backend/bun/
├── apps/
│   └── monolith/                  ← Main Hono application
│       └── src/
│           ├── api-gateway/       ← Hono app, middleware, routes, schemas
│           │   ├── middleware/    ← Auth, rate limit, idempotency, i18n, error handling
│           │   ├── routes/        ← REST endpoints
│           │   └── schemas/       ← Zod request/response schemas
│           ├── config/            ← DI container, env schema
│           ├── services/          ← Feature routes (auth, organizations, teams, users, roles, ...)
│           └── main.ts            ← App entry point
├── packages/
│   ├── auth-ports/                 ← `AuthPort` interface — the reference port
│   ├── auth-adapter/               ← `AuthAdapter` (Better Auth) + Drizzle auth schema
│   ├── infrastructure/             ← cache, events, logging, localization, database repositories
│   │   └── database/repositories/  ← Drizzle/PostgreSQL repositories (`CustomRolesRepository`)
│   ├── shared-kernel/               ← `ApplicationError` subclasses, state machine, shared types
│   ├── users-domain/                ← Zod DTO schemas only — not a domain (ADR-0053)
│   ├── clawui-domain/                ← a `package.json` and nothing else — KIV, not built
│   └── contracts/                    ← cross-stack contract types (Go backend, frontend)
├── openspec/                       ← Change proposals and specs
├── tests/                          ← Unit and integration tests
└── package.json

// packages/auth-ports/ports/auth.port.ts
export interface AuthPort {
  signIn: {
    email: (opts: { email: string; password: string }) => Promise<Session | null>;
  };
  signUp: {
    email: (opts: { email: string; password: string; name?: string }) => Promise<User>;
  };
  getSession(): Promise<Session | null>;
}