id";
+}
+
+function getAttributeLabel(attr, allEntities) {
+  if (attr.label && attr.label !== attr.name) return attr.label;
+  if (attr.name === 'status') return 'Статус';
+  if (attr.name === 'equipmentId') return 'Оборудование';
+  if (attr.name === 'equipmentTypeCode') return 'Вид оборудования';
+  if (attr.foreign) return allEntities[attr.foreign.entity]?.label || attr.name;
+  return attr.name;
+}
+
+function prismaScalarType(dslType) {
+  switch (dslType) {
+    case 'string':
+    case 'text':
+      return 'String';
+    case 'uuid':
+      return 'String';
+    case 'integer':
+      return 'Int';
+    case 'decimal':
+      return 'Decimal';
+    case 'date':
+      return 'DateTime';
+    default:
+      // enum type name
+      return dslType;
+  }
+}
+
+function generatePrismaEnum(name, values) {
+  return `enum ${name} {\n${values.map((v) => `  ${v}`).join('\n')}\n}\n`;
+}
+
+function generatePrismaModel(name, entity, allEntities) {
+  const lines = [];
+  lines.push(`model ${name} {`);
+  for (const attr of entity.attributes) {
+    if (attr.foreign) {
+      // Keep scalar FK field, relation field added below
+    }
+    const scalar = prismaScalarType(attr.type);
+    const optional = attr.isRequired || attr.isPrimary ? '' : '?';
+    const parts = [`  ${attr.name} ${scalar}${optional}`];
+
+    if (attr.isPrimary) {
+      if (attr.type === 'uuid' || attr.name === 'id') parts.push('@id @default(uuid())');
+      else parts.push('@id');
+    }
+    if (attr.isUnique && !attr.isPrimary) parts.push('@unique');
+    if (attr.defaultValue) parts.push(`@default(${attr.defaultValue})`);
+
+    lines.push(`${parts.join(' ')}`);
+  }
+
+  // Add relations for foreign keys
+  for (const attr of entity.attributes.filter((a) => a.foreign)) {
+    const relEntity = attr.foreign.entity;
+    const relField = attr.foreign.field;
+    const relName = lowerFirst(relEntity);
+    // relation field must not collide; fallback to relEntity name if needed
+    const relationFieldName = entity.attributes.some((a) => a.name === relName) ? `${relName}Ref` : relName;
+    lines.push(
+      `  ${relationFieldName} ${relEntity} @relation(fields: [${attr.name}], references: [${relField}])`
+    );
+  }
+
+  // Add back-relations (required by Prisma when a relation field exists)
+  // For each other entity that has a FK pointing to this model, create a list field.
+  for (const [otherName, otherEntity] of Object.entries(allEntities)) {
+    for (const fk of otherEntity.attributes.filter((a) => a.foreign)) {
+      if (fk.foreign.entity !== name) continue;
+      const candidate = pluralize(lowerFirst(otherName));
+      const fieldName = lines.some((l) => l.startsWith(`  ${candidate} `))
+        ? `${candidate}List`
+        : candidate;
+      // Avoid duplicates if multiple FKs exist (basic de-dupe)
+      if (lines.some((l) => l.startsWith(`  ${fieldName} `))) continue;
+      lines.push(`  ${fieldName} ${otherName}[]`);
+    }
+  }
+
+  lines.push('}');
+  return `${lines.join('\n')}\n`;
+}
+
+function ensurePrismaSchema({ enums, entities }, prismaPath, apply) {
+  const existing = fs.existsSync(prismaPath) ? readFile(prismaPath) : '';
+  const hasGenerator = /generator\s+client\s*\{/m.test(existing);
+  const header = hasGenerator
+    ? existing.split(/\n(?=enum|model)\b/)[0].trimEnd() + '\n\n'
+    : `generator client {\n  provider = "prisma-client-js"\n}\n\ndatasource db {\n  provider = "postgresql"\n  url      = env("DATABASE_URL")\n}\n\n`;
+
+  const out = [header];
+
+  // Preserve existing enum/model blocks not in DSL? For now, regenerate from DSL only.
+  for (const [name, e] of Object.entries(enums)) out.push(generatePrismaEnum(name, e.values) + '\n');
+  for (const [name, ent] of Object.entries(entities)) out.push(generatePrismaModel(name, ent, entities) + '\n');
+
+  const next = out.join('').trimEnd() + '\n';
+  if (!apply) return { changed: next !== existing, content: next };
+  writeFile(prismaPath, next);
+  return { changed: true, content: next };
+}
+
+function renderBackendModule(entityName, entity, resourceName, pk) {
+  const className = entityName;
+  const moduleName = `${className}Module`;
+  const serviceName = `${className}Service`;
+  const controllerName = `${className}Controller`;
+  const folder = toKebab(entityName);
+
+  // DTOs
+  const enumTypes = entity.attributes
+    .filter((a) => !['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type))
+    .map((a) => a.type);
+
+  const enumUnion = (typeName) => {
+    // Unknown labels in DSL aren't needed; keep as string union to avoid importing Prisma enums.
+    return `'${typeName}'`;
+  };
+
+  const dtoType = (attr) => {
+    switch (attr.type) {
+      case 'uuid':
+      case 'string':
+      case 'text':
+        return 'string';
+      case 'integer':
+        return 'number';
+      case 'decimal':
+        return 'string';
+      case 'date':
+        return 'string';
+      default:
+        // enum
+        return 'string';
+    }
+  };
+
+  const createDtoLines = [];
+  createDtoLines.push(`export class Create${className}Dto {`);
+  for (const a of entity.attributes) {
+    if (a.isPrimary && a.type === 'uuid') continue; // generated
+    const opt = a.isRequired && !(a.isPrimary && a.type !== 'uuid') ? '!' : '?';
+    createDtoLines.push(`  ${a.name}${opt}: ${dtoType(a)};`);
+  }
+  createDtoLines.push('}');
+
+  const updateDtoLines = [];
+  updateDtoLines.push(`export class Update${className}Dto {`);
+  if (pk !== 'id') updateDtoLines.push(`  id?: string;`);
+  for (const a of entity.attributes) {
+    if (pk !== 'id' && a.name === 'id') continue;
+    updateDtoLines.push(`  ${a.name}?: ${dtoType(a)};`);
+  }
+  updateDtoLines.push('}');
+
+  const controller = `import { Controller, Get, Post, Patch, Delete, Param, Body, Query, Res } from '@nestjs/common';\nimport { Response } from 'express';\nimport { Roles } from '../../auth/decorators/roles.decorator';\nimport { RealmRole } from '../../auth/roles/realm-role.enum';\nimport { ${serviceName} } from './${folder}.service';\nimport { Create${className}Dto } from './dto/create-${folder}.dto';\nimport { Update${className}Dto } from './dto/update-${folder}.dto';\n\n@Controller('${resourceName}')\nexport class ${controllerName} {\n  constructor(private readonly service: ${serviceName}) {}\n\n  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)\n  @Get()\n  async findAll(@Query() query: any, @Res() res: Response) {\n    const result = await this.service.findAll(query);\n    res.set('Content-Range', \`${resourceName} \${query._start || 0}-\${query._end || result.total}/\${result.total}\`);\n    res.set('Access-Control-Expose-Headers', 'Content-Range');\n    return res.json(result.data);\n  }\n\n  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)\n  @Get(':${pk}')\n  findOne(@Param('${pk}') id: string) {\n    return this.service.findOne(id);\n  }\n\n  @Roles(RealmRole.Editor, RealmRole.Admin)\n  @Post()\n  create(@Body() dto: Create${className}Dto) {\n    return this.service.create(dto);\n  }\n\n  @Roles(RealmRole.Editor, RealmRole.Admin)\n  @Patch(':${pk}')\n  update(@Param('${pk}') id: string, @Body() dto: Update${className}Dto) {\n    return this.service.update(id, dto);\n  }\n\n  @Roles(RealmRole.Admin)\n  @Delete(':${pk}')\n  remove(@Param('${pk}') id: string) {\n    return this.service.remove(id);\n  }\n}\n`;
+
+  const service = `import { Injectable } from '@nestjs/common';\nimport { Prisma } from '@prisma/client';\nimport { PrismaService } from '../../prisma/prisma.service';\nimport { Create${className}Dto } from './dto/create-${folder}.dto';\nimport { Update${className}Dto } from './dto/update-${folder}.dto';\n\nfunction serializeRecord(record: any) {\n  return {\n    ...record,\n${entity.attributes
+      .filter((a) => a.type === 'decimal')
+      .map((a) => `    ${a.name}: record.${a.name}?.toString() ?? null,`)
+      .join('\n')}\n${entity.attributes
+      .filter((a) => a.type === 'date')
+      .map((a) => `    ${a.name}: record.${a.name}?.toISOString() ?? null,`)
+      .join('\n')}\n  };\n}\n\n@Injectable()\nexport class ${serviceName} {\n  constructor(private readonly prisma: PrismaService) {}\n\n  async findAll(query: { _start?: string; _end?: string; _sort?: string; _order?: string; [key: string]: any }) {\n    const start = parseInt(query._start) || 0;\n    const end = parseInt(query._end) || 10;\n    const take = end - start;\n    const skip = start;\n    const sortField = query._sort || '${getBestSortField(entity, pk)}';\n    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';\n\n    const where: any = {};\n\n    if (query.q) {\n      const q = String(query.q);\n      const ors: any[] = [];\n      ${entity.attributes
+        .filter((a) => ['string', 'text'].includes(a.type))
+        .slice(0, 6)
+        .map((a) => `ors.push({ ${a.name}: { contains: q, mode: 'insensitive' } });`)
+        .join('\n      ')}\n      if (ors.length) where.OR = ors;\n    }\n\n    ${entity.attributes
+      .filter((a) => ['string', 'text'].includes(a.type) && !a.foreign)
+      .map((a) => `if (query.${a.name}) where.${a.name} = { contains: query.${a.name}, mode: 'insensitive' };`)
+      .join('\n    ')}\n\n    ${entity.attributes
+      .filter((a) => a.foreign)
+      .map((a) => `if (query.${a.name}) where.${a.name} = query.${a.name};`)
+      .join('\n    ')}\n\n    // Enum multi-value support (e.g. status=A&status=B)\n    ${entity.attributes
+      .filter((a) => !['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type))
+      .map((a) => `if (query.${a.name}) { const vals = Array.isArray(query.${a.name}) ? query.${a.name} : [query.${a.name}]; where.${a.name} = vals.length > 1 ? { in: vals } : vals[0]; }`)
+      .join('\n    ')}\n\n    if (query.id) {\n      const ids = Array.isArray(query.id) ? query.id : [query.id];\n      where.${pk} = { in: ids };\n    }\n\n    const [data, total] = await Promise.all([\n      this.prisma.${lowerFirst(className)}.findMany({ where, skip, take, orderBy: { [sortField]: sortOrder } }),\n      this.prisma.${lowerFirst(className)}.count({ where }),\n    ]);\n\n    const mapped = ${pk === 'id' ? 'data.map(serializeRecord)' : `data.map((r: any) => ({ id: r.${pk}, ...serializeRecord(r) }))`};\n    return { data: mapped, total };\n  }\n\n  async findOne(id: string) {\n    const record = await this.prisma.${lowerFirst(className)}.findUniqueOrThrow({ where: { ${pk}: id } as any });\n    return ${pk === 'id' ? 'serializeRecord(record)' : `{ id: (record as any).${pk}, ...serializeRecord(record) }`};\n  }\n\n  async create(dto: Create${className}Dto) {\n    const data: any = { ...(dto as any) };\n${entity.attributes
+      .filter((a) => a.type === 'date')
+      .map((a) => `    if (data.${a.name}) data.${a.name} = new Date(data.${a.name});`)
+      .join('\n')}\n${entity.attributes
+      .filter((a) => a.type === 'decimal')
+      .map((a) => `    if (data.${a.name}) data.${a.name} = new Prisma.Decimal(data.${a.name});`)
+      .join('\n')}\n\n    const record = await this.prisma.${lowerFirst(className)}.create({ data });\n    return ${pk === 'id' ? 'serializeRecord(record)' : `{ id: (record as any).${pk}, ...serializeRecord(record) }`};\n  }\n\n  async update(id: string, dto: Update${className}Dto) {\n    const data: any = { ...(dto as any) };\n    delete data.id;\n    delete data.${pk};\n${entity.attributes
+      .filter((a) => a.type === 'date')
+      .map((a) => `    if (data.${a.name}) data.${a.name} = new Date(data.${a.name});`)
+      .join('\n')}\n${entity.attributes
+      .filter((a) => a.type === 'decimal')
+      .map((a) => `    if (data.${a.name} !== undefined && data.${a.name} !== null) data.${a.name} = new Prisma.Decimal(data.${a.name});`)
+      .join('\n')}\n\n    const record = await this.prisma.${lowerFirst(className)}.update({ where: { ${pk}: id } as any, data });\n    return ${pk === 'id' ? 'serializeRecord(record)' : `{ id: (record as any).${pk}, ...serializeRecord(record) }`};\n  }\n\n  async remove(id: string) {\n    const record = await this.prisma.${lowerFirst(className)}.delete({ where: { ${pk}: id } as any });\n    return ${pk === 'id' ? 'serializeRecord(record)' : `{ id: (record as any).${pk}, ...serializeRecord(record) }`};\n  }\n}\n`;
+
+  let serviceContent = service
+    .replace(
+      `const sortField = query._sort || '${getBestSortField(entity, pk)}';\n    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';`,
+      `const sortField = query._sort || '${getBestSortField(entity, pk)}';\n    const prismaSortField = sortField === 'id' ? '${pk}' : sortField;\n    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';`
+    )
+    .replace('orderBy: { [sortField]: sortOrder }', 'orderBy: { [prismaSortField]: sortOrder }')
+    .replace(
+      `data.map((r: any) => ({ id: r.${pk}, ...serializeRecord(r) }))`,
+      `data.map((item: any) => ({ id: item.${pk}, ...serializeRecord(item) }))`
+    );
+
+  if (pk !== 'id') {
+    serviceContent = serviceContent.replace(
+      `const data: any = { ...(dto as any) };\n    delete data.id;\n    delete data.${pk};`,
+      `const { id: _pk, ${pk}, ...rest } = (dto as any);\n    const data: any = { ...rest };`
+    );
+  }
+
+  const mod = `import { Module } from '@nestjs/common';\nimport { ${controllerName} } from './${folder}.controller';\nimport { ${serviceName} } from './${folder}.service';\n\n@Module({\n  controllers: [${controllerName}],\n  providers: [${serviceName}],\n})\nexport class ${moduleName} {}\n`;
+
+  return {
+    folder,
+    files: {
+      [`server/src/modules/${folder}/${folder}.controller.ts`]: controller,
+      [`server/src/modules/${folder}/${folder}.service.ts`]: serviceContent,
+      [`server/src/modules/${folder}/${folder}.module.ts`]: mod,
+      [`server/src/modules/${folder}/dto/create-${folder}.dto.ts`]: createDtoLines.join('\n') + '\n',
+      [`server/src/modules/${folder}/dto/update-${folder}.dto.ts`]: updateDtoLines.join('\n') + '\n',
+    },
+    moduleName,
+    importPath: `./modules/${folder}/${folder}.module`,
+  };
+}
+
+function renderFrontendResource(entityName, entity, resourceName, pk, enums, allEntities) {
+  const folder = toKebab(entityName);
+  const className = entityName;
+  const enumAttrs = entity.attributes.filter(
+    (a) => !['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type)
+  );
+  const statusEnumAttr = enumAttrs.find((a) => a.name === 'status');
+
+  const identBase = toIdentifierFromKebab(folder);
+  const filtersIdent = `${identBase}Filters`;
+  const sortField = getBestSortField(entity, pk);
+
+  const hasNumber = entity.attributes.some((a) => ['integer', 'decimal'].includes(a.type));
+  const hasDate = entity.attributes.some((a) => a.type === 'date');
+  const hasFK = entity.attributes.some((a) => a.foreign);
+  const hasNonStatusEnum = enumAttrs.some((a) => a.name !== 'status');
+
+  const listImportSet = new Set([
+    'List',
+    'Datagrid',
+    'TextField',
+    'TextInput',
+    'TopToolbar',
+    'FilterButton',
+    'CreateButton',
+    'ExportButton',
+  ]);
+  if (hasNumber) listImportSet.add('NumberField');
+  if (hasDate) listImportSet.add('DateField');
+  if (enumAttrs.length) listImportSet.add('SelectField');
+  if (hasFK) listImportSet.add('ReferenceField');
+  if (statusEnumAttr) listImportSet.add('SelectArrayInput');
+  if (hasNonStatusEnum) listImportSet.add('SelectInput');
+  if (hasFK) {
+    listImportSet.add('ReferenceInput');
+    listImportSet.add('AutocompleteInput');
+  }
+  const listImports = Array.from(listImportSet);
+
+  const choiceConsts = [];
+  for (const a of enumAttrs) {
+    const enumName = a.type;
+    const values = enums?.[enumName]?.values ?? [];
+    const labels = enums?.[enumName]?.labels ?? {};
+    const constName = `${a.name}Choices`;
+    if (a.name === 'status') {
+      choiceConsts.push(
+        `const statusChoices = [\n${values.map((v) => `  { id: '${v}', name: '${labels[v] ?? v}' },`).join('\n')}\n];\n`
+      );
+    } else {
+      choiceConsts.push(
+        `const ${constName} = [\n${values.map((v) => `  { id: '${v}', name: '${labels[v] ?? v}' },`).join('\n')}\n];\n`
+      );
+    }
+  }
+
+  const filterInputs = [];
+  // Always include q if any string fields
+  if (entity.attributes.some((a) => ['string', 'text'].includes(a.type))) {
+    filterInputs.push(`<TextInput key="q" source="q" label="Поиск" alwaysOn />`);
+  }
+  for (const a of entity.attributes) {
+    const label = getAttributeLabel(a, allEntities);
+    if (a.name === pk) continue;
+    if (a.foreign) {
+      const referenceDisplay = getReferenceDisplayExpr(allEntities[a.foreign.entity]);
+      filterInputs.push(
+        `<ReferenceInput key="${a.name}" source="${a.name}" reference="${pluralize(toKebab(a.foreign.entity))}" label="${label}">\n    <AutocompleteInput optionText={${referenceDisplay}} filterToQuery={(searchText) => ({ q: searchText })} />\n  </ReferenceInput>`
+      );
+      continue;
+    }
+    if (['string', 'text', 'uuid'].includes(a.type)) {
+      filterInputs.push(`<TextInput key="${a.name}" source="${a.name}" label="${label}" />`);
+      continue;
+    }
+    if (['integer', 'decimal'].includes(a.type)) continue;
+    if (a.type === 'date') continue;
+    // enum
+    if (a.name === 'status') {
+      filterInputs.push(`<SelectArrayInput key="${a.name}" source="${a.name}" label="${label}" choices={statusChoices} />`);
+    } else {
+      filterInputs.push(`<SelectInput key="${a.name}" source="${a.name}" label="${label}" choices={${a.name}Choices} emptyText="Все" />`);
+    }
+  }
+
+  const listFields = [];
+  for (const a of entity.attributes) {
+    const label = getAttributeLabel(a, allEntities);
+    if (a.foreign) {
+      const referenceEntity = allEntities[a.foreign.entity];
+      const referenceAttrs = getEntityAttrNames(referenceEntity);
+      const fieldSource = referenceAttrs.has('inventoryNumber')
+        ? 'inventoryNumber'
+        : referenceAttrs.has('code')
+          ? 'code'
+          : referenceAttrs.has('number')
+            ? 'number'
+            : 'name';
+      listFields.push(
+        `<ReferenceField source="${a.name}" reference="${pluralize(toKebab(a.foreign.entity))}" label="${label}" link="show">\n        <TextField source="${fieldSource}" />\n      </ReferenceField>`
+      );
+      continue;
+    }
+    if (a.type === 'date') {
+      listFields.push(`<DateField source="${a.name}" label="${label}" />`);
+    } else if (['integer', 'decimal'].includes(a.type)) {
+      listFields.push(`<NumberField source="${a.name}" label="${label}" />`);
+    } else if (!['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type)) {
+      listFields.push(`<SelectField source="${a.name}" label="${label}" choices={${a.name === 'status' ? 'statusChoices' : `${a.name}Choices`}} />`);
+    } else {
+      listFields.push(`<TextField source="${a.name}" label="${label}" />`);
+    }
+  }
+
+  const list = `import {\n  ${listImports.join(',\n  ')}\n} from 'react-admin';\n\n${choiceConsts.join('\n')}\nconst ${filtersIdent} = [\n  ${filterInputs.join(',\n  ')}\n];\n\nconst ${className}ListActions = () => (\n  <TopToolbar>\n    <FilterButton filters={${filtersIdent}} />\n    <CreateButton />\n    <ExportButton />\n  </TopToolbar>\n);\n\nexport const ${className}List = () => (\n  <List actions={<${className}ListActions />} filters={${filtersIdent}} sort={{ field: '${sortField}', order: 'ASC' }}>\n    <Datagrid rowClick=\"show\">\n      ${listFields.join('\n      ')}\n    </Datagrid>\n  </List>\n);\n`;
+
+  const formField = (a, mode) => {
+    const label = getAttributeLabel(a, allEntities);
+    if (a.isPrimary && mode === 'create' && a.type === 'uuid') return null;
+    if (a.isPrimary && mode === 'edit') {
+      return `<TextInput source="${a.name}" label="${label}" disabled />`;
+    }
+    if (a.foreign) {
+      const referenceDisplay = getReferenceDisplayExpr(allEntities[a.foreign.entity]);
+      return `<ReferenceInput source="${a.name}" reference="${pluralize(toKebab(a.foreign.entity))}">\n        <AutocompleteInput label="${label}" optionText={${referenceDisplay}} filterToQuery={(searchText) => ({ q: searchText })} />\n      </ReferenceInput>`;
+    }
+    if (a.type === 'date') return `<DateInput source="${a.name}" label="${label}" />`;
+    if (['integer', 'decimal'].includes(a.type)) return `<NumberInput source="${a.name}" label="${label}" />`;
+    if (!['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type)) {
+      if (a.name === 'status' && statusEnumAttr) return `<SelectInput source="${a.name}" label="${label}" choices={statusChoices} emptyText="Не выбрано" />`;
+      return `<SelectInput source="${a.name}" label="${label}" choices={${a.name}Choices} emptyText="Не выбрано" />`;
+    }
+    return `<TextInput source="${a.name}" label="${label}" ${a.isRequired ? 'isRequired' : ''} />`;
+  };
+
+  const formImportSet = new Set(['SimpleForm', 'TextInput']);
+  if (hasNumber) formImportSet.add('NumberInput');
+  if (hasDate) formImportSet.add('DateInput');
+  if (enumAttrs.length) formImportSet.add('SelectInput');
+  if (hasFK) {
+    formImportSet.add('ReferenceInput');
+    formImportSet.add('AutocompleteInput');
+  }
+  const createImports = ['Create', ...Array.from(formImportSet)].join(', ');
+  const create = `import { ${createImports} } from 'react-admin';\n\n${choiceConsts.join('\n')}\nexport const ${className}Create = () => (\n  <Create>\n    <SimpleForm>\n      ${entity.attributes.map((a) => formField(a, 'create')).filter(Boolean).join('\n      ')}\n    </SimpleForm>\n  </Create>\n);\n`;
+
+  const editImports = ['Edit', ...Array.from(formImportSet)].join(', ');
+  const edit = `import { ${editImports} } from 'react-admin';\n\n${choiceConsts.join('\n')}\nexport const ${className}Edit = () => (\n  <Edit>\n    <SimpleForm>\n      ${entity.attributes.map((a) => formField(a, 'edit')).filter(Boolean).join('\n      ')}\n    </SimpleForm>\n  </Edit>\n);\n`;
+
+  const showImportSet = new Set(['Show', 'SimpleShowLayout', 'TextField']);
+  if (hasNumber) showImportSet.add('NumberField');
+  if (hasDate) showImportSet.add('DateField');
+  if (enumAttrs.length) showImportSet.add('SelectField');
+  if (hasFK) showImportSet.add('ReferenceField');
+
+  const showFields = [];
+  for (const a of entity.attributes) {
+    const label = getAttributeLabel(a, allEntities);
+    if (a.foreign) {
+      const referenceEntity = allEntities[a.foreign.entity];
+      const referenceAttrs = getEntityAttrNames(referenceEntity);
+      const fieldSource = referenceAttrs.has('inventoryNumber')
+        ? 'inventoryNumber'
+        : referenceAttrs.has('code')
+          ? 'code'
+          : referenceAttrs.has('number')
+            ? 'number'
+            : 'name';
+      showFields.push(
+        `<ReferenceField source="${a.name}" reference="${pluralize(toKebab(a.foreign.entity))}" label="${label}" link="show">\n        <TextField source="${fieldSource}" />\n      </ReferenceField>`
+      );
+      continue;
+    }
+    if (a.type === 'date') {
+      showFields.push(`<DateField source="${a.name}" label="${label}" />`);
+    } else if (['integer', 'decimal'].includes(a.type)) {
+      showFields.push(`<NumberField source="${a.name}" label="${label}" />`);
+    } else if (!['string', 'text', 'uuid', 'integer', 'decimal', 'date'].includes(a.type)) {
+      showFields.push(`<SelectField source="${a.name}" label="${label}" choices={${a.name === 'status' ? 'statusChoices' : `${a.name}Choices`}} />`);
+    } else {
+      showFields.push(`<TextField source="${a.name}" label="${label}" />`);
+    }
+  }
+
+  const show = `import { ${Array.from(showImportSet).join(', ')} } from 'react-admin';\n\n${choiceConsts.join('\n')}export const ${className}Show = () => (\n  <Show>\n    <SimpleShowLayout>\n      ${showFields.join('\n      ')}\n    </SimpleShowLayout>\n  </Show>\n);\n`;
+
+  return {
+    files: {
+      [`client/src/resources/${folder}/${className}List.tsx`]: list,
+      [`client/src/resources/${folder}/${className}Create.tsx`]: create,
+      [`client/src/resources/${folder}/${className}Edit.tsx`]: edit,
+      [`client/src/resources/${folder}/${className}Show.tsx`]: show,
+    },
+    resourceName,
+    className,
+    folder,
+  };
+}
+
+function upsertInFile(filePath, apply, updater) {
+  const abs = path.join(ROOT, filePath);
+  const existing = fs.existsSync(abs) ? readFile(abs) : '';
+  const next = updater(existing);
+  if (apply) writeFile(abs, next);
+  return { changed: next !== existing, content: next };
+}
+
+function ensureAppModule(apply, backendModules) {
+  return upsertInFile('server/src/app.module.ts', apply, (src) => {
+    let out = src;
+    for (const m of backendModules) {
+      if (!out.includes(`import { ${m.moduleName} }`)) {
+        const importLine = `import { ${m.moduleName} } from '${m.importPath}';`;
+        const importMatches = [...out.matchAll(/^import\s+.*;$/gm)];
+        if (importMatches.length) {
+          const lastImport = importMatches[importMatches.length - 1];
+          const insertAt = lastImport.index + lastImport[0].length;
+          out = `${out.slice(0, insertAt)}\n${importLine}${out.slice(insertAt)}`;
+        } else {
+          out = `${importLine}\n${out}`;
+        }
+      }
+    }
+    out = out.replace(/imports:\s*\[\s*([\s\S]*?)\s*\],/m, (match, inner) => {
+      let block = inner;
+      for (const m of backendModules) {
+        if (!block.includes(m.moduleName)) block = block.replace(/\s*\],?\s*$/m, '') + `\n    ${m.moduleName},`;
+      }
+      // normalize trailing comma/indent by reusing original replacement style
+      return `imports: [${block}\n  ],`;
+    });
+    return out;
+  });
+}
+
+function ensureClientApp(apply, frontendResources) {
+  return upsertInFile('client/src/App.tsx', apply, (src) => {
+    let out = src;
+    for (const r of frontendResources) {
+      const imports = [
+        `import { ${r.className}List } from './resources/${r.folder}/${r.className}List';`,
+        `import { ${r.className}Create } from './resources/${r.folder}/${r.className}Create';`,
+        `import { ${r.className}Edit } from './resources/${r.folder}/${r.className}Edit';`,
+        `import { ${r.className}Show } from './resources/${r.folder}/${r.className}Show';`,
+      ];
+      for (const imp of imports) {
+        if (!out.includes(imp)) {
+          const importMatches = [...out.matchAll(/^import\s+.*;$/gm)];
+          if (importMatches.length) {
+            const lastImport = importMatches[importMatches.length - 1];
+            const insertAt = lastImport.index + lastImport[0].length;
+            out = `${out.slice(0, insertAt)}\n${imports.join('\n')}${out.slice(insertAt)}`;
+          } else {
+            out = `${imports.join('\n')}\n${out}`;
+          }
+          break;
+        }
+      }
+      if (!out.includes(`name="${r.resourceName}"`)) {
+        out = out.replace(
+          /<\/Admin>/m,
+          `    <Resource\n      name="${r.resourceName}"\n      options={{ label: '${r.className}' }}\n      list={${r.className}List}\n      create={${r.className}Create}\n      edit={${r.className}Edit}\n      show={${r.className}Show}\n    />\n  </Admin>`
+        );
+      }
+    }
+    return out;
+  });
+}
+
+/** Собирает файлы как при --apply, без записи. Учитывает текущие app.module.ts и App.tsx на диске. */
+function collectGeneratedBundle(parsed) {
+  const files = {};
+  const prismaPath = path.join(ROOT, 'server/prisma/schema.prisma');
+  const pr = ensurePrismaSchema(parsed, prismaPath, false);
+  files['server/prisma/schema.prisma'] = pr.content;
+
+  const backendModules = [];
+  const frontendResources = [];
+  for (const [entityName, ent] of Object.entries(parsed.entities)) {
+    const pk = ent.primaryKey;
+    const resource = pluralize(toKebab(entityName));
+    const be = renderBackendModule(entityName, ent, resource, pk);
+    const fe = renderFrontendResource(entityName, ent, resource, pk, parsed.enums);
+    backendModules.push(be);
+    frontendResources.push(fe);
+    Object.assign(files, be.files, fe.files);
+  }
+
+  const appMod = ensureAppModule(false, backendModules);
+  files['server/src/app.module.ts'] = appMod.content;
+  const clientApp = ensureClientApp(false, frontendResources);
+  files['client/src/App.tsx'] = clientApp.content;
+
+  return {
+    entityCount: Object.keys(parsed.entities).length,
+    enumCount: Object.keys(parsed.enums).length,
+    files,
+  };
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const apply = args.includes('--apply');
+  const printBundleJson = args.includes('--print-bundle-json');
+  const dslArgIdx = args.indexOf('--dsl');
+  const dslPath = dslArgIdx >= 0 ? args[dslArgIdx + 1] : 'domain/TOiR.domain.dsl';
+
+  const absDsl = path.resolve(ROOT, dslPath);
+  const dslText = readFile(absDsl);
+  const parsed = parseDomainDSL(dslText);
+
+  if (printBundleJson) {
+    const bundle = collectGeneratedBundle(parsed);
+    process.stdout.write(JSON.stringify(bundle));
+    return;
+  }
+
+  // Prisma schema
+  const prismaPath = path.join(ROOT, 'server/prisma/schema.prisma');
+  ensurePrismaSchema(parsed, prismaPath, apply);
+
+  // Backend modules + frontend resources
+  const backendModules = [];
+  const frontendResources = [];
+  for (const [entityName, ent] of Object.entries(parsed.entities)) {
+    const pk = ent.primaryKey;
+    const resource = pluralize(toKebab(entityName));
+    const be = renderBackendModule(entityName, ent, resource, pk);
+    const fe = renderFrontendResource(entityName, ent, resource, pk, parsed.enums, parsed.entities);
+    backendModules.push(be);
+    frontendResources.push(fe);
+
+    if (apply) {
+      for (const [rel, content] of Object.entries(be.files)) writeFile(path.join(ROOT, rel), content);
+      for (const [rel, content] of Object.entries(fe.files)) writeFile(path.join(ROOT, rel), content);
+    }
+  }
+
+  ensureAppModule(apply, backendModules);
+  ensureClientApp(apply, frontendResources);
+
+  process.stdout.write(
+    `${apply ? 'Generated' : 'Planned'} ${Object.keys(parsed.entities).length} entities from ${dslPath}\n`
+  );
+}
+
+main();
+
--- a/overrides/api-overrides.dsl
+++ b/overrides/api-overrides.dsl
@@ -0,0 +1,2 @@
+// Optional overrides:
+// resource EquipmentType path "equipment-types";
--- a/overrides/ui-overrides.dsl
+++ b/overrides/ui-overrides.dsl
@@ -0,0 +1,2 @@
+// Optional overrides:
+// field EquipmentType.code widget "text";
--- a/package.json
+++ b/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "toir-generation-context",
+  "private": true,
+  "scripts": {
+    "generate:domain-summary": "node tools/generate-domain-summary.mjs",
+    "validate:generation": "node tools/validate-generation.mjs",
+    "validate:generation:runtime": "node tools/validate-generation.mjs --run-runtime",
+    "validate:generation:artifacts": "node tools/validate-generation.mjs --artifacts-only"
+  }
+}
--- a/prompts/auth-rules.md
+++ b/prompts/auth-rules.md
@@ -0,0 +1,79 @@
+# Auth Rules
+
+This repository keeps the current LLM-first CRUD generation architecture as the primary working baseline.
+
+- Auth is part of the default generation path, not a post-generation addon.
+- `server/` is the active backend target output path.
+- `client/` is the active frontend target output path.
+- The generated runtime stays SPA + API + external Keycloak + PostgreSQL only.
+
+## Frontend auth invariants
+
+- Use `keycloak-js` with redirect-based login only.
+- Initialize Keycloak before rendering the SPA.
+- Use Authorization Code Flow + PKCE (`S256`).
+- Keep `authProvider`, `dataProvider`, `getIdentity()`, `getPermissions()`, and `checkError()` as stable provider seams.
+- Derive identity from token claims already present in the parsed token.
+- Do not call `loadUserProfile()` and do not depend on `/account` for the baseline app.
+- `401` must force re-authentication; `403` must stay an authorization error.
+- Keep token handling in memory and refresh through one shared in-flight operation.
+
+## Working runtime defaults
+
+Use the already working project defaults unless a prompt explicitly overrides them.
+
+- Frontend Keycloak base URL example:
+  - `VITE_KEYCLOAK_URL=https://sso.greact.ru`
+- Frontend realm and client example:
+  - `VITE_KEYCLOAK_REALM=toir`
+  - `VITE_KEYCLOAK_CLIENT_ID=toir-frontend`
+- Backend issuer and audience example:
+  - `KEYCLOAK_ISSUER_URL=https://sso.greact.ru/realms/toir`
+  - `KEYCLOAK_AUDIENCE=toir-backend`
+- CORS example:
+  - `CORS_ALLOWED_ORIGINS=http://localhost:5173,https://toir-frontend.greact.ru`
+
+Anti-regression rule:
+
+- Do not switch the baseline Keycloak example back to `http://localhost:8080` in generated `.env.example` files unless the prompt explicitly asks for a local Keycloak runtime.
+- Localhost Keycloak values may exist in private `.env.local` or `.env` overrides, but they are not the default project examples.
+
+## Backend auth invariants
+
+- Verify JWTs with `jose`.
+- Validate issuer + audience + signature via JWKS.
+- Resolve JWKS in this order:
+  1. `KEYCLOAK_JWKS_URL`
+  2. OIDC discovery at `/.well-known/openid-configuration`
+  3. `${issuer}/protocol/openid-connect/certs`
+- Extract roles only from `realm_access.roles`.
+- Keep `/health` public and all generated CRUD routes protected by default.
+
+## Auth anti-regression invariants
+
+- The accepted JWKS resolution chain above is the only baseline truth path. Do not document one order and implement another.
+- If auth implementation changes, `prompts/auth-rules.md` and `prompts/validation-rules.md` must be updated in the same change.
+- Do not skip OIDC discovery when no explicit `KEYCLOAK_JWKS_URL` is provided.
+- Do not switch role extraction to alternative claims unless the prompt explicitly changes the baseline contract.
+- Do not reintroduce localhost Keycloak defaults into shared baseline examples.
+
+## Realm artifact contract
+
+- A physical root-level `*-realm.json` artifact is mandatory output.
+- The artifact must be importable, versioned, and aligned with generated backend/frontend env contracts.
+- It must parameterize:
+  - realm name
+  - frontend client id
+  - backend client id / audience
+  - local and production frontend URLs
+  - artifact filename
+- It must explicitly deliver:
+  - `sub`
+  - `aud`
+  - `realm_access.roles`
+- It must define:
+  - realm roles `admin`, `editor`, `viewer`
+  - a public SPA client with PKCE S256
+  - a bearer-only backend client
+  - an explicit audience client scope
+  - explicit protocol mappers for baseline identity and role claims
--- a/prompts/backend-rules.md
+++ b/prompts/backend-rules.md
@@ -0,0 +1,88 @@
+# Backend Rules
+
+The backend remains derived from `domain/*.dsl` inside the existing LLM-first pipeline. No compiler platform or generator engine is introduced.
+
+## Backend scaffold baseline
+
+- Start backend initialization from the official NestJS CLI workspace, not from manually created files.
+- The backend must remain compatible with standard Nest workspace tooling such as `nest build` and `nest start`.
+- Preserve the core Nest workspace files generated by the CLI, especially:
+  - `server/tsconfig.json`
+  - `server/tsconfig.build.json`
+  - `server/nest-cli.json`
+  - `server/src/main.ts`
+  - `server/src/app.module.ts`
+- For domain resources, prefer official Nest CLI generation patterns for modules/controllers/services/resources and then adapt the generated code to Prisma and auth requirements.
+- Do not delete required Nest workspace files just because the LLM can inline a smaller custom structure.
+
+## Forbidden backend generation patterns
+
+- Do not bootstrap `server/` by hand-writing a pseudo-Nest project from memory.
+- Do not remove `tsconfig.json`, `tsconfig.build.json`, or `nest-cli.json` after generation.
+- Do not replace standard Nest package scripts with ad hoc commands that break `nest build` or `nest start`.
+- Do not continue CRUD generation on top of a degraded backend workspace without repairing the workspace first.
+
+## Domain-derived output
+
+- `domain/*.dsl` is the source of truth for entities, fields, primary keys, foreign keys, and enums.
+- `domain-summary.json` is a derived artifact used to stabilize LLM generation and validation. It must never replace the DSL as the source of truth.
+- Each entity becomes:
+  - a Prisma model
+  - a NestJS module
+  - a controller
+  - a service
+  - create/update DTOs
+
+## DTO and Prisma mapping
+
+- `decimal` -> Prisma `Decimal`, DTO/API `string`
+- `date` -> Prisma `DateTime`, DTO/API `string`
+- Enums remain string-valued in DTO/API contracts
+
+## CRUD and natural-key invariants
+
+- CRUD routes use the real primary key name in the path.
+- Every API record returned to React Admin must include `id`.
+- For entities whose primary key is not `id`, the backend must map the real key to `id`.
+- Natural-key list/sort logic must never build ORM `orderBy` against a fake physical `id`.
+
+## Service invariants
+
+- Never pass raw update DTOs into Prisma update `data`.
+- Remove `id`, the real primary key, and readonly fields from update payloads before calling Prisma.
+- Keep PrismaService lightweight:
+  - extend `PrismaClient`
+  - implement `OnModuleInit`
+  - call `$connect()`
+  - do not use `beforeExit`
+
+## Filtering contract
+
+- List endpoints must support React Admin query parameters:
+  - `_start`, `_end`, `_sort`, `_order`
+  - arbitrary field filters from query string
+  - `q` for reference autocomplete search
+- String/text search filters may use `contains` with case-insensitive mode.
+- Foreign key filters must use exact-match semantics (no `contains` for FK scalar keys).
+- Enum filters must support both single and repeated query params:
+  - `status=Draft`
+  - `status=Draft&status=Approved`
+- Repeated enum params must map to Prisma `{ in: [...] }`.
+- Sorting must use real model scalar fields only; natural-key entities must not fallback to fake physical `id`.
+
+## Reproducibility invariants
+
+- A freshly generated backend must be bootstrappable with ordinary Nest + Prisma commands from `prompts/runtime-rules.md`.
+- Missing TypeScript or Nest workspace config is a generation failure, not an acceptable simplification.
+- The baseline backend should fail only on missing runtime dependencies or env values, not because the Nest workspace itself is incomplete.
+
+## Recovery rule if backend workspace degraded
+
+- If required Nest scaffold files are missing or broken, restore the official workspace baseline before editing Prisma models, modules, controllers, services, or DTOs.
+- Treat workspace repair as higher priority than feature generation, because generated domain code on top of a broken workspace is invalid baseline output.
+
+## Backend auth defaults
+
+- `GET` -> `viewer | editor | admin`
+- `POST`, `PATCH`, `PUT` -> `editor | admin`
+- `DELETE` -> `admin`
--- a/prompts/frontend-rules.md
+++ b/prompts/frontend-rules.md
@@ -0,0 +1,65 @@
+# Frontend Rules
+
+The frontend stays a React Admin SPA generated from `domain/*.dsl` and anchored to the existing auth seams.
+
+## Frontend scaffold baseline
+
+- Start frontend initialization from the official Vite React TypeScript scaffold, not from manually assembled files.
+- Preserve a valid Vite workspace baseline, including:
+  - `client/index.html`
+  - `client/tsconfig.json`
+  - `client/vite.config.*`
+  - `client/src/main.tsx`
+- Add React Admin and auth seams on top of that baseline instead of replacing the workspace with a hand-written minimal shell.
+- Do not delete required Vite entry/config files just because the LLM can write a shorter custom setup.
+
+## Forbidden frontend generation patterns
+
+- Do not bootstrap `client/` by hand-writing a pseudo-Vite project from memory.
+- Do not remove `index.html`, `tsconfig*`, or `vite.config.*` after generation.
+- Do not replace standard Vite package scripts with ad hoc commands that break `vite build`, `vite dev`, or `vite preview`.
+- Do not continue React Admin resource generation on top of a degraded frontend workspace without repairing the workspace first.
+
+## Resource generation
+
+- Each entity becomes a React Admin resource with list/create/edit/show views.
+- Resource names must stay aligned with backend path segments.
+- Foreign keys must use `ReferenceInput` / `ReferenceField`.
+- Foreign keys shown in list/show views must stay clickable via `ReferenceField link="show"` to open full details of the related resource.
+- Lists must expose filters through `List` `filters` and an actions toolbar with `FilterButton`.
+- For enum fields where multi-select is required (for example `status`), use `SelectArrayInput` in list filters.
+- For foreign key filters and form selection use `ReferenceInput` + `AutocompleteInput` with `filterToQuery={(searchText) => ({ q: searchText })}`.
+- Form mapping must stay type-safe:
+  - `integer` / `decimal` -> `NumberInput`
+  - `date` -> `DateInput`
+
+## Provider seams
+
+- `client/src/dataProvider.ts` is the single authenticated request seam.
+- `client/src/auth/authProvider.ts` is the single React Admin auth seam.
+- Auth logic must not leak into resource components.
+
+## Identity and permissions
+
+- `getIdentity()` must resolve from parsed token claims.
+- `getPermissions()` may expose realm roles for UI awareness.
+- Backend enforcement remains authoritative.
+
+## React Admin compatibility
+
+- Every resource record must include `id`.
+- Natural-key resources must preserve route, update, and sort compatibility with React Admin contracts.
+- Frontend requests must continue to work when the real primary key is not named `id`.
+- `dataProvider` query serialization must preserve repeated query params for array filters (for example enum multi-select).
+- `Resource` wiring in `App.tsx` must keep `show={...}` registration for all generated resources.
+
+## Reproducibility invariants
+
+- A freshly generated frontend must remain compatible with standard Vite commands such as `npm run dev` and `npm run build`.
+- Missing Vite workspace files or missing local Vite executable wiring is a generation failure, not an acceptable simplification.
+- The generated frontend should fail only on missing installation/env/runtime backend availability, not because the Vite app structure itself is incomplete.
+
+## Recovery rule if frontend workspace degraded
+
+- If required Vite scaffold files are missing or broken, restore the official workspace baseline before editing resources, auth seams, or UI code.
+- Treat workspace repair as higher priority than feature generation, because generated React Admin code on top of a broken Vite workspace is invalid baseline output.
--- a/prompts/general-prompt.md
+++ b/prompts/general-prompt.md
@@ -0,0 +1,146 @@
+ROLE
+
+You are a Staff-level Fullstack Platform Engineer working inside the established LLM-first CRUD generation baseline.
+
+Use context7 when official framework guidance is needed.
+
+This repository is not a new generator engine. Do not redesign it into a planner/emitter/runtime platform.
+
+GOAL
+
+Strengthen and use the existing LLM-first CRUD generation pipeline.
+
+- Keep `domain/*.dsl` as the source of truth for the domain model.
+- Keep `server/` as the active backend target output path.
+- Keep `client/` as the active frontend target output path.
+- Keep Keycloak auth in the default generation path.
+- Keep PostgreSQL as the only Dockerized runtime dependency.
+- Generate and maintain:
+  - `domain-summary.json`
+  - a root-level `*-realm.json`
+  - backend/frontend auth seams
+  - runtime/env/bootstrap artifacts
+  - validation-gate-compatible output
+
+Use the already working runtime defaults for this project unless the prompt explicitly overrides them:
+
+- frontend Keycloak URL example: `https://sso.greact.ru`
+- frontend realm/client examples: `toir`, `toir-frontend`
+- backend issuer/audience examples: `https://sso.greact.ru/realms/toir`, `toir-backend`
+- production frontend origin example: `https://toir-frontend.greact.ru`
+
+Do not silently regress these examples to localhost Keycloak defaults.
+
+ACTIVE KNOWLEDGE BLOCKS
+
+Read in this order:
+
+1. `domain/dsl-spec.md`
+2. `domain/*.dsl`
+3. `domain-summary.json` if present
+4. `prompts/auth-rules.md`
+5. `prompts/backend-rules.md`
+6. `prompts/frontend-rules.md`
+7. `prompts/runtime-rules.md`
+8. `prompts/validation-rules.md`
+
+Interpretation rules:
+
+- `domain/*.dsl` is authoritative.
+- `domain-summary.json` is derived. Regenerate or validate it against the DSL; never treat it as the source of truth.
+INPUT CONTRACT
+
+Required:
+
+- `domain/*.dsl`
+
+Optional:
+
+- `overrides/api-overrides.dsl`
+- `overrides/ui-overrides.dsl`
+
+Rules:
+
+- Do not require DTO/API/UI DSL files.
+- Do not resurrect multi-DSL source-of-truth behavior.
+- Optional overrides may refine derived API/UI behavior but must not redefine the domain model.
+
+PIPELINE CONTRACT
+
+1. Parse `domain/*.dsl`.
+2. Generate or refresh `domain-summary.json`.
+3. Scaffold with official framework CLI conventions where scaffolding is needed.
+4. Generate or maintain backend/frontend code in `server/` and `client/`.
+5. Generate or maintain the root-level realm artifact.
+6. Generate or maintain env/bootstrap/runtime artifacts.
+7. Run the lightweight validation gate.
+
+REPAIR-BEFORE-GENERATE ORDER
+
+1. Inspect whether `server/` and `client/` are still valid framework workspaces.
+2. If either workspace is degraded, repair the official scaffold baseline first.
+3. Only after workspace repair, generate or update domain-derived feature code.
+4. Only after generation, run validation and buildability checks.
+
+CLI-FIRST SCAFFOLDING CONTRACT
+
+- Never hand-write a fresh framework workspace from scratch when an official CLI exists for that framework.
+- For `server/`, initialize the workspace from the official NestJS CLI baseline first, then generate/adapt modules/resources inside that workspace.
+- For `client/`, initialize the workspace from the official Vite React TypeScript baseline first, then add React Admin, auth seams, and generated resources.
+- Treat CLI scaffolding as the required baseline for compiler config, package scripts, workspace metadata, and default entry files.
+- Manual creation is allowed only for domain-derived feature code after the official workspace exists.
+- If a workspace already exists but is missing required CLI baseline files, repair it back to a valid official-style workspace before adding more generated code.
+
+ANTI-REGRESSION FAILURES
+
+Treat the following as baseline violations, not acceptable improvisations:
+
+- creating a NestJS workspace by manually writing `package.json`, `tsconfig*`, `nest-cli.json`, and `src/*` from memory instead of starting from official CLI conventions
+- creating a Vite React TypeScript workspace by manually writing `package.json`, `index.html`, `tsconfig*`, `vite.config.*`, and `src/*` from memory instead of starting from official scaffold conventions
+- deleting required framework scaffold files after generation because the app appears to work with a smaller custom structure
+- declaring generation successful when workspace validity or buildability is broken or unverified
+- letting prompts promise an auth/runtime contract that validation does not enforce
+- treating one project-specific DSL filename as the only allowed source instead of supporting `domain/*.dsl`
+
+OUTPUT CONTRACT
+
+The baseline output must include:
+
+- `server/prisma/schema.prisma`
+- `server/.env.example`
+- `client/.env.example`
+- `client/src/auth/keycloak.ts`
+- `client/src/auth/authProvider.ts`
+- `client/src/dataProvider.ts`
+- `server/src/auth/*`
+- `docker-compose.yml`
+- `domain-summary.json`
+- root-level `*-realm.json`
+
+The baseline output must also remain a real framework workspace, not a prompt-only file collection:
+
+- `server/tsconfig.json`
+- `server/tsconfig.build.json`
+- `server/nest-cli.json`
+- `client/index.html`
+- `client/tsconfig.json`
+- `client/vite.config.*`
+
+NON-GOALS
+
+- No new generator engine
+- No compiler/IR platform
+- No heavy codegen redesign
+- No replacement of the old LLM-first architecture
+
+COMPLETION INVARIANTS
+
+- Generation is incomplete if `server/` is not a valid NestJS workspace.
+- Generation is incomplete if `client/` is not a valid Vite React TypeScript workspace.
+- Generation is incomplete if auth rules, runtime rules, and validation rules describe different truth paths.
+- Generation is incomplete if buildability is broken.
+- If buildability cannot be checked because dependencies are missing, report that state explicitly; do not report a green result for buildability.
+
+VALIDATION
+
+Before considering the output complete, satisfy `prompts/validation-rules.md`.
--- a/prompts/runtime-rules.md
+++ b/prompts/runtime-rules.md
@@ -0,0 +1,96 @@
+# Runtime Rules
+
+This repository keeps the current LLM-first CRUD generation architecture as the primary working baseline and strengthens the existing pipeline instead of replacing it.
+
+## Baseline runtime topology
+
+- `server/` is the active backend target output path.
+- `client/` is the active frontend target output path.
+- Docker scope remains PostgreSQL only.
+- Keycloak remains external to the repository runtime.
+- The project remains LLM-first: markdown knowledge blocks in `prompts/` orchestrate generation, while active generated/maintained code lives in `server/` and `client/`.
+
+## Required input and derived artifacts
+
+- Source of truth:
+  - `domain/*.dsl`
+- Required derived artifacts:
+  - `domain-summary.json`
+  - root-level `*-realm.json`
+
+`domain-summary.json` exists to stabilize generation and validation; it must be regenerated from the DSL and treated as non-authoritative.
+
+## Output contract
+
+The strengthened baseline must produce and keep aligned:
+
+- `server/prisma/schema.prisma`
+- backend/frontend env examples
+- backend/frontend auth seams
+- root `.gitignore`, `server/.gitignore`, `client/.gitignore`
+- `docker-compose.yml`
+- `domain-summary.json`
+- root-level realm import artifact
+
+## Concrete runtime examples
+
+Use these as the baseline examples for this project unless the prompt explicitly overrides them:
+
+- Backend:
+  - `PORT=3000`
+  - `DATABASE_URL="postgresql://postgres:postgres@localhost:5432/toir"`
+  - `CORS_ALLOWED_ORIGINS="http://localhost:5173,https://toir-frontend.greact.ru"`
+  - `KEYCLOAK_ISSUER_URL="https://sso.greact.ru/realms/toir"`
+  - `KEYCLOAK_AUDIENCE="toir-backend"`
+- Frontend:
+  - `VITE_API_URL=http://localhost:3000`
+  - `VITE_KEYCLOAK_URL=https://sso.greact.ru`
+  - `VITE_KEYCLOAK_REALM=toir`
+  - `VITE_KEYCLOAK_CLIENT_ID=toir-frontend`
+
+These example values come from the already working runtime shape and are preferred over local-only Keycloak placeholders.
+
+## Runtime bootstrap
+
+1. Import the root-level realm artifact into Keycloak.
+2. Start PostgreSQL with `docker compose up -d`.
+3. From `server/` run:
+   - initialize or repair the workspace with official Nest CLI scaffolding if required before generating domain code
+   - `npm install`
+   - `npx prisma generate`
+   - `npx prisma migrate dev`
+   - `npx prisma db seed`
+   - `npm run build`
+   - `npm run start`
+4. From `client/` run:
+   - initialize or repair the workspace with official Vite React TypeScript scaffolding if required before generating app code
+   - `npm install`
+   - `npm run build`
+   - `npm run dev`
+
+## Recovery and completion rules
+
+- Repair degraded framework workspaces before applying any new domain-derived generation changes.
+- Do not mark generation complete while `server/` or `client/` remains non-buildable.
+- If dependency installation has not happened yet, buildability may be reported as skipped, but it must never be reported as green without verification.
+- Runtime/bootstrap instructions are reusable project baseline rules; TOiR names remain examples, not the only supported domain project.
+
+## Scaffold expectations
+
+- NestJS workspace creation should follow the official Nest CLI path for new applications and resource scaffolding.
+- Vite frontend creation should follow the official Vite `create-vite` path for React TypeScript applications.
+- The LLM may customize generated code after scaffold creation, but must not replace official workspace initialization with ad hoc file creation.
+
+## Common generation failures to avoid
+
+- starting feature generation before scaffold repair
+- leaving deleted framework config files unrepaired because the current diff looks smaller
+- accepting a form-only validation pass while buildability is unknown
+- binding runtime rules to one project-specific DSL filename instead of `domain/*.dsl`
+
+## Baseline intent
+
+- No new generator engine
+- No compiler platform
+- No planner/emitter/runtime redesign
+- Only the current LLM-first pipeline, strengthened by summary, realm, and validation artifacts
--- a/prompts/validation-rules.md
+++ b/prompts/validation-rules.md
@@ -0,0 +1,98 @@
+# Validation Rules
+
+Validation is now a lightweight automated gate instead of a prose-only checklist.
+
+## Commands
+
+- `npm run generate:domain-summary`
+- `npm run validate:generation`
+- `npm run validate:generation:runtime`
+
+## Prompt-Gate Alignment Rule
+
+- Every invariant described as required in the active prompt corpus must either be enforced by this gate or be called out explicitly as a manual/runtime-only check.
+- Validation must not stay silent about a violation that the prompts describe as forbidden.
+- Validation must not report green buildability when build verification was skipped.
+
+## Gate groups
+
+### Build checks
+
+- at least one `domain/*.dsl` file exists
+- required artifacts exist
+- Prisma schema exists
+- frontend/backend env contracts exist
+- frontend/backend framework workspace files exist
+- `domain-summary.json` matches the current DSL
+- project `.env.example` files keep the working domain-based Keycloak examples unless explicitly overridden
+- `server/` remains a valid Nest workspace
+- `client/` remains a valid Vite workspace
+- generation must not pass validation if framework scaffolding files were deleted and replaced by a hand-written minimal skeleton
+- if dependencies are installed, build verification runs for `server/` and `client/`
+- if dependencies are missing, build verification is reported as skipped with reason instead of green
+
+### Auth checks
+
+- frontend auth seam files exist
+- backend auth seam files exist
+- `401` and `403` semantics stay split
+- auth code keeps the required Keycloak/JWT contracts
+- JWKS resolution chain matches the contract:
+  1. explicit `KEYCLOAK_JWKS_URL`
+  2. OIDC discovery
+  3. certs fallback
+
+### Filter checks
+
+- list resources expose filter UI (including `FilterButton`)
+- reference filters use `ReferenceInput` + `AutocompleteInput` with `filterToQuery`
+- data provider preserves repeated query params for array filters
+- backend FK filters keep exact-match semantics
+- enum repeated params are mapped to Prisma `in`
+- typed form mapping is preserved:
+  - `integer` / `decimal` -> `NumberInput`
+  - `date` -> `DateInput`
+- reference fields intended for navigation keep `ReferenceField link="show"`
+- resources keep `show={...}` registration in `App.tsx`
+
+### Natural-key checks
+
+- response records expose `id`
+- route/update contracts use the real primary key
+- natural-key sort/update paths do not regress to a fake physical `id`
+
+### Realm checks
+
+- a root `*-realm.json` artifact exists
+- realm roles exist
+- audience delivery exists
+- required claims are explicit
+- SPA/backend client structure is explicit
+
+### Runtime checks
+
+- compose topology stays PostgreSQL-only
+- Prisma lifecycle scripts remain in place
+- `/health` stays public
+- backend can execute `npm run build` inside `server/`
+- frontend can execute `npm run build` inside `client/` after dependencies are installed
+- client/server `.env.example` stay aligned with the working runtime defaults:
+  - `https://sso.greact.ru`
+  - `toir`
+  - `toir-frontend`
+  - `toir-backend`
+  - `https://toir-frontend.greact.ru`
+- optional runtime execution mode runs:
+  - `npx prisma generate`
+  - `npx prisma migrate dev`
+  - `npx prisma db seed`
+
+### Scaffold checks
+
+- backend initialization starts from official Nest CLI scaffolding
+- frontend initialization starts from official Vite React TypeScript scaffolding
+- feature generation happens after scaffold creation, not instead of scaffold creation
+- repair happens before generation when workspace is degraded
+- required framework configs and entry files must survive subsequent LLM edits
+
+The automated gate is intentionally small. It enforces the critical reproducibility contract without turning the repository into a test platform or a generator engine.
--- a/server/.env.example
+++ b/server/.env.example
@@ -0,0 +1,7 @@
+PORT=3000
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/toir"
+CORS_ALLOWED_ORIGINS="http://localhost:5173,https://toir-frontend.greact.ru"
+KEYCLOAK_ISSUER_URL="https://sso.greact.ru/realms/toir"
+KEYCLOAK_AUDIENCE="toir-backend"
+# Optional: if omitted, backend uses OIDC discovery and then falls back to issuer + /protocol/openid-connect/certs
+# KEYCLOAK_JWKS_URL="https://sso.greact.ru/realms/toir/protocol/openid-connect/certs"
--- a/server/.eslintrc.js
+++ b/server/.eslintrc.js
@@ -0,0 +1,25 @@
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    project: 'tsconfig.json',
+    tsconfigRootDir: __dirname,
+    sourceType: 'module',
+  },
+  plugins: ['@typescript-eslint/eslint-plugin'],
+  extends: [
+    'plugin:@typescript-eslint/recommended',
+    'plugin:prettier/recommended',
+  ],
+  root: true,
+  env: {
+    node: true,
+    jest: true,
+  },
+  ignorePatterns: ['.eslintrc.js'],
+  rules: {
+    '@typescript-eslint/interface-name-prefix': 'off',
+    '@typescript-eslint/explicit-function-return-type': 'off',
+    '@typescript-eslint/explicit-module-boundary-types': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+  },
+};
--- a/server/.gitignore
+++ b/server/.gitignore
@@ -0,0 +1,32 @@
+# Dependencies
+node_modules/
+
+# Build
+dist/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# Prisma
+prisma/migrations/**/migration_lock.toml
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor / IDE
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
--- a/server/.prettierrc
+++ b/server/.prettierrc
@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all"
+}
--- a/server/README.md
+++ b/server/README.md
@@ -0,0 +1,99 @@
+<p align="center">
+  <a href="http://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+</p>
+
+[circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
+[circleci-url]: https://circleci.com/gh/nestjs/nest
+
+  <p align="center">A progressive <a href="http://nodejs.org" target="_blank">Node.js</a> framework for building efficient and scalable server-side applications.</p>
+    <p align="center">
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/v/@nestjs/core.svg" alt="NPM Version" /></a>
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/l/@nestjs/core.svg" alt="Package License" /></a>
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/dm/@nestjs/common.svg" alt="NPM Downloads" /></a>
+<a href="https://circleci.com/gh/nestjs/nest" target="_blank"><img src="https://img.shields.io/circleci/build/github/nestjs/nest/master" alt="CircleCI" /></a>
+<a href="https://coveralls.io/github/nestjs/nest?branch=master" target="_blank"><img src="https://coveralls.io/repos/github/nestjs/nest/badge.svg?branch=master#9" alt="Coverage" /></a>
+<a href="https://discord.gg/G7Qnnhy" target="_blank"><img src="https://img.shields.io/badge/discord-online-brightgreen.svg" alt="Discord"/></a>
+<a href="https://opencollective.com/nest#backer" target="_blank"><img src="https://opencollective.com/nest/backers/badge.svg" alt="Backers on Open Collective" /></a>
+<a href="https://opencollective.com/nest#sponsor" target="_blank"><img src="https://opencollective.com/nest/sponsors/badge.svg" alt="Sponsors on Open Collective" /></a>
+  <a href="https://paypal.me/kamilmysliwiec" target="_blank"><img src="https://img.shields.io/badge/Donate-PayPal-ff3f59.svg" alt="Donate us"/></a>
+    <a href="https://opencollective.com/nest#sponsor"  target="_blank"><img src="https://img.shields.io/badge/Support%20us-Open%20Collective-41B883.svg" alt="Support us"></a>
+  <a href="https://twitter.com/nestframework" target="_blank"><img src="https://img.shields.io/twitter/follow/nestframework.svg?style=social&label=Follow" alt="Follow us on Twitter"></a>
+</p>
+  <!--[![Backers on Open Collective](https://opencollective.com/nest/backers/badge.svg)](https://opencollective.com/nest#backer)
+  [![Sponsors on Open Collective](https://opencollective.com/nest/sponsors/badge.svg)](https://opencollective.com/nest#sponsor)-->
+
+## Description
+
+[Nest](https://github.com/nestjs/nest) framework TypeScript starter repository.
+
+## Project setup
+
+```bash
+$ npm install
+```
+
+## Compile and run the project
+
+```bash
+# development
+$ npm run start
+
+# watch mode
+$ npm run start:dev
+
+# production mode
+$ npm run start:prod
+```
+
+## Run tests
+
+```bash
+# unit tests
+$ npm run test
+
+# e2e tests
+$ npm run test:e2e
+
+# test coverage
+$ npm run test:cov
+```
+
+## Deployment
+
+When you're ready to deploy your NestJS application to production, there are some key steps you can take to ensure it runs as efficiently as possible. Check out the [deployment documentation](https://docs.nestjs.com/deployment) for more information.
+
+If you are looking for a cloud-based platform to deploy your NestJS application, check out [Mau](https://mau.nestjs.com), our official platform for deploying NestJS applications on AWS. Mau makes deployment straightforward and fast, requiring just a few simple steps:
+
+```bash
+$ npm install -g mau
+$ mau deploy
+```
+
+With Mau, you can deploy your application in just a few clicks, allowing you to focus on building features rather than managing infrastructure.
+
+## Resources
+
+Check out a few resources that may come in handy when working with NestJS:
+
+- Visit the [NestJS Documentation](https://docs.nestjs.com) to learn more about the framework.
+- For questions and support, please visit our [Discord channel](https://discord.gg/G7Qnnhy).
+- To dive deeper and get more hands-on experience, check out our official video [courses](https://courses.nestjs.com/).
+- Deploy your application to AWS with the help of [NestJS Mau](https://mau.nestjs.com) in just a few clicks.
+- Visualize your application graph and interact with the NestJS application in real-time using [NestJS Devtools](https://devtools.nestjs.com).
+- Need help with your project (part-time to full-time)? Check out our official [enterprise support](https://enterprise.nestjs.com).
+- To stay in the loop and get updates, follow us on [X](https://x.com/nestframework) and [LinkedIn](https://linkedin.com/company/nestjs).
+- Looking for a job, or have a job to offer? Check out our official [Jobs board](https://jobs.nestjs.com).
+
+## Support
+
+Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://docs.nestjs.com/support).
+
+## Stay in touch
+
+- Author - [Kamil Myśliwiec](https://twitter.com/kammysliwiec)
+- Website - [https://nestjs.com](https://nestjs.com/)
+- Twitter - [@nestframework](https://twitter.com/nestframework)
+
+## License
+
+Nest is [MIT licensed](https://github.com/nestjs/nest/blob/master/LICENSE).
--- a/server/nest-cli.json
+++ b/server/nest-cli.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "deleteOutDir": true
+  }
+}
--- a/server/package-lock.json
+++ b/server/package-lock.json
--- a/server/package.json
+++ b/server/package.json
@@ -0,0 +1,79 @@
+{
+  "name": "server",
+  "version": "0.0.1",
+  "description": "",
+  "author": "",
+  "private": true,
+  "license": "UNLICENSED",
+  "scripts": {
+    "build": "nest build",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "start": "nest start",
+    "start:dev": "nest start --watch",
+    "start:debug": "nest start --debug --watch",
+    "start:prod": "node dist/main",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+    "test:e2e": "jest --config ./test/jest-e2e.json",
+    "generate:from-dsl": "node ../generation/generate.mjs --apply --dsl domain/TOiR.domain.dsl",
+    "generate:bundle-json": "node ../generation/generate.mjs --print-bundle-json --dsl domain/TOiR.domain.dsl",
+    "postinstall": "prisma generate"
+  },
+  "prisma": {
+    "seed": "ts-node prisma/seed.ts"
+  },
+  "dependencies": {
+    "@nestjs/common": "^10.0.0",
+    "@nestjs/config": "^4.0.3",
+    "@nestjs/core": "^10.0.0",
+    "@nestjs/platform-express": "^10.0.0",
+    "@prisma/client": "^5.22.0",
+    "jose": "^6.2.2",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.1"
+  },
+  "devDependencies": {
+    "@nestjs/cli": "^10.0.0",
+    "@nestjs/schematics": "^10.0.0",
+    "@nestjs/testing": "^10.0.0",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^29.5.2",
+    "@types/node": "^20.3.1",
+    "@types/supertest": "^6.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "eslint": "^8.0.0",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jest": "^29.5.0",
+    "prettier": "^3.0.0",
+    "prisma": "^5.22.0",
+    "source-map-support": "^0.5.21",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.1.0",
+    "ts-loader": "^9.4.3",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.1.3"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  }
+}
--- a/server/prisma/migrations/20260322114233_baseline/migration.sql
+++ b/server/prisma/migrations/20260322114233_baseline/migration.sql
@@ -0,0 +1,68 @@
+-- CreateEnum
+CREATE TYPE "EquipmentStatus" AS ENUM ('Active', 'Repair', 'Reserve', 'WriteOff');
+
+-- CreateEnum
+CREATE TYPE "RepairKind" AS ENUM ('TO', 'TR', 'TRE', 'KR', 'AR', 'MP');
+
+-- CreateEnum
+CREATE TYPE "RepairOrderStatus" AS ENUM ('Draft', 'Approved', 'InWork', 'Done', 'Cancelled');
+
+-- CreateTable
+CREATE TABLE "EquipmentType" (
+    "code" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "manufacturer" TEXT,
+    "maintenanceIntervalHours" INTEGER,
+    "overhaulIntervalHours" INTEGER,
+
+    CONSTRAINT "EquipmentType_pkey" PRIMARY KEY ("code")
+);
+
+-- CreateTable
+CREATE TABLE "Equipment" (
+    "id" TEXT NOT NULL,
+    "inventoryNumber" TEXT NOT NULL,
+    "serialNumber" TEXT,
+    "name" TEXT NOT NULL,
+    "equipmentTypeCode" TEXT NOT NULL,
+    "status" "EquipmentStatus" NOT NULL DEFAULT 'Active',
+    "location" TEXT,
+    "commissionedAt" TIMESTAMP(3),
+    "totalEngineHours" DECIMAL(65,30),
+    "engineHoursSinceLastRepair" DECIMAL(65,30),
+    "lastRepairAt" TIMESTAMP(3),
+    "notes" TEXT,
+
+    CONSTRAINT "Equipment_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "RepairOrder" (
+    "id" TEXT NOT NULL,
+    "number" TEXT NOT NULL,
+    "equipmentId" TEXT NOT NULL,
+    "repairKind" "RepairKind" NOT NULL,
+    "status" "RepairOrderStatus" NOT NULL DEFAULT 'Draft',
+    "plannedAt" TIMESTAMP(3) NOT NULL,
+    "startedAt" TIMESTAMP(3),
+    "completedAt" TIMESTAMP(3),
+    "contractor" TEXT,
+    "engineHoursAtRepair" DECIMAL(65,30),
+    "description" TEXT,
+    "notes" TEXT,
+
+    CONSTRAINT "RepairOrder_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Equipment_inventoryNumber_key" ON "Equipment"("inventoryNumber");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "RepairOrder_number_key" ON "RepairOrder"("number");
+
+-- AddForeignKey
+ALTER TABLE "Equipment" ADD CONSTRAINT "Equipment_equipmentTypeCode_fkey" FOREIGN KEY ("equipmentTypeCode") REFERENCES "EquipmentType"("code") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "RepairOrder" ADD CONSTRAINT "RepairOrder_equipmentId_fkey" FOREIGN KEY ("equipmentId") REFERENCES "Equipment"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
--- a/server/prisma/schema.prisma
+++ b/server/prisma/schema.prisma
@@ -0,0 +1,74 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+enum EquipmentStatus {
+  Active
+  Repair
+  Reserve
+  WriteOff
+}
+
+enum RepairKind {
+  TO
+  TR
+  TRE
+  KR
+  AR
+  MP
+}
+
+enum RepairOrderStatus {
+  Draft
+  Approved
+  InWork
+  Done
+  Cancelled
+}
+
+model EquipmentType {
+  code String @id
+  name String
+  manufacturer String?
+  maintenanceIntervalHours Int?
+  overhaulIntervalHours Int?
+  equipment Equipment[]
+}
+
+model Equipment {
+  id String @id @default(uuid())
+  inventoryNumber String @unique
+  serialNumber String?
+  name String
+  equipmentTypeCode String
+  status EquipmentStatus @default(Active)
+  location String?
+  commissionedAt DateTime?
+  totalEngineHours Decimal?
+  engineHoursSinceLastRepair Decimal?
+  lastRepairAt DateTime?
+  notes String?
+  equipmentType EquipmentType @relation(fields: [equipmentTypeCode], references: [code])
+  repairOrders RepairOrder[]
+}
+
+model RepairOrder {
+  id String @id @default(uuid())
+  number String @unique
+  equipmentId String
+  repairKind RepairKind
+  status RepairOrderStatus @default(Draft)
+  plannedAt DateTime
+  startedAt DateTime?
+  completedAt DateTime?
+  contractor String?
+  engineHoursAtRepair Decimal?
+  description String?
+  notes String?
+  equipment Equipment @relation(fields: [equipmentId], references: [id])
+}
--- a/server/prisma/seed.ts
+++ b/server/prisma/seed.ts
@@ -0,0 +1,172 @@
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+async function main() {
+  const equipmentTypes = [
+    {
+      code: 'pump',
+      name: 'Насосный агрегат',
+      manufacturer: 'АО НасосПром',
+      maintenanceIntervalHours: 2000,
+      overhaulIntervalHours: 16000,
+    },
+    {
+      code: 'compressor',
+      name: 'Компрессорная установка',
+      manufacturer: 'ОАО Компрессормаш',
+      maintenanceIntervalHours: 1500,
+      overhaulIntervalHours: 12000,
+    },
+    {
+      code: 'generator',
+      name: 'Дизель-генератор',
+      manufacturer: 'АО ЭнергоМаш',
+      maintenanceIntervalHours: 500,
+      overhaulIntervalHours: 6000,
+    },
+    {
+      code: 'valve',
+      name: 'Запорная арматура',
+      manufacturer: 'ЗАО АрматурПром',
+      maintenanceIntervalHours: 1000,
+      overhaulIntervalHours: 10000,
+    },
+    {
+      code: 'sensor',
+      name: 'Датчик давления',
+      manufacturer: 'ООО ПриборСервис',
+      maintenanceIntervalHours: 800,
+      overhaulIntervalHours: 8000,
+    },
+    {
+      code: 'motor',
+      name: 'Электродвигатель',
+      manufacturer: 'ПАО ЭлектроМотор',
+      maintenanceIntervalHours: 1200,
+      overhaulIntervalHours: 14000,
+    },
+    {
+      code: 'fan',
+      name: 'Вентилятор',
+      manufacturer: 'АО ВентПром',
+      maintenanceIntervalHours: 700,
+      overhaulIntervalHours: 9000,
+    },
+    {
+      code: 'heat-exchanger',
+      name: 'Теплообменник',
+      manufacturer: 'ОАО ТеплоТех',
+      maintenanceIntervalHours: 1800,
+      overhaulIntervalHours: 15000,
+    },
+    {
+      code: 'filter',
+      name: 'Фильтровальная установка',
+      manufacturer: 'ООО ФильтрТех',
+      maintenanceIntervalHours: 600,
+      overhaulIntervalHours: 7000,
+    },
+    {
+      code: 'separator',
+      name: 'Сепаратор',
+      manufacturer: 'АО СепараторМаш',
+      maintenanceIntervalHours: 1600,
+      overhaulIntervalHours: 13000,
+    },
+    {
+      code: 'transformer',
+      name: 'Трансформатор',
+      manufacturer: 'ПАО ТрансЭнерго',
+      maintenanceIntervalHours: 2500,
+      overhaulIntervalHours: 20000,
+    },
+  ] as const;
+
+  for (const type of equipmentTypes) {
+    await prisma.equipmentType.upsert({
+      where: { code: type.code },
+      update: { ...type },
+      create: { ...type },
+    });
+  }
+
+  const equipmentRecords: { id: string; inventoryNumber: string; name: string }[] = [];
+  for (let i = 1; i <= 11; i++) {
+    const type = equipmentTypes[(i - 1) % equipmentTypes.length];
+    const inventoryNumber = `INV-${String(i).padStart(3, '0')}`;
+    const serialNumber = `SN-2026-${String(i).padStart(4, '0')}`;
+    const record = await prisma.equipment.upsert({
+      where: { inventoryNumber },
+      update: {
+        serialNumber,
+        name: `${type.name} #${i}`,
+        equipmentTypeCode: type.code,
+        status: i % 5 === 0 ? 'Repair' : 'Active',
+        location: i % 2 === 0 ? `Площадка ${Math.ceil(i / 2)}` : `Цех ${Math.ceil(i / 3)}`,
+        commissionedAt: new Date(2022, (i - 1) % 12, 1 + ((i - 1) % 28)),
+        totalEngineHours: 1000 + i * 350,
+        engineHoursSinceLastRepair: 200 + i * 25,
+      },
+      create: {
+        inventoryNumber,
+        serialNumber,
+        name: `${type.name} #${i}`,
+        equipmentTypeCode: type.code,
+        status: i % 5 === 0 ? 'Repair' : 'Active',
+        location: i % 2 === 0 ? `Площадка ${Math.ceil(i / 2)}` : `Цех ${Math.ceil(i / 3)}`,
+        commissionedAt: new Date(2022, (i - 1) % 12, 1 + ((i - 1) % 28)),
+        totalEngineHours: 1000 + i * 350,
+        engineHoursSinceLastRepair: 200 + i * 25,
+      },
+    });
+    equipmentRecords.push({ id: record.id, inventoryNumber: record.inventoryNumber, name: record.name });
+  }
+
+  const repairKinds = ['TO', 'TR', 'TRE', 'KR', 'AR', 'MP'] as const;
+  const statuses = ['Draft', 'Approved', 'InWork', 'Done', 'Cancelled'] as const;
+
+  for (let i = 1; i <= 11; i++) {
+    const number = `RO-2026-${String(i).padStart(3, '0')}`;
+    const equipment = equipmentRecords[(i - 1) % equipmentRecords.length];
+    await prisma.repairOrder.upsert({
+      where: { number },
+      update: {
+        equipmentId: equipment.id,
+        repairKind: repairKinds[(i - 1) % repairKinds.length],
+        status: statuses[(i - 1) % statuses.length],
+        plannedAt: new Date(2026, ((i - 1) % 12), 1 + ((i - 1) % 28)),
+        startedAt: i % 4 === 0 ? new Date(2026, ((i - 1) % 12), 2 + ((i - 1) % 28)) : null,
+        completedAt: i % 5 === 0 ? new Date(2026, ((i - 1) % 12), 5 + ((i - 1) % 28)) : null,
+        contractor: i % 3 === 0 ? 'ООО СервисРемонт' : 'АО ТехПодряд',
+        engineHoursAtRepair: 1000 + i * 350,
+        description: `Заявка на ремонт ${equipment.inventoryNumber} (${equipment.name})`,
+        notes: i % 2 === 0 ? 'Тестовая заметка' : null,
+      },
+      create: {
+        number,
+        equipmentId: equipment.id,
+        repairKind: repairKinds[(i - 1) % repairKinds.length],
+        status: statuses[(i - 1) % statuses.length],
+        plannedAt: new Date(2026, ((i - 1) % 12), 1 + ((i - 1) % 28)),
+        startedAt: i % 4 === 0 ? new Date(2026, ((i - 1) % 12), 2 + ((i - 1) % 28)) : null,
+        completedAt: i % 5 === 0 ? new Date(2026, ((i - 1) % 12), 5 + ((i - 1) % 28)) : null,
+        contractor: i % 3 === 0 ? 'ООО СервисРемонт' : 'АО ТехПодряд',
+        engineHoursAtRepair: 1000 + i * 350,
+        description: `Заявка на ремонт ${equipment.inventoryNumber} (${equipment.name})`,
+        notes: i % 2 === 0 ? 'Тестовая заметка' : null,
+      },
+    });
+  }
+
+  console.log('Seed data created successfully');
+}
+
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });
--- a/server/src/aid-export/README.md
+++ b/server/src/aid-export/README.md
@@ -0,0 +1,87 @@
+# AID export: OpenAPI + генератор приложения
+
+**Полное описание задачи, сценариев и CLI:** [docs/AID_EXPORT_README.md](../../../docs/AID_EXPORT_README.md)
+
+Ниже — краткая справка по HTTP-эндпоинтам.
+
+---
+
+## 1. `api-format` → OpenAPI 3.0
+
+`POST /aid/export/openapi`
+
+Внутри: `tools/api-format-to-openapi/convert.mjs` (режимы `deterministic` и `llm`).
+
+**Тело:**
+
+```json
+{
+  "apiFormat": { "apiFormatVersion": "1", "...": "..." },
+  "mode": "deterministic"
+}
+```
+
+**Ответ:** `{ "openapi": { ... } }`
+
+---
+
+## 2. DSL → сгенерированное приложение (бандл или запись на диск)
+
+`POST /aid/export/app`
+
+Внутри: `generation/generate.mjs`.
+
+**Тело:**
+
+```json
+{
+  "dsl": "domain TOiR {\n  ...\n}\n",
+  "apply": false
+}
+```
+
+- **`apply` по умолчанию `false` (рекомендуется для AID):** ответ содержит `files` — карта **путь от корня репозитория → текст файла** (Prisma, Nest-модули, React Admin и обновлённые `app.module.ts` / `App.tsx`). **На диск ничего не пишется.**
+- **`apply: true`:** выполняется тот же процесс, что и `npm run generate:from-dsl` с `--apply` — **перезапись файлов в рабочей копии** на машине, где запущен Nest. Включено только если в окружении задано **`AID_GENERATOR_ALLOW_APPLY=1`** (или `true`). Иначе `403 Forbidden`.
+
+**Ответ (бандл):**
+
+```json
+{
+  "applied": false,
+  "entityCount": 3,
+  "enumCount": 3,
+  "files": {
+    "server/prisma/schema.prisma": "...",
+    "server/src/modules/equipment/equipment.controller.ts": "...",
+    "client/src/App.tsx": "..."
+  }
+}
+```
+
+**Ответ (apply):**
+
+```json
+{
+  "applied": true,
+  "message": "Generated 3 entities from ..."
+}
+```
+
+### CLI-аналог бандла (без Nest)
+
+Из **корня репозитория**:
+
+```bash
+node generation/generate.mjs --print-bundle-json --dsl examples/TOiR.domain.dsl > bundle.json
+```
+
+---
+
+## Безопасность
+
+- Если в `.env` задан **`AID_EXPORT_API_KEY`**, для **обоих** эндпоинтов нужен заголовок **`X-AID-Export-Key`** с тем же значением.
+- Не включайте **`AID_GENERATOR_ALLOW_APPLY`** на публичных инстансах без понимания рисков.
+
+## Требования
+
+- Запуск Nest с **cwd = `server/`** относительно корня репо, чтобы находились `../generation/generate.mjs` и `../tools/...`.
--- a/server/src/aid-export/aid-export.controller.ts
+++ b/server/src/aid-export/aid-export.controller.ts
@@ -0,0 +1,112 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  ForbiddenException,
+  Headers,
+  HttpCode,
+  Post,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AidExportService, OpenApiExportMode } from './aid-export.service';
+
+/**
+ * HTTP-экспортёры для AID: OpenAPI из api-format и генерация приложения из DSL.
+ */
+@Controller('aid/export')
+export class AidExportController {
+  constructor(
+    private readonly aidExport: AidExportService,
+    private readonly config: ConfigService,
+  ) {}
+
+  private assertExportKey(exportKey: string | undefined) {
+    const requiredKey = this.config.get<string>('AID_EXPORT_API_KEY');
+    if (requiredKey && exportKey !== requiredKey) {
+      throw new UnauthorizedException('Invalid or missing X-AID-Export-Key');
+    }
+  }
+
+  /**
+   * POST /aid/export/openapi
+   * Body: { "apiFormat": <объект api-format>, "mode"?: "deterministic" | "llm" }
+   * Response: { "openapi": <OpenAPI 3.0.3 document> }
+   *
+   * mode=llm требует OPENAI_API_KEY в окружении сервера.
+   *
+   * Если задан AID_EXPORT_API_KEY, клиент должен передать заголовок X-AID-Export-Key с тем же значением.
+   */
+  @Post('openapi')
+  @HttpCode(200)
+  async exportOpenApi(
+    @Body()
+    body: { apiFormat?: unknown; mode?: string },
+    @Headers('x-aid-export-key') exportKey?: string,
+  ) {
+    this.assertExportKey(exportKey);
+
+    if (body == null || typeof body !== 'object' || body.apiFormat == null) {
+      throw new BadRequestException('Body must be a JSON object with an "apiFormat" property');
+    }
+    if (typeof body.apiFormat !== 'object' || Array.isArray(body.apiFormat)) {
+      throw new BadRequestException('"apiFormat" must be a JSON object');
+    }
+
+    const mode: OpenApiExportMode =
+      body.mode === 'llm' ? 'llm' : 'deterministic';
+
+    const openapi = await this.aidExport.convertApiFormatToOpenApi(
+      body.apiFormat,
+      mode,
+    );
+    return { openapi };
+  }
+
+  /**
+   * POST /aid/export/app
+   * Body: { "dsl": "<текст DSL как в examples/TOiR.domain.dsl>", "apply"?: boolean }
+   *
+   * По умолчанию `apply: false` — возвращается JSON с полем `files` (пути относительно корня репо → содержимое),
+   * без записи на диск (безопасно для вызова из AID).
+   *
+   * `apply: true` перезаписывает файлы в **текущей** рабочей копии репозитория на машине, где крутится Nest.
+   * Разрешено только если в окружении задано `AID_GENERATOR_ALLOW_APPLY=1` (или `true`).
+   */
+  @Post('app')
+  @HttpCode(200)
+  async exportApp(
+    @Body()
+    body: { dsl?: string; apply?: boolean },
+    @Headers('x-aid-export-key') exportKey?: string,
+  ) {
+    this.assertExportKey(exportKey);
+
+    if (body == null || typeof body !== 'object') {
+      throw new BadRequestException('Body must be a JSON object');
+    }
+    if (typeof body.dsl !== 'string' || !body.dsl.trim()) {
+      throw new BadRequestException('Body must include a non-empty string "dsl"');
+    }
+
+    const apply = body.apply === true;
+    if (apply) {
+      const allow = this.config.get<string>('AID_GENERATOR_ALLOW_APPLY');
+      if (allow !== '1' && allow !== 'true') {
+        throw new ForbiddenException(
+          'apply=true is disabled. Set AID_GENERATOR_ALLOW_APPLY=1 on the server to allow writing generated files to disk.',
+        );
+      }
+      const { message } = await this.aidExport.generateAppApply(body.dsl);
+      return { applied: true, message };
+    }
+
+    const bundle = await this.aidExport.generateAppBundle(body.dsl);
+    return {
+      applied: false,
+      entityCount: bundle.entityCount,
+      enumCount: bundle.enumCount,
+      files: bundle.files,
+    };
+  }
+}
--- a/server/src/aid-export/aid-export.module.ts
+++ b/server/src/aid-export/aid-export.module.ts
@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { AidExportController } from './aid-export.controller';
+import { AidExportService } from './aid-export.service';
+
+@Module({
+  controllers: [AidExportController],
+  providers: [AidExportService],
+})
+export class AidExportModule {}
--- a/server/src/aid-export/aid-export.service.ts
+++ b/server/src/aid-export/aid-export.service.ts
@@ -0,0 +1,154 @@
+import { Injectable, InternalServerErrorException } from '@nestjs/common';
+import { randomUUID } from 'crypto';
+import { execFile } from 'child_process';
+import { access, readFile, unlink, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { promisify } from 'util';
+
+const execFileAsync = promisify(execFile);
+
+const LARGE_BUFFER = 64 * 1024 * 1024;
+
+export type OpenApiExportMode = 'deterministic' | 'llm';
+
+export type AppGeneratorBundle = {
+  entityCount: number;
+  enumCount: number;
+  files: Record<string, string>;
+};
+
+@Injectable()
+export class AidExportService {
+  /**
+   * Путь к tools/api-format-to-openapi/convert.mjs относительно cwd процесса (обычно каталог server/).
+   */
+  private resolveConvertScript(): string {
+    return join(process.cwd(), '..', 'tools', 'api-format-to-openapi', 'convert.mjs');
+  }
+
+  /** Путь к generation/generate.mjs относительно cwd = server/. */
+  private resolveGenerateScript(): string {
+    return join(process.cwd(), '..', 'generation', 'generate.mjs');
+  }
+
+  async convertApiFormatToOpenApi(
+    apiFormat: unknown,
+    mode: OpenApiExportMode,
+  ): Promise<Record<string, unknown>> {
+    const script = this.resolveConvertScript();
+    try {
+      await access(script);
+    } catch {
+      throw new InternalServerErrorException(
+        `Converter script not found at ${script}. Run the server with cwd = server/ from repo root.`,
+      );
+    }
+
+    const id = randomUUID();
+    const inPath = join(tmpdir(), `api-format-${id}.json`);
+    const outPath = join(tmpdir(), `openapi-${id}.json`);
+
+    try {
+      await writeFile(inPath, JSON.stringify(apiFormat), 'utf8');
+      const { stderr } = await execFileAsync(
+        process.execPath,
+        [script, '--in', inPath, '--out', outPath, '--mode', mode],
+        {
+          env: { ...process.env },
+          maxBuffer: 16 * 1024 * 1024,
+        },
+      );
+      if (stderr?.trim()) {
+        // convert.mjs пишет ошибки в stderr при падении; при успехе обычно пусто
+        console.warn('[aid-export]', stderr);
+      }
+      const raw = await readFile(outPath, 'utf8');
+      return JSON.parse(raw) as Record<string, unknown>;
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new InternalServerErrorException(`OpenAPI conversion failed: ${msg}`);
+    } finally {
+      await unlink(inPath).catch(() => undefined);
+      await unlink(outPath).catch(() => undefined);
+    }
+  }
+
+  /**
+   * DSL → снимок сгенерированных файлов (без записи в репозиторий).
+   * Использует `generation/generate.mjs --print-bundle-json`.
+   */
+  async generateAppBundle(dsl: string): Promise<AppGeneratorBundle> {
+    const script = this.resolveGenerateScript();
+    try {
+      await access(script);
+    } catch {
+      throw new InternalServerErrorException(
+        `Generator script not found at ${script}. Run the server with cwd = server/ from repo root.`,
+      );
+    }
+
+    const id = randomUUID();
+    const dslPath = join(tmpdir(), `domain-${id}.dsl`);
+
+    try {
+      await writeFile(dslPath, dsl, 'utf8');
+      const { stdout, stderr } = await execFileAsync(
+        process.execPath,
+        [script, '--print-bundle-json', '--dsl', dslPath],
+        {
+          env: { ...process.env },
+          maxBuffer: LARGE_BUFFER,
+        },
+      );
+      if (stderr?.trim()) console.warn('[aid-export][generate]', stderr);
+      const bundle = JSON.parse(stdout) as AppGeneratorBundle;
+      if (!bundle.files || typeof bundle.files !== 'object') {
+        throw new Error('Invalid bundle: missing files');
+      }
+      return bundle;
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new InternalServerErrorException(`App generator (bundle) failed: ${msg}`);
+    } finally {
+      await unlink(dslPath).catch(() => undefined);
+    }
+  }
+
+  /**
+   * DSL → запись сгенерированного кода в рабочую копию репозитория (`--apply`).
+   * Опасно для публичных эндпоинтов; включать только осознанно.
+   */
+  async generateAppApply(dsl: string): Promise<{ message: string }> {
+    const script = this.resolveGenerateScript();
+    try {
+      await access(script);
+    } catch {
+      throw new InternalServerErrorException(
+        `Generator script not found at ${script}. Run the server with cwd = server/ from repo root.`,
+      );
+    }
+
+    const id = randomUUID();
+    const dslPath = join(tmpdir(), `domain-${id}.dsl`);
+
+    try {
+      await writeFile(dslPath, dsl, 'utf8');
+      const { stdout, stderr } = await execFileAsync(
+        process.execPath,
+        [script, '--apply', '--dsl', dslPath],
+        {
+          env: { ...process.env },
+          maxBuffer: LARGE_BUFFER,
+        },
+      );
+      if (stderr?.trim()) console.warn('[aid-export][generate-apply]', stderr);
+      return { message: (stdout || 'ok').trim() };
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new InternalServerErrorException(`App generator (apply) failed: ${msg}`);
+    } finally {
+      await unlink(dslPath).catch(() => undefined);
+    }
+  }
+}
--- a/server/src/app.module.ts
+++ b/server/src/app.module.ts
@@ -0,0 +1,26 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { AuthModule } from './auth/auth.module';
+import { validateEnvironment } from './config/env.validation';
+import { PrismaModule } from './prisma/prisma.module';
+import { HealthModule } from './health/health.module';
+import { EquipmentTypeModule } from './modules/equipment-type/equipment-type.module';
+import { EquipmentModule } from './modules/equipment/equipment.module';
+import { RepairOrderModule } from './modules/repair-order/repair-order.module';
+import { AidExportModule } from './aid-export/aid-export.module';
+
+@Module({
+  imports: [ConfigModule.forRoot({
+      isGlobal: true,
+      validate: validateEnvironment,
+    }),
+    AuthModule,
+    PrismaModule,
+    HealthModule,
+    AidExportModule,
+    EquipmentTypeModule,
+    EquipmentModule,
+    RepairOrderModule,
+  ],
+})
+export class AppModule {}
--- a/server/src/auth/auth.constants.ts
+++ b/server/src/auth/auth.constants.ts
@@ -0,0 +1,3 @@
+export const IS_PUBLIC_KEY = 'isPublic';
+export const ROLES_KEY = 'roles';
+
--- a/server/src/auth/auth.module.ts
+++ b/server/src/auth/auth.module.ts
@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { AuthService } from './auth.service';
+import { JwtAuthGuard } from './guards/jwt-auth.guard';
+import { RolesGuard } from './guards/roles.guard';
+
+@Module({
+  providers: [
+    AuthService,
+    {
+      provide: APP_GUARD,
+      useClass: JwtAuthGuard,
+    },
+    {
+      provide: APP_GUARD,
+      useClass: RolesGuard,
+    },
+  ],
+  exports: [AuthService],
+})
+export class AuthModule {}
+
--- a/server/src/auth/auth.service.ts
+++ b/server/src/auth/auth.service.ts
@@ -0,0 +1,129 @@
+import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { RuntimeEnvironment } from '../config/env.validation';
+import {
+  AuthenticatedUser,
+  KeycloakJwtPayload,
+} from './interfaces/authenticated-user.interface';
+
+@Injectable()
+export class AuthService {
+  private readonly logger = new Logger(AuthService.name);
+  private readonly issuerUrl: string;
+  private readonly audience: string;
+  private readonly explicitJwksUrl?: string;
+
+  private jwksResolverPromise: Promise<ReturnType<typeof createRemoteJWKSet>> | null =
+    null;
+  private jwksResolver: ReturnType<typeof createRemoteJWKSet> | null = null;
+
+  constructor(
+    private readonly configService: ConfigService<RuntimeEnvironment, true>,
+  ) {
+    this.issuerUrl = this.configService.getOrThrow('KEYCLOAK_ISSUER_URL');
+    this.audience = this.configService.getOrThrow('KEYCLOAK_AUDIENCE');
+    this.explicitJwksUrl = this.configService.get('KEYCLOAK_JWKS_URL');
+  }
+
+  async verifyAccessToken(token: string): Promise<AuthenticatedUser> {
+    try {
+      const jwksResolver = await this.getJwksResolver();
+
+      const { payload } = await jwtVerify(token, jwksResolver, {
+        issuer: this.issuerUrl,
+        audience: this.audience,
+      });
+
+      return this.mapPayloadToUser(payload as KeycloakJwtPayload);
+    } catch (error) {
+      this.logger.warn(
+        `JWT verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+      );
+      throw new UnauthorizedException('Invalid or expired access token');
+    }
+  }
+
+  private mapPayloadToUser(payload: KeycloakJwtPayload): AuthenticatedUser {
+    if (!payload.sub) {
+      throw new UnauthorizedException('Token subject is missing');
+    }
+
+    const roles = Array.isArray(payload.realm_access?.roles)
+      ? payload.realm_access.roles.filter(
+          (role): role is string => typeof role === 'string',
+        )
+      : [];
+
+    return {
+      sub: payload.sub,
+      username: payload.preferred_username,
+      name: payload.name,
+      email: payload.email,
+      roles,
+      claims: payload,
+    };
+  }
+
+  private async getJwksResolver() {
+    if (this.jwksResolver) {
+      return this.jwksResolver;
+    }
+
+    if (!this.jwksResolverPromise) {
+      this.jwksResolverPromise = this.createJwksResolver()
+        .then((resolver) => {
+          this.jwksResolver = resolver;
+          return resolver;
+        })
+        .finally(() => {
+          this.jwksResolverPromise = null;
+        });
+    }
+
+    return this.jwksResolverPromise;
+  }
+
+  private async createJwksResolver() {
+    const jwksUrl = await this.resolveJwksUrl();
+    this.logger.log(`Using JWKS URL: ${jwksUrl}`);
+    return createRemoteJWKSet(new URL(jwksUrl));
+  }
+
+  private async resolveJwksUrl(): Promise<string> {
+    if (this.explicitJwksUrl) {
+      return this.explicitJwksUrl;
+    }
+
+    const issuer = this.issuerUrl.replace(/\/+$/, '');
+    const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+
+    try {
+      const discoveryResponse = await fetch(discoveryUrl, {
+        headers: {
+          Accept: 'application/json',
+        },
+      });
+
+      if (discoveryResponse.ok) {
+        const discoveryDocument = (await discoveryResponse.json()) as {
+          jwks_uri?: string;
+        };
+
+        if (
+          typeof discoveryDocument.jwks_uri === 'string' &&
+          discoveryDocument.jwks_uri.trim().length > 0
+        ) {
+          return discoveryDocument.jwks_uri;
+        }
+      }
+    } catch (error) {
+      this.logger.warn(
+        `OIDC discovery failed at ${discoveryUrl}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+      );
+    }
+
+    return `${issuer}/protocol/openid-connect/certs`;
+  }
+}
+
--- a/server/src/auth/decorators/public.decorator.ts
+++ b/server/src/auth/decorators/public.decorator.ts
@@ -0,0 +1,5 @@
+import { SetMetadata } from '@nestjs/common';
+import { IS_PUBLIC_KEY } from '../auth.constants';
+
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
+
--- a/server/src/auth/decorators/roles.decorator.ts
+++ b/server/src/auth/decorators/roles.decorator.ts
@@ -0,0 +1,6 @@
+import { SetMetadata } from '@nestjs/common';
+import { ROLES_KEY } from '../auth.constants';
+import { RealmRole } from '../roles/realm-role.enum';
+
+export const Roles = (...roles: RealmRole[]) => SetMetadata(ROLES_KEY, roles);
+
--- a/server/src/auth/guards/jwt-auth.guard.ts
+++ b/server/src/auth/guards/jwt-auth.guard.ts
@@ -0,0 +1,54 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { IS_PUBLIC_KEY } from '../auth.constants';
+import { AuthService } from '../auth.service';
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly authService: AuthService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const token = this.extractBearerToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('Missing bearer token');
+    }
+
+    request.user = await this.authService.verifyAccessToken(token);
+    return true;
+  }
+
+  private extractBearerToken(request: Request): string | null {
+    const authorization = request.headers.authorization;
+    if (!authorization) {
+      return null;
+    }
+
+    const [scheme, token] = authorization.split(' ');
+    if (scheme?.toLowerCase() !== 'bearer' || !token) {
+      return null;
+    }
+
+    return token;
+  }
+}
+
--- a/server/src/auth/guards/roles.guard.ts
+++ b/server/src/auth/guards/roles.guard.ts
@@ -0,0 +1,49 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { IS_PUBLIC_KEY, ROLES_KEY } from '../auth.constants';
+import { RealmRole } from '../roles/realm-role.enum';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const requiredRoles =
+      this.reflector.getAllAndOverride<RealmRole[]>(ROLES_KEY, [
+        context.getHandler(),
+        context.getClass(),
+      ]) ?? [];
+
+    if (requiredRoles.length === 0) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const userRoles = request.user?.roles ?? [];
+    const hasRequiredRole = requiredRoles.some((role) =>
+      userRoles.includes(role),
+    );
+
+    if (!hasRequiredRole) {
+      throw new ForbiddenException('Access denied: insufficient role');
+    }
+
+    return true;
+  }
+}
+
--- a/server/src/auth/interfaces/authenticated-user.interface.ts
+++ b/server/src/auth/interfaces/authenticated-user.interface.ts
@@ -0,0 +1,20 @@
+import { JWTPayload } from 'jose';
+
+export interface KeycloakJwtPayload extends JWTPayload {
+  preferred_username?: string;
+  name?: string;
+  email?: string;
+  realm_access?: {
+    roles?: string[];
+  };
+}
+
+export interface AuthenticatedUser {
+  sub: string;
+  username?: string;
+  name?: string;
+  email?: string;
+  roles: string[];
+  claims: KeycloakJwtPayload;
+}
+
--- a/server/src/auth/interfaces/express-request.interface.ts
+++ b/server/src/auth/interfaces/express-request.interface.ts
@@ -0,0 +1,12 @@
+import { AuthenticatedUser } from './authenticated-user.interface';
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: AuthenticatedUser;
+    }
+  }
+}
+
+export {};
+
--- a/server/src/auth/roles/realm-role.enum.ts
+++ b/server/src/auth/roles/realm-role.enum.ts
@@ -0,0 +1,6 @@
+export enum RealmRole {
+  Admin = 'admin',
+  Editor = 'editor',
+  Viewer = 'viewer',
+}
+
--- a/server/src/config/env.validation.ts
+++ b/server/src/config/env.validation.ts
@@ -0,0 +1,58 @@
+export interface RuntimeEnvironment {
+  PORT: number;
+  DATABASE_URL: string;
+  CORS_ALLOWED_ORIGINS: string;
+  KEYCLOAK_ISSUER_URL: string;
+  KEYCLOAK_AUDIENCE: string;
+  KEYCLOAK_JWKS_URL?: string;
+}
+
+function getRequiredString(
+  config: Record<string, unknown>,
+  key: keyof RuntimeEnvironment,
+): string {
+  const value = config[key];
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error(`Missing required environment variable: ${key}`);
+  }
+  return value.trim();
+}
+
+function getOptionalString(
+  config: Record<string, unknown>,
+  key: keyof RuntimeEnvironment,
+): string | undefined {
+  const value = config[key];
+  if (typeof value !== 'string') {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+function parsePort(value: unknown): number {
+  if (value === undefined || value === null || value === '') {
+    return 3000;
+  }
+
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error('Environment variable PORT must be an integer between 1 and 65535');
+  }
+
+  return port;
+}
+
+export function validateEnvironment(
+  config: Record<string, unknown>,
+): RuntimeEnvironment {
+  return {
+    PORT: parsePort(config.PORT),
+    DATABASE_URL: getRequiredString(config, 'DATABASE_URL'),
+    CORS_ALLOWED_ORIGINS: getRequiredString(config, 'CORS_ALLOWED_ORIGINS'),
+    KEYCLOAK_ISSUER_URL: getRequiredString(config, 'KEYCLOAK_ISSUER_URL'),
+    KEYCLOAK_AUDIENCE: getRequiredString(config, 'KEYCLOAK_AUDIENCE'),
+    KEYCLOAK_JWKS_URL: getOptionalString(config, 'KEYCLOAK_JWKS_URL'),
+  };
+}
+
--- a/server/src/health/health.controller.ts
+++ b/server/src/health/health.controller.ts
@@ -0,0 +1,11 @@
+import { Controller, Get } from '@nestjs/common';
+import { Public } from '../auth/decorators/public.decorator';
+
+@Public()
+@Controller('health')
+export class HealthController {
+  @Get()
+  getHealth() {
+    return { status: 'ok' };
+  }
+}
--- a/server/src/health/health.module.ts
+++ b/server/src/health/health.module.ts
@@ -0,0 +1,7 @@
+import { Module } from '@nestjs/common';
+import { HealthController } from './health.controller';
+
+@Module({
+  controllers: [HealthController],
+})
+export class HealthModule {}
--- a/server/src/main.ts
+++ b/server/src/main.ts
@@ -0,0 +1,35 @@
+import { NestFactory } from '@nestjs/core';
+import { ConfigService } from '@nestjs/config';
+import { AppModule } from './app.module';
+import { RuntimeEnvironment } from './config/env.validation';
+
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule);
+  const configService = app.get<ConfigService<RuntimeEnvironment, true>>(
+    ConfigService,
+  );
+
+  const allowedOrigins = configService
+    .getOrThrow('CORS_ALLOWED_ORIGINS')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+
+  app.enableCors({
+    origin: (origin, callback) => {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      callback(new Error(`Origin ${origin} is not allowed by CORS`), false);
+    },
+    methods: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Authorization', 'Content-Type'],
+    exposedHeaders: ['Content-Range'],
+    credentials: false,
+  });
+
+  const port = configService.get('PORT', 3000);
+  await app.listen(port);
+}
+bootstrap();
--- a/server/src/modules/equipment-type/dto/create-equipment-type.dto.ts
+++ b/server/src/modules/equipment-type/dto/create-equipment-type.dto.ts
@@ -0,0 +1,7 @@
+export class CreateEquipmentTypeDto {
+  code?: string;
+  name!: string;
+  manufacturer?: string;
+  maintenanceIntervalHours?: number;
+  overhaulIntervalHours?: number;
+}
--- a/server/src/modules/equipment-type/dto/update-equipment-type.dto.ts
+++ b/server/src/modules/equipment-type/dto/update-equipment-type.dto.ts
@@ -0,0 +1,8 @@
+export class UpdateEquipmentTypeDto {
+  id?: string;
+  code?: string;
+  name?: string;
+  manufacturer?: string;
+  maintenanceIntervalHours?: number;
+  overhaulIntervalHours?: number;
+}
--- a/server/src/modules/equipment-type/equipment-type.controller.ts
+++ b/server/src/modules/equipment-type/equipment-type.controller.ts
@@ -0,0 +1,45 @@
+import { Controller, Get, Post, Patch, Delete, Param, Body, Query, Res } from '@nestjs/common';
+import { Response } from 'express';
+import { Roles } from '../../auth/decorators/roles.decorator';
+import { RealmRole } from '../../auth/roles/realm-role.enum';
+import { EquipmentTypeService } from './equipment-type.service';
+import { CreateEquipmentTypeDto } from './dto/create-equipment-type.dto';
+import { UpdateEquipmentTypeDto } from './dto/update-equipment-type.dto';
+
+@Controller('equipment-types')
+export class EquipmentTypeController {
+  constructor(private readonly service: EquipmentTypeService) {}
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get()
+  async findAll(@Query() query: any, @Res() res: Response) {
+    const result = await this.service.findAll(query);
+    res.set('Content-Range', `equipment-types ${query._start || 0}-${query._end || result.total}/${result.total}`);
+    res.set('Access-Control-Expose-Headers', 'Content-Range');
+    return res.json(result.data);
+  }
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get(':code')
+  findOne(@Param('code') id: string) {
+    return this.service.findOne(id);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Post()
+  create(@Body() dto: CreateEquipmentTypeDto) {
+    return this.service.create(dto);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Patch(':code')
+  update(@Param('code') id: string, @Body() dto: UpdateEquipmentTypeDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Roles(RealmRole.Admin)
+  @Delete(':code')
+  remove(@Param('code') id: string) {
+    return this.service.remove(id);
+  }
+}
--- a/server/src/modules/equipment-type/equipment-type.module.ts
+++ b/server/src/modules/equipment-type/equipment-type.module.ts
@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { EquipmentTypeController } from './equipment-type.controller';
+import { EquipmentTypeService } from './equipment-type.service';
+
+@Module({
+  controllers: [EquipmentTypeController],
+  providers: [EquipmentTypeService],
+})
+export class EquipmentTypeModule {}
--- a/server/src/modules/equipment-type/equipment-type.service.ts
+++ b/server/src/modules/equipment-type/equipment-type.service.ts
@@ -0,0 +1,90 @@
+import { Injectable } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../../prisma/prisma.service';
+import { CreateEquipmentTypeDto } from './dto/create-equipment-type.dto';
+import { UpdateEquipmentTypeDto } from './dto/update-equipment-type.dto';
+
+function serializeRecord(record: any) {
+  return {
+    ...record,
+
+
+  };
+}
+
+@Injectable()
+export class EquipmentTypeService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async findAll(query: { _start?: string; _end?: string; _sort?: string; _order?: string; [key: string]: any }) {
+    const start = parseInt(query._start) || 0;
+    const end = parseInt(query._end) || 10;
+    const take = end - start;
+    const skip = start;
+    const sortField = query._sort || 'code';
+    const prismaSortField = sortField === 'id' ? 'code' : sortField;
+    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';
+
+    const where: any = {};
+
+    if (query.q) {
+      const q = String(query.q);
+      const ors: any[] = [];
+      ors.push({ code: { contains: q, mode: 'insensitive' } });
+      ors.push({ name: { contains: q, mode: 'insensitive' } });
+      ors.push({ manufacturer: { contains: q, mode: 'insensitive' } });
+      if (ors.length) where.OR = ors;
+    }
+
+    if (query.code) where.code = { contains: query.code, mode: 'insensitive' };
+    if (query.name) where.name = { contains: query.name, mode: 'insensitive' };
+    if (query.manufacturer) where.manufacturer = { contains: query.manufacturer, mode: 'insensitive' };
+
+    
+
+    // Enum multi-value support (e.g. status=A&status=B)
+    
+
+    if (query.id) {
+      const ids = Array.isArray(query.id) ? query.id : [query.id];
+      where.code = { in: ids };
+    }
+
+    const [data, total] = await Promise.all([
+      this.prisma.equipmentType.findMany({ where, skip, take, orderBy: { [prismaSortField]: sortOrder } }),
+      this.prisma.equipmentType.count({ where }),
+    ]);
+
+    const mapped = data.map((item: any) => ({ id: item.code, ...serializeRecord(item) }));
+    return { data: mapped, total };
+  }
+
+  async findOne(id: string) {
+    const record = await this.prisma.equipmentType.findUniqueOrThrow({ where: { code: id } as any });
+    return { id: (record as any).code, ...serializeRecord(record) };
+  }
+
+  async create(dto: CreateEquipmentTypeDto) {
+    const data: any = { ...(dto as any) };
+
+
+
+    const record = await this.prisma.equipmentType.create({ data });
+    return { id: (record as any).code, ...serializeRecord(record) };
+  }
+
+  async update(id: string, dto: UpdateEquipmentTypeDto) {
+    const { id: _pk, code, ...rest } = (dto as any);
+    const data: any = { ...rest };
+
+
+
+    const record = await this.prisma.equipmentType.update({ where: { code: id } as any, data });
+    return { id: (record as any).code, ...serializeRecord(record) };
+  }
+
+  async remove(id: string) {
+    const record = await this.prisma.equipmentType.delete({ where: { code: id } as any });
+    return { id: (record as any).code, ...serializeRecord(record) };
+  }
+}
--- a/server/src/modules/equipment/dto/create-equipment.dto.ts
+++ b/server/src/modules/equipment/dto/create-equipment.dto.ts
@@ -0,0 +1,13 @@
+export class CreateEquipmentDto {
+  inventoryNumber!: string;
+  serialNumber?: string;
+  name!: string;
+  equipmentTypeCode!: string;
+  status!: string;
+  location?: string;
+  commissionedAt?: string;
+  totalEngineHours?: string;
+  engineHoursSinceLastRepair?: string;
+  lastRepairAt?: string;
+  notes?: string;
+}
--- a/server/src/modules/equipment/dto/update-equipment.dto.ts
+++ b/server/src/modules/equipment/dto/update-equipment.dto.ts
@@ -0,0 +1,14 @@
+export class UpdateEquipmentDto {
+  id?: string;
+  inventoryNumber?: string;
+  serialNumber?: string;
+  name?: string;
+  equipmentTypeCode?: string;
+  status?: string;
+  location?: string;
+  commissionedAt?: string;
+  totalEngineHours?: string;
+  engineHoursSinceLastRepair?: string;
+  lastRepairAt?: string;
+  notes?: string;
+}
--- a/server/src/modules/equipment/equipment.controller.ts
+++ b/server/src/modules/equipment/equipment.controller.ts
@@ -0,0 +1,45 @@
+import { Controller, Get, Post, Patch, Delete, Param, Body, Query, Res } from '@nestjs/common';
+import { Response } from 'express';
+import { Roles } from '../../auth/decorators/roles.decorator';
+import { RealmRole } from '../../auth/roles/realm-role.enum';
+import { EquipmentService } from './equipment.service';
+import { CreateEquipmentDto } from './dto/create-equipment.dto';
+import { UpdateEquipmentDto } from './dto/update-equipment.dto';
+
+@Controller('equipment')
+export class EquipmentController {
+  constructor(private readonly service: EquipmentService) {}
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get()
+  async findAll(@Query() query: any, @Res() res: Response) {
+    const result = await this.service.findAll(query);
+    res.set('Content-Range', `equipment ${query._start || 0}-${query._end || result.total}/${result.total}`);
+    res.set('Access-Control-Expose-Headers', 'Content-Range');
+    return res.json(result.data);
+  }
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get(':id')
+  findOne(@Param('id') id: string) {
+    return this.service.findOne(id);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Post()
+  create(@Body() dto: CreateEquipmentDto) {
+    return this.service.create(dto);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Patch(':id')
+  update(@Param('id') id: string, @Body() dto: UpdateEquipmentDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Roles(RealmRole.Admin)
+  @Delete(':id')
+  remove(@Param('id') id: string) {
+    return this.service.remove(id);
+  }
+}
--- a/server/src/modules/equipment/equipment.module.ts
+++ b/server/src/modules/equipment/equipment.module.ts
@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { EquipmentController } from './equipment.controller';
+import { EquipmentService } from './equipment.service';
+
+@Module({
+  controllers: [EquipmentController],
+  providers: [EquipmentService],
+})
+export class EquipmentModule {}
--- a/server/src/modules/equipment/equipment.service.ts
+++ b/server/src/modules/equipment/equipment.service.ts
@@ -0,0 +1,102 @@
+import { Injectable } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../../prisma/prisma.service';
+import { CreateEquipmentDto } from './dto/create-equipment.dto';
+import { UpdateEquipmentDto } from './dto/update-equipment.dto';
+
+function serializeRecord(record: any) {
+  return {
+    ...record,
+    totalEngineHours: record.totalEngineHours?.toString() ?? null,
+    engineHoursSinceLastRepair: record.engineHoursSinceLastRepair?.toString() ?? null,
+    commissionedAt: record.commissionedAt?.toISOString() ?? null,
+    lastRepairAt: record.lastRepairAt?.toISOString() ?? null,
+  };
+}
+
+@Injectable()
+export class EquipmentService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async findAll(query: { _start?: string; _end?: string; _sort?: string; _order?: string; [key: string]: any }) {
+    const start = parseInt(query._start) || 0;
+    const end = parseInt(query._end) || 10;
+    const take = end - start;
+    const skip = start;
+    const sortField = query._sort || 'inventoryNumber';
+    const prismaSortField = sortField === 'id' ? 'id' : sortField;
+    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';
+
+    const where: any = {};
+
+    if (query.q) {
+      const q = String(query.q);
+      const ors: any[] = [];
+      ors.push({ inventoryNumber: { contains: q, mode: 'insensitive' } });
+      ors.push({ serialNumber: { contains: q, mode: 'insensitive' } });
+      ors.push({ name: { contains: q, mode: 'insensitive' } });
+      ors.push({ equipmentTypeCode: { contains: q, mode: 'insensitive' } });
+      ors.push({ location: { contains: q, mode: 'insensitive' } });
+      ors.push({ notes: { contains: q, mode: 'insensitive' } });
+      if (ors.length) where.OR = ors;
+    }
+
+    if (query.inventoryNumber) where.inventoryNumber = { contains: query.inventoryNumber, mode: 'insensitive' };
+    if (query.serialNumber) where.serialNumber = { contains: query.serialNumber, mode: 'insensitive' };
+    if (query.name) where.name = { contains: query.name, mode: 'insensitive' };
+    if (query.location) where.location = { contains: query.location, mode: 'insensitive' };
+    if (query.notes) where.notes = { contains: query.notes, mode: 'insensitive' };
+
+    if (query.equipmentTypeCode) where.equipmentTypeCode = query.equipmentTypeCode;
+
+    // Enum multi-value support (e.g. status=A&status=B)
+    if (query.status) { const vals = Array.isArray(query.status) ? query.status : [query.status]; where.status = vals.length > 1 ? { in: vals } : vals[0]; }
+
+    if (query.id) {
+      const ids = Array.isArray(query.id) ? query.id : [query.id];
+      where.id = { in: ids };
+    }
+
+    const [data, total] = await Promise.all([
+      this.prisma.equipment.findMany({ where, skip, take, orderBy: { [prismaSortField]: sortOrder } }),
+      this.prisma.equipment.count({ where }),
+    ]);
+
+    const mapped = data.map(serializeRecord);
+    return { data: mapped, total };
+  }
+
+  async findOne(id: string) {
+    const record = await this.prisma.equipment.findUniqueOrThrow({ where: { id: id } as any });
+    return serializeRecord(record);
+  }
+
+  async create(dto: CreateEquipmentDto) {
+    const data: any = { ...(dto as any) };
+    if (data.commissionedAt) data.commissionedAt = new Date(data.commissionedAt);
+    if (data.lastRepairAt) data.lastRepairAt = new Date(data.lastRepairAt);
+    if (data.totalEngineHours) data.totalEngineHours = new Prisma.Decimal(data.totalEngineHours);
+    if (data.engineHoursSinceLastRepair) data.engineHoursSinceLastRepair = new Prisma.Decimal(data.engineHoursSinceLastRepair);
+
+    const record = await this.prisma.equipment.create({ data });
+    return serializeRecord(record);
+  }
+
+  async update(id: string, dto: UpdateEquipmentDto) {
+    const data: any = { ...(dto as any) };
+    delete data.id;
+    delete data.id;
+    if (data.commissionedAt) data.commissionedAt = new Date(data.commissionedAt);
+    if (data.lastRepairAt) data.lastRepairAt = new Date(data.lastRepairAt);
+    if (data.totalEngineHours !== undefined && data.totalEngineHours !== null) data.totalEngineHours = new Prisma.Decimal(data.totalEngineHours);
+    if (data.engineHoursSinceLastRepair !== undefined && data.engineHoursSinceLastRepair !== null) data.engineHoursSinceLastRepair = new Prisma.Decimal(data.engineHoursSinceLastRepair);
+
+    const record = await this.prisma.equipment.update({ where: { id: id } as any, data });
+    return serializeRecord(record);
+  }
+
+  async remove(id: string) {
+    const record = await this.prisma.equipment.delete({ where: { id: id } as any });
+    return serializeRecord(record);
+  }
+}
--- a/server/src/modules/repair-order/dto/create-repair-order.dto.ts
+++ b/server/src/modules/repair-order/dto/create-repair-order.dto.ts
@@ -0,0 +1,13 @@
+export class CreateRepairOrderDto {
+  number!: string;
+  equipmentId!: string;
+  repairKind!: string;
+  status!: string;
+  plannedAt!: string;
+  startedAt?: string;
+  completedAt?: string;
+  contractor?: string;
+  engineHoursAtRepair?: string;
+  description?: string;
+  notes?: string;
+}
--- a/server/src/modules/repair-order/dto/update-repair-order.dto.ts
+++ b/server/src/modules/repair-order/dto/update-repair-order.dto.ts
@@ -0,0 +1,14 @@
+export class UpdateRepairOrderDto {
+  id?: string;
+  number?: string;
+  equipmentId?: string;
+  repairKind?: string;
+  status?: string;
+  plannedAt?: string;
+  startedAt?: string;
+  completedAt?: string;
+  contractor?: string;
+  engineHoursAtRepair?: string;
+  description?: string;
+  notes?: string;
+}
--- a/server/src/modules/repair-order/repair-order.controller.ts
+++ b/server/src/modules/repair-order/repair-order.controller.ts
@@ -0,0 +1,45 @@
+import { Controller, Get, Post, Patch, Delete, Param, Body, Query, Res } from '@nestjs/common';
+import { Response } from 'express';
+import { Roles } from '../../auth/decorators/roles.decorator';
+import { RealmRole } from '../../auth/roles/realm-role.enum';
+import { RepairOrderService } from './repair-order.service';
+import { CreateRepairOrderDto } from './dto/create-repair-order.dto';
+import { UpdateRepairOrderDto } from './dto/update-repair-order.dto';
+
+@Controller('repair-orders')
+export class RepairOrderController {
+  constructor(private readonly service: RepairOrderService) {}
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get()
+  async findAll(@Query() query: any, @Res() res: Response) {
+    const result = await this.service.findAll(query);
+    res.set('Content-Range', `repair-orders ${query._start || 0}-${query._end || result.total}/${result.total}`);
+    res.set('Access-Control-Expose-Headers', 'Content-Range');
+    return res.json(result.data);
+  }
+
+  @Roles(RealmRole.Viewer, RealmRole.Editor, RealmRole.Admin)
+  @Get(':id')
+  findOne(@Param('id') id: string) {
+    return this.service.findOne(id);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Post()
+  create(@Body() dto: CreateRepairOrderDto) {
+    return this.service.create(dto);
+  }
+
+  @Roles(RealmRole.Editor, RealmRole.Admin)
+  @Patch(':id')
+  update(@Param('id') id: string, @Body() dto: UpdateRepairOrderDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Roles(RealmRole.Admin)
+  @Delete(':id')
+  remove(@Param('id') id: string) {
+    return this.service.remove(id);
+  }
+}
--- a/server/src/modules/repair-order/repair-order.module.ts
+++ b/server/src/modules/repair-order/repair-order.module.ts
@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { RepairOrderController } from './repair-order.controller';
+import { RepairOrderService } from './repair-order.service';
+
+@Module({
+  controllers: [RepairOrderController],
+  providers: [RepairOrderService],
+})
+export class RepairOrderModule {}
--- a/server/src/modules/repair-order/repair-order.service.ts
+++ b/server/src/modules/repair-order/repair-order.service.ts
@@ -0,0 +1,100 @@
+import { Injectable } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../../prisma/prisma.service';
+import { CreateRepairOrderDto } from './dto/create-repair-order.dto';
+import { UpdateRepairOrderDto } from './dto/update-repair-order.dto';
+
+function serializeRecord(record: any) {
+  return {
+    ...record,
+    engineHoursAtRepair: record.engineHoursAtRepair?.toString() ?? null,
+    plannedAt: record.plannedAt?.toISOString() ?? null,
+    startedAt: record.startedAt?.toISOString() ?? null,
+    completedAt: record.completedAt?.toISOString() ?? null,
+  };
+}
+
+@Injectable()
+export class RepairOrderService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async findAll(query: { _start?: string; _end?: string; _sort?: string; _order?: string; [key: string]: any }) {
+    const start = parseInt(query._start) || 0;
+    const end = parseInt(query._end) || 10;
+    const take = end - start;
+    const skip = start;
+    const sortField = query._sort || 'number';
+    const prismaSortField = sortField === 'id' ? 'id' : sortField;
+    const sortOrder = (query._order || 'ASC').toLowerCase() as 'asc' | 'desc';
+
+    const where: any = {};
+
+    if (query.q) {
+      const q = String(query.q);
+      const ors: any[] = [];
+      ors.push({ number: { contains: q, mode: 'insensitive' } });
+      ors.push({ contractor: { contains: q, mode: 'insensitive' } });
+      ors.push({ description: { contains: q, mode: 'insensitive' } });
+      ors.push({ notes: { contains: q, mode: 'insensitive' } });
+      if (ors.length) where.OR = ors;
+    }
+
+    if (query.number) where.number = { contains: query.number, mode: 'insensitive' };
+    if (query.contractor) where.contractor = { contains: query.contractor, mode: 'insensitive' };
+    if (query.description) where.description = { contains: query.description, mode: 'insensitive' };
+    if (query.notes) where.notes = { contains: query.notes, mode: 'insensitive' };
+
+    if (query.equipmentId) where.equipmentId = query.equipmentId;
+
+    // Enum multi-value support (e.g. status=A&status=B)
+    if (query.repairKind) { const vals = Array.isArray(query.repairKind) ? query.repairKind : [query.repairKind]; where.repairKind = vals.length > 1 ? { in: vals } : vals[0]; }
+    if (query.status) { const vals = Array.isArray(query.status) ? query.status : [query.status]; where.status = vals.length > 1 ? { in: vals } : vals[0]; }
+
+    if (query.id) {
+      const ids = Array.isArray(query.id) ? query.id : [query.id];
+      where.id = { in: ids };
+    }
+
+    const [data, total] = await Promise.all([
+      this.prisma.repairOrder.findMany({ where, skip, take, orderBy: { [prismaSortField]: sortOrder } }),
+      this.prisma.repairOrder.count({ where }),
+    ]);
+
+    const mapped = data.map(serializeRecord);
+    return { data: mapped, total };
+  }
+
+  async findOne(id: string) {
+    const record = await this.prisma.repairOrder.findUniqueOrThrow({ where: { id: id } as any });
+    return serializeRecord(record);
+  }
+
+  async create(dto: CreateRepairOrderDto) {
+    const data: any = { ...(dto as any) };
+    if (data.plannedAt) data.plannedAt = new Date(data.plannedAt);
+    if (data.startedAt) data.startedAt = new Date(data.startedAt);
+    if (data.completedAt) data.completedAt = new Date(data.completedAt);
+    if (data.engineHoursAtRepair) data.engineHoursAtRepair = new Prisma.Decimal(data.engineHoursAtRepair);
+
+    const record = await this.prisma.repairOrder.create({ data });
+    return serializeRecord(record);
+  }
+
+  async update(id: string, dto: UpdateRepairOrderDto) {
+    const data: any = { ...(dto as any) };
+    delete data.id;
+    delete data.id;
+    if (data.plannedAt) data.plannedAt = new Date(data.plannedAt);
+    if (data.startedAt) data.startedAt = new Date(data.startedAt);
+    if (data.completedAt) data.completedAt = new Date(data.completedAt);
+    if (data.engineHoursAtRepair !== undefined && data.engineHoursAtRepair !== null) data.engineHoursAtRepair = new Prisma.Decimal(data.engineHoursAtRepair);
+
+    const record = await this.prisma.repairOrder.update({ where: { id: id } as any, data });
+    return serializeRecord(record);
+  }
+
+  async remove(id: string) {
+    const record = await this.prisma.repairOrder.delete({ where: { id: id } as any });
+    return serializeRecord(record);
+  }
+}
--- a/server/src/prisma/prisma.module.ts
+++ b/server/src/prisma/prisma.module.ts
@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
+
+@Global()
+@Module({
+  providers: [PrismaService],
+  exports: [PrismaService],
+})
+export class PrismaModule {}
--- a/server/src/prisma/prisma.service.ts
+++ b/server/src/prisma/prisma.service.ts
@@ -0,0 +1,9 @@
+import { Injectable, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+
+@Injectable()
+export class PrismaService extends PrismaClient implements OnModuleInit {
+  async onModuleInit() {
+    await this.$connect();
+  }
+}
--- a/server/test/app.e2e-spec.ts
+++ b/server/test/app.e2e-spec.ts
@@ -0,0 +1,83 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import { AuthService } from '../src/auth/auth.service';
+import { AuthenticatedUser } from '../src/auth/interfaces/authenticated-user.interface';
+import { PrismaService } from '../src/prisma/prisma.service';
+import { AppModule } from './../src/app.module';
+
+describe('Auth and Health (e2e)', () => {
+  let app: INestApplication;
+  let authServiceMock: {
+    verifyAccessToken: jest.Mock<Promise<AuthenticatedUser>, [string]>;
+  };
+
+  beforeAll(async () => {
+    process.env.PORT = '3000';
+    process.env.DATABASE_URL =
+      process.env.DATABASE_URL ??
+      'postgresql://postgres:postgres@localhost:5432/toir';
+    process.env.CORS_ALLOWED_ORIGINS =
+      process.env.CORS_ALLOWED_ORIGINS ??
+      'http://localhost:5173,https://toir-frontend.greact.ru';
+    process.env.KEYCLOAK_ISSUER_URL =
+      process.env.KEYCLOAK_ISSUER_URL ?? 'https://sso.greact.ru/realms/toir';
+    process.env.KEYCLOAK_AUDIENCE =
+      process.env.KEYCLOAK_AUDIENCE ?? 'toir-backend';
+
+    authServiceMock = {
+      verifyAccessToken: jest.fn<Promise<AuthenticatedUser>, [string]>(),
+    };
+
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    })
+      .overrideProvider(AuthService)
+      .useValue(authServiceMock)
+      .overrideProvider(PrismaService)
+      .useValue({})
+      .compile();
+
+    app = moduleFixture.createNestApplication();
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  beforeEach(() => {
+    authServiceMock.verifyAccessToken.mockReset();
+  });
+
+  it('/health (GET) is public', () => {
+    return request(app.getHttpServer())
+      .get('/health')
+      .expect(200)
+      .expect({ status: 'ok' });
+  });
+
+  it('/equipment (GET) requires authentication', () => {
+    return request(app.getHttpServer()).get('/equipment').expect(401);
+  });
+
+  it('/equipment (POST) returns 403 for authenticated viewer role', async () => {
+    authServiceMock.verifyAccessToken.mockResolvedValue({
+      sub: 'viewer-user',
+      username: 'viewer-user',
+      roles: ['viewer'],
+      claims: {
+        sub: 'viewer-user',
+        realm_access: {
+          roles: ['viewer'],
+        },
+      },
+    });
+
+    await request(app.getHttpServer())
+      .post('/equipment')
+      .set('Authorization', 'Bearer viewer-token')
+      .send({})
+      .expect(403);
+  });
+});
--- a/server/test/jest-e2e.json
+++ b/server/test/jest-e2e.json
@@ -0,0 +1,12 @@
+{
+  "moduleFileExtensions": ["js", "json", "ts"],
+  "rootDir": ".",
+  "testEnvironment": "node",
+  "testRegex": ".e2e-spec.ts$",
+  "transform": {
+    "^.+\\.(t|j)s$": "ts-jest"
+  },
+  "moduleNameMapper": {
+    "^jose$": "<rootDir>/mocks/jose.ts"
+  }
+}
--- a/server/test/mocks/jose.ts
+++ b/server/test/mocks/jose.ts
@@ -0,0 +1,8 @@
+export const createRemoteJWKSet = () => {
+  return async () => ({}) as never;
+};
+
+export const jwtVerify = async () => {
+  return { payload: {} };
+};
+
--- a/server/tsconfig.build.json
+++ b/server/tsconfig.build.json
@@ -0,0 +1,4 @@
+{
+  "extends": "./tsconfig.json",
+  "exclude": ["node_modules", "test", "dist", "**/*spec.ts"]
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>