@abgov/nx-adsp 13.6.1 → 13.7.1

package/README.md

@@ -55,8 +55,9 @@ authenticated as an account with **`write:packages`** on your registry org.
 > option (name, `--env`, `--sandboxProject`, etc.) supplied — otherwise Nx prompts
 > and your session hangs waiting for input. Setting `CI=true` in the env has the
 > same effect and also skips the Nx Cloud prompt. (`nx run <target>` executors
-> don't prompt — this only applies to `nx g` generators.) The commands below
-> already follow this.
+> don't prompt — this only applies to `nx g` generators.) Also pass `--skipAgent`
+> — see [Agent consultation](#agent-consultation) for why you want to, not just
+> how. The commands below already follow this.
 
 ```bash
 # 1. Empty folder → Nx workspace (the plugins require Nx 23)
@@ -71,7 +72,7 @@ npm i -D @abgov/nx-oc @abgov/nx-adsp "@nx/express@$NXV" "@nx/vue@$NXV" "@nx/node
 npx @abgov/adsp-cli login --env test --tenant "<Your Tenant>" --scope adsp-cli-admin
 
 # 4. Scaffold a Postgres + Express + Vue + Node solution
-npx nx g @abgov/nx-adsp:pevn acme --env=dev --tenant=my-tenant --no-interactive
+npx nx g @abgov/nx-adsp:pevn acme --env=dev --tenant=my-tenant --no-interactive --skipAgent
 
 # 5. Add sandbox targets (registry derives from the git remote, or pass --registry=ghcr.io/<org>;
 #    the database is auto-detected from the service — no --database needed)
@@ -225,6 +226,28 @@ Generator flags that steer which tenant/token is used:
 
 With none of these, the generator lets `adsp login`'s interactive picker resolve the tenant.
 
+## Agent consultation
+
+`express-service`, `react-app`, `angular-app`, `vue-app`, and the fullstack composites connect to
+ADSP's own `agent-service` after base scaffolding and hold an interactive, multi-turn conversation
+with an ADSP-aware agent that can read and modify key integration files (`main.ts`,
+`environment.ts`, `events.ts`, `database.ts`) based on a description you provide. The socket
+connection and file upload start immediately, in parallel with prompting for that description.
+
+This needs the same tenant/token as [Authentication](#authentication) above, plus a reachable
+`agent-service` — it falls back silently to base scaffolding if either is missing, or if the run
+is non-interactive (`--no-interactive`, no TTY, or `CI=true`). Skip it explicitly with
+`--skipAgent`, regardless of interactivity.
+
+> **Note for coding agents:** skip this. It exists to let a *human* describe what they want built
+> to a separate, remote agent working from nothing but that description. You already have the
+> actual requirements and the surrounding codebase context that conversation exists to gather —
+> make any needed customizations directly, after scaffolding, rather than through an indirect
+> round-trip to a second, less-informed agent. Pass `--skipAgent` explicitly rather than relying
+> on `--no-interactive` alone: `--skipAgent` is a plain option check at the generator level, while
+> `--no-interactive`'s detection is built on argv inspection this plugin's own code notes could go
+> stale on an Nx upgrade — belt and suspenders, not a real behavior difference today.
+
 ## nx-oc integration
 
 If `@abgov/nx-oc` is installed in the workspace, the quickstart generators (`express-service`, `react-app`, `angular-app`, `dotnet-service`, `react-dotnet`) automatically include OpenShift deployment YAML in their output. See the [@abgov/nx-oc README](../nx-oc/README.md) for details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-adsp",
-  "version": "13.6.1",
+  "version": "13.7.1",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for ADSP apps.",

package/src/generators/express-service/express-service.js

@@ -135,17 +135,17 @@ function default_1(host, options) {
             const accessToken = (_f = normalizedOptions.accessToken) !== null && _f !== void 0 ? _f : normalizedOptions.adsp.accessToken;
             const clientSecret = yield (0, keycloak_admin_1.ensureServiceClient)(normalizedOptions.adsp.accessServiceUrl, normalizedOptions.adsp.tenantRealm, clientId, accessToken);
             if (clientSecret) {
-                const envPath = `${normalizedOptions.projectRoot}/.env`;
-                const existing = host.exists(envPath) ? host.read(envPath).toString() : '';
+                // .env.local, not .env: CLIENT_SECRET is a generated, local-only value — the
+                // same tier `nx dev-db` already uses for DATABASE_URL/MONGODB_URI — and
+                // already unconditionally gitignored by create-nx-workspace's default
+                // .gitignore (.env.local, .env.*.local), so no gitignore management is
+                // needed here at all. .env itself is left alone: it holds non-secret,
+                // developer-owned config too (KEYCLOAK_ROOT_URL, DIRECTORY_URL, etc.) and
+                // shouldn't be blanket-gitignored.
+                const envLocalPath = `${normalizedOptions.projectRoot}/.env.local`;
+                const existing = host.exists(envLocalPath) ? host.read(envLocalPath).toString() : '';
                 if (!existing.includes('CLIENT_SECRET=')) {
-                    host.write(envPath, `${existing ? existing.trimEnd() + '\n' : ''}CLIENT_SECRET=${clientSecret}\n`);
-                }
-                const gitignorePath = '.gitignore';
-                if (host.exists(gitignorePath)) {
-                    const gitignoreContent = host.read(gitignorePath).toString();
-                    if (!gitignoreContent.includes('.env')) {
-                        host.write(gitignorePath, `${gitignoreContent.trimEnd()}\n${normalizedOptions.projectRoot}/.env\n`);
-                    }
+                    host.write(envLocalPath, `${existing ? existing.trimEnd() + '\n' : ''}CLIENT_SECRET=${clientSecret}\n`);
                 }
             }
         }

package/src/generators/express-service/express-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"express-service.js","sourceRoot":"","sources":["../../../../../../packages/nx-adsp/src/generators/express-service/express-service.ts"],"names":[],"mappings":";;AAsGA,4BAkOC;;AAxUD,wCAA0I;AAC1I,uCAUoB;AACpB,uCAAoC;AACpC,6BAA6B;AAC7B,6CAAiD;AACjD,+DAAiE;AACjE,+DAA4D;AAC5D,iDAA0I;AAG1I,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACjD,MAAM,WAAW,GAAG,GAAG,IAAA,2BAAkB,EAAC,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAEzE,IAAI,IAA8C,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,uFAAuF;YACvF,0DAA0D;YAC1D,MAAM,GAAG,GAAG,oBAAY,CAAC,MAAA,OAAO,CAAC,GAAG,mCAAI,MAAM,CAAC,CAAC;YAChD,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAA,sBAAc,EAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;YAE5G,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,2CAAa,OAAO,EAAC,CAAC;YACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAC9B,IAAI,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC,IAAI,EACxD,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CACrC,CAAC;YAEF,MAAM,UAAU,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,0CAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,kBAAkB,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC;YACzF,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,UAAU,CAAC,KAAK,CAAC;YAE5D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,OAAO,mCACF,OAAO,KACV,WAAW,EAAE,MAAM,IAAA,uBAAe,EAAC;wBACjC,GAAG,EAAE,MAAA,OAAO,CAAC,GAAG,mCAAI,MAAM;wBAC1B,KAAK,EAAE,WAAW;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,CAAC,wBAAgB,CAAC;qBAC3B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAC1B,CAAC;YACJ,CAAC;YAED,IAAI,GAAG;gBACL,MAAM,EAAE,UAAU,CAAC,IAAI;gBACvB,WAAW;gBACX,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,IAAA,4BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,uCACK,OAAO,KACV,WAAW;YACX,WAAW;YACX,IAAI,EACJ,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,IACpC;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,aAAa,EAAE,MAAA,OAAO,CAAC,aAAa,mCAAI,IAAI,EAC5C,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,WAAW,EACnB,eAAe,CAChB,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpE,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,EACjD,OAAO,CAAC,WAAW,EACnB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEhE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,MAAM,qCAAO,aAAa,GAAE,KAAK,CAC7E,GAAG,EAAE;YACH,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,WAAW,CAAC,IAAI,kCACjB,OAAO,KACV,UAAU,EAAE,IAAI,EAChB,eAAe,EAAE,KAAK,EACtB,MAAM,EAAE,eAAM,CAAC,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,KAAK,EACT,SAAS,EAAE,iBAAiB,CAAC,WAAW,IACxC,CAAC;QAEH,IAAA,qCAA4B,EAC1B,IAAI,gCAEF,yBAAyB,EAAE,SAAS,EACpC,WAAW,EAAE,QAAQ,EACrB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,QAAQ,EAClB,oBAAoB,EAAE,QAAQ,EAC9B,GAAG,EAAE,QAAQ,IACV,CAAC,iBAAiB,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9F,CAAC,iBAAiB,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,iCAGzE,oBAAoB,EAAE,QAAQ,EAC9B,aAAa,EAAE,SAAS,EACxB,iBAAiB,EAAE,SAAS,EAC5B,2BAA2B,EAAE,QAAQ,EACrC,SAAS,EAAE,QAAQ,EACnB,kBAAkB,EAAE,QAAQ,IACzB,CAAC,iBAAiB,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC1G,wBAAwB,EAAE,QAAQ,EAClC,0BAA0B,EAAE,QAAQ,EACpC,oBAAoB,EAAE,SAAS,IAElC,CAAC;QAEF,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAElC,IAAA,+BAAqB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7F,IAAA,+BAAqB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAA,2BAAiB,EAAC,IAAI,CAAC,CAAC;QACxB,2EAA2E;QAC3E,IAAA,0BAAgB,EAAC,IAAI,CAAC,CAAC;QAEvB,MAAM,aAAa,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpF,MAAM,OAAO,qBAAQ,aAAa,CAAC,OAAO,CAAE,CAAC;QAE7C,IAAI,iBAAiB,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAE1C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAClB,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,OAAO,EAAE,wBAAwB;oBACjC,GAAG,EAAE,eAAe;iBACrB;aACF,CAAC;YAEF,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,OAAO,CAAC,mCACX,OAAO,CAAC,OAAO,CAAC,KACnB,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,mCAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,GAC7D,CAAC;YACJ,CAAC;YAED,IAAI,iBAAiB,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9C,OAAO,CAAC,aAAa,CAAC,GAAG;oBACvB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,eAAe,EAAE;iBACvE,CAAC;gBACF,OAAO,CAAC,YAAY,CAAC,GAAG;oBACtB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACtE,CAAC;gBACF,OAAO,CAAC,mBAAmB,CAAC,GAAG;oBAC7B,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACtE,CAAC;gBACF,OAAO,CAAC,WAAW,CAAC,GAAG;oBACrB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACrE,CAAC;gBAEF,6EAA6E;gBAC7E,2EAA2E;gBAC3E,wEAAwE;gBACxE,IAAI,MAAA,OAAO,CAAC,OAAO,CAAC,0CAAE,OAAO,EAAE,CAAC;oBAC9B,OAAO,CAAC,OAAO,CAAC,mCACX,OAAO,CAAC,OAAO,CAAC,KACnB,OAAO,kCACF,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,KAC3B,MAAM,EAAE;gCACN,GAAG,CAAC,MAAA,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,mCAAI,EAAE,CAAC;gCAC1C;oCACE,KAAK,EAAE,GAAG,iBAAiB,CAAC,WAAW,UAAU;oCACjD,IAAI,EAAE,MAAM;oCACZ,MAAM,EAAE,SAAS;iCAClB;6BACF,MAEJ,CAAC;gBACJ,CAAC;YACH,CAAC;QAEH,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,iBAAiB,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,GACR,iBAAiB,CAAC,QAAQ,KAAK,MAAM;YACrC,CAAC,CAAC,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC,EAAE,KAAK,CAAC;YACxC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;QAEzB,IAAA,mCAA0B,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,kCACzD,aAAa,KAChB,OAAO;YACP,IAAI,IACJ,CAAC;QAEH,IAAA,0BAAgB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,WAAW,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;YAC7F,MAAM,WAAW,GAAG,MAAA,iBAAiB,CAAC,WAAW,mCAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YACxF,MAAM,YAAY,GAAG,MAAM,IAAA,oCAAmB,EAC5C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EACvC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAClC,QAAQ,EACR,WAAW,CACZ,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,WAAW,OAAO,CAAC;gBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,YAAY,IAAI,CAAC,CAAC;gBACrG,CAAC;gBACD,MAAM,aAAa,GAAG,YAAY,CAAC;gBACnC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAC7D,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,iBAAiB,CAAC,WAAW,SAAS,CAAC,CAAC;oBACtG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,6CAA6C;QAC7C,yEAAyE;QACzE,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACjD,gFAAgF;YAChF,mFAAmF;YACnF,MAAM,WAAW,GACf,MAAA,iBAAiB,CAAC,WAAW,mCAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YAEtE,MAAM,MAAM,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,cAAc,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YAC3F,MAAM,aAAa,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,qBAAqB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YACzG,MAAM,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,gBAAgB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YAC/F,MAAM,UAAU,GACd,iBAAiB,CAAC,QAAQ,KAAK,MAAM;gBACnC,CAAC,CAAC,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,kBAAkB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBACjF,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,MAAM,IAAA,oBAAY,EACpC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAC1C,WAAW,EACX;gBACE,WAAW,EAAE,iBAAiB,CAAC,WAAW;gBAC1C,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM;gBACrC,aAAa,EAAE,+BAAc;gBAC7B,aAAa,kBACX,aAAa,EAAE,MAAM,EACrB,oBAAoB,EAAE,aAAa,EACnC,eAAe,EAAE,QAAQ,IACtB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;aACF,EACD,IAAI,EACJ,iBAAiB,CAAC,WAAW,CAC9B,CAAC;YAEF,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,WAAW,IAAI,WAAW,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;gBAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAuB;oBACrD,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,mFAAmF;oBAC5F,OAAO,EAAE,CAAC,WAAW,CAAC,WAAW;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAA,2BAAmB,EAAC,IAAI,kCACzB,iBAAiB,KACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,CAAC,WAAW,EACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IACpC,CAAC;QAEH,OAAO,GAAG,EAAE;YACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC;CAAA"}
+{"version":3,"file":"express-service.js","sourceRoot":"","sources":["../../../../../../packages/nx-adsp/src/generators/express-service/express-service.ts"],"names":[],"mappings":";;AAsGA,4BAkOC;;AAxUD,wCAA0I;AAC1I,uCAUoB;AACpB,uCAAoC;AACpC,6BAA6B;AAC7B,6CAAiD;AACjD,+DAAiE;AACjE,+DAA4D;AAC5D,iDAA0I;AAG1I,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACjD,MAAM,WAAW,GAAG,GAAG,IAAA,2BAAkB,EAAC,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAEzE,IAAI,IAA8C,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,uFAAuF;YACvF,0DAA0D;YAC1D,MAAM,GAAG,GAAG,oBAAY,CAAC,MAAA,OAAO,CAAC,GAAG,mCAAI,MAAM,CAAC,CAAC;YAChD,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAA,sBAAc,EAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;YAE5G,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,2CAAa,OAAO,EAAC,CAAC;YACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAC9B,IAAI,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC,IAAI,EACxD,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CACrC,CAAC;YAEF,MAAM,UAAU,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,0CAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,kBAAkB,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC;YACzF,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,UAAU,CAAC,KAAK,CAAC;YAE5D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,OAAO,mCACF,OAAO,KACV,WAAW,EAAE,MAAM,IAAA,uBAAe,EAAC;wBACjC,GAAG,EAAE,MAAA,OAAO,CAAC,GAAG,mCAAI,MAAM;wBAC1B,KAAK,EAAE,WAAW;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,CAAC,wBAAgB,CAAC;qBAC3B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAC1B,CAAC;YACJ,CAAC;YAED,IAAI,GAAG;gBACL,MAAM,EAAE,UAAU,CAAC,IAAI;gBACvB,WAAW;gBACX,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,IAAA,4BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,uCACK,OAAO,KACV,WAAW;YACX,WAAW;YACX,IAAI,EACJ,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,IACpC;IACJ,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI,KACf,aAAa,EAAE,MAAA,OAAO,CAAC,aAAa,mCAAI,IAAI,EAC5C,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,WAAW,EACnB,eAAe,CAChB,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpE,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,EACjD,OAAO,CAAC,WAAW,EACnB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEhE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,MAAM,qCAAO,aAAa,GAAE,KAAK,CAC7E,GAAG,EAAE;YACH,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,WAAW,CAAC,IAAI,kCACjB,OAAO,KACV,UAAU,EAAE,IAAI,EAChB,eAAe,EAAE,KAAK,EACtB,MAAM,EAAE,eAAM,CAAC,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,KAAK,EACT,SAAS,EAAE,iBAAiB,CAAC,WAAW,IACxC,CAAC;QAEH,IAAA,qCAA4B,EAC1B,IAAI,gCAEF,yBAAyB,EAAE,SAAS,EACpC,WAAW,EAAE,QAAQ,EACrB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,QAAQ,EAClB,oBAAoB,EAAE,QAAQ,EAC9B,GAAG,EAAE,QAAQ,IACV,CAAC,iBAAiB,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9F,CAAC,iBAAiB,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,iCAGzE,oBAAoB,EAAE,QAAQ,EAC9B,aAAa,EAAE,SAAS,EACxB,iBAAiB,EAAE,SAAS,EAC5B,2BAA2B,EAAE,QAAQ,EACrC,SAAS,EAAE,QAAQ,EACnB,kBAAkB,EAAE,QAAQ,IACzB,CAAC,iBAAiB,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC1G,wBAAwB,EAAE,QAAQ,EAClC,0BAA0B,EAAE,QAAQ,EACpC,oBAAoB,EAAE,SAAS,IAElC,CAAC;QAEF,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAElC,IAAA,+BAAqB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7F,IAAA,+BAAqB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAA,2BAAiB,EAAC,IAAI,CAAC,CAAC;QACxB,2EAA2E;QAC3E,IAAA,0BAAgB,EAAC,IAAI,CAAC,CAAC;QAEvB,MAAM,aAAa,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpF,MAAM,OAAO,qBAAQ,aAAa,CAAC,OAAO,CAAE,CAAC;QAE7C,IAAI,iBAAiB,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAE1C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAClB,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,OAAO,EAAE,wBAAwB;oBACjC,GAAG,EAAE,eAAe;iBACrB;aACF,CAAC;YAEF,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,OAAO,CAAC,mCACX,OAAO,CAAC,OAAO,CAAC,KACnB,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,mCAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,GAC7D,CAAC;YACJ,CAAC;YAED,IAAI,iBAAiB,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9C,OAAO,CAAC,aAAa,CAAC,GAAG;oBACvB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,eAAe,EAAE;iBACvE,CAAC;gBACF,OAAO,CAAC,YAAY,CAAC,GAAG;oBACtB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACtE,CAAC;gBACF,OAAO,CAAC,mBAAmB,CAAC,GAAG;oBAC7B,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACtE,CAAC;gBACF,OAAO,CAAC,WAAW,CAAC,GAAG;oBACrB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,eAAe,EAAE;iBACrE,CAAC;gBAEF,6EAA6E;gBAC7E,2EAA2E;gBAC3E,wEAAwE;gBACxE,IAAI,MAAA,OAAO,CAAC,OAAO,CAAC,0CAAE,OAAO,EAAE,CAAC;oBAC9B,OAAO,CAAC,OAAO,CAAC,mCACX,OAAO,CAAC,OAAO,CAAC,KACnB,OAAO,kCACF,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,KAC3B,MAAM,EAAE;gCACN,GAAG,CAAC,MAAA,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,mCAAI,EAAE,CAAC;gCAC1C;oCACE,KAAK,EAAE,GAAG,iBAAiB,CAAC,WAAW,UAAU;oCACjD,IAAI,EAAE,MAAM;oCACZ,MAAM,EAAE,SAAS;iCAClB;6BACF,MAEJ,CAAC;gBACJ,CAAC;YACH,CAAC;QAEH,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,iBAAiB,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,GACR,iBAAiB,CAAC,QAAQ,KAAK,MAAM;YACrC,CAAC,CAAC,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC,EAAE,KAAK,CAAC;YACxC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;QAEzB,IAAA,mCAA0B,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,kCACzD,aAAa,KAChB,OAAO;YACP,IAAI,IACJ,CAAC;QAEH,IAAA,0BAAgB,EAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,WAAW,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;YAC7F,MAAM,WAAW,GAAG,MAAA,iBAAiB,CAAC,WAAW,mCAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YACxF,MAAM,YAAY,GAAG,MAAM,IAAA,oCAAmB,EAC5C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EACvC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAClC,QAAQ,EACR,WAAW,CACZ,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBACjB,6EAA6E;gBAC7E,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,0EAA0E;gBAC1E,mCAAmC;gBACnC,MAAM,YAAY,GAAG,GAAG,iBAAiB,CAAC,WAAW,aAAa,CAAC;gBACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,YAAY,IAAI,CAAC,CAAC;gBAC1G,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,6CAA6C;QAC7C,yEAAyE;QACzE,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACjD,gFAAgF;YAChF,mFAAmF;YACnF,MAAM,WAAW,GACf,MAAA,iBAAiB,CAAC,WAAW,mCAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YAEtE,MAAM,MAAM,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,cAAc,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YAC3F,MAAM,aAAa,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,qBAAqB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YACzG,MAAM,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,gBAAgB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE,CAAC;YAC/F,MAAM,UAAU,GACd,iBAAiB,CAAC,QAAQ,KAAK,MAAM;gBACnC,CAAC,CAAC,MAAA,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,WAAW,kBAAkB,CAAC,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBACjF,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,MAAM,IAAA,oBAAY,EACpC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAC1C,WAAW,EACX;gBACE,WAAW,EAAE,iBAAiB,CAAC,WAAW;gBAC1C,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM;gBACrC,aAAa,EAAE,+BAAc;gBAC7B,aAAa,kBACX,aAAa,EAAE,MAAM,EACrB,oBAAoB,EAAE,aAAa,EACnC,eAAe,EAAE,QAAQ,IACtB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;aACF,EACD,IAAI,EACJ,iBAAiB,CAAC,WAAW,CAC9B,CAAC;YAEF,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,WAAW,IAAI,WAAW,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;gBAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAuB;oBACrD,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,mFAAmF;oBAC5F,OAAO,EAAE,CAAC,WAAW,CAAC,WAAW;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAA,2BAAmB,EAAC,IAAI,kCACzB,iBAAiB,KACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,CAAC,WAAW,EACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IACpC,CAAC;QAEH,OAAO,GAAG,EAAE;YACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC;IACJ,CAAC;CAAA"}

package/src/generators/express-service/express-service.spec.ts

@@ -3,6 +3,7 @@ import { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';
 
 import * as utils from '@abgov/nx-oc';
 import { environments } from '@abgov/nx-oc';
+import * as keycloakAdmin from '../../utils/keycloak-admin';
 import { Schema } from './schema';
 import generator from './express-service';
 
@@ -17,6 +18,9 @@ utilsMock.getAdspConfiguration.mockResolvedValue({
 utilsMock.deploymentGenerator.mockResolvedValue(undefined);
 utilsMock.ensureAdspToken.mockResolvedValue('test-token');
 
+jest.mock('../../utils/keycloak-admin');
+const keycloakAdminMock = keycloakAdmin as jest.Mocked<typeof keycloakAdmin>;
+
 describe('Express Service Generator', () => {
   const options: Schema = {
     name: 'test',
@@ -168,4 +172,58 @@ describe('Express Service Generator', () => {
       false
     );
   }, 60000);
+
+  it('writes a provisioned CLIENT_SECRET to .env.local, not .env', async () => {
+    keycloakAdminMock.ensureServiceClient.mockResolvedValueOnce('super-secret');
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await generator(host, { ...options, accessToken: 'test-token' });
+
+    expect(host.read('apps/test/.env.local').toString()).toContain('CLIENT_SECRET=super-secret');
+    expect(host.exists('apps/test/.env')).toBeFalsy();
+  }, 60000);
+
+  it('does not modify .gitignore for the provisioned secret', async () => {
+    keycloakAdminMock.ensureServiceClient.mockResolvedValueOnce('super-secret');
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    const gitignoreBefore = host.read('.gitignore')?.toString() ?? '';
+    await generator(host, { ...options, accessToken: 'test-token' });
+
+    expect(host.read('.gitignore')?.toString() ?? '').toBe(gitignoreBefore);
+  }, 60000);
+
+  it('does not overwrite or duplicate an existing CLIENT_SECRET in .env.local', async () => {
+    keycloakAdminMock.ensureServiceClient.mockResolvedValueOnce('freshly-provisioned-secret');
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    // express-service is a one-shot scaffolder (re-running it against an
+    // existing project throws in @nx/express), so this exercises the guard
+    // directly rather than by calling the generator twice: a CLIENT_SECRET
+    // already present in .env.local (e.g. set by hand) must survive untouched.
+    host.write('apps/test/.env.local', 'CLIENT_SECRET=already-there\n');
+    await generator(host, { ...options, accessToken: 'test-token' });
+
+    const envLocal = host.read('apps/test/.env.local').toString();
+    expect(envLocal).toContain('CLIENT_SECRET=already-there');
+    expect(envLocal).not.toContain('freshly-provisioned-secret');
+    expect(envLocal.split('CLIENT_SECRET=').length - 1).toBe(1);
+  }, 60000);
+
+  it('preserves an existing .env.local value (e.g. a prior dev-db run) alongside CLIENT_SECRET', async () => {
+    keycloakAdminMock.ensureServiceClient.mockResolvedValueOnce('super-secret');
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    host.write('apps/test/.env.local', 'DATABASE_URL=postgresql://test:test@localhost:5432/test_dev\n');
+    await generator(host, { ...options, accessToken: 'test-token' });
+
+    const envLocal = host.read('apps/test/.env.local').toString();
+    expect(envLocal).toContain('DATABASE_URL=postgresql://test:test@localhost:5432/test_dev');
+    expect(envLocal).toContain('CLIENT_SECRET=super-secret');
+  }, 60000);
+
+  it('writes nothing when no secret is provisioned', async () => {
+    keycloakAdminMock.ensureServiceClient.mockResolvedValueOnce(null);
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    await generator(host, { ...options, accessToken: 'test-token' });
+
+    expect(host.exists('apps/test/.env.local')).toBeFalsy();
+    expect(host.exists('apps/test/.env')).toBeFalsy();
+  }, 60000);
 });

package/src/generators/express-service/files/src/environment.ts__tmpl__

@@ -5,13 +5,13 @@ import { resolve } from 'path';
 config({
   path: resolve(process.cwd(), '<%= projectRoot %>/.env'),
 });
-<% if (database !== 'none') { %>
-// .env.local is written by 'nx dev-db' with the local database connection string.
+// .env.local holds generated, local-only values: CLIENT_SECRET (written once by
+// this generator after Keycloak provisioning) and, when a database is
+// configured, the connection string written by 'nx dev-db'.
 config({
   path: resolve(process.cwd(), '<%= projectRoot %>/.env.local'),
   override: true,
 });
-<% } %>
 
 export const environment = cleanEnv(process.env, {
   KEYCLOAK_ROOT_URL: str({ default: '<%= accessServiceUrl %>' }),

package/src/generators/express-service/files-mongo/.env.example__tmpl__

@@ -1,8 +1,12 @@
-# Copy this file to .env and set CLIENT_SECRET.
-# MONGODB_URI is written automatically to .env.local by 'nx dev-db <%= projectName %>'.
+# Every value below already has a matching default in src/environment.ts — you
+# only need to copy this to .env if you want to override one (e.g. point at a
+# different environment temporarily).
+#
+# CLIENT_SECRET is written automatically to .env.local after Keycloak
+# provisioning (or set it there yourself, as CLIENT_SECRET=<value>, for manual
+# setup). MONGODB_URI is written automatically to .env.local by
+# 'nx dev-db <%= projectName %>'. Neither belongs here.
 KEYCLOAK_ROOT_URL=<%= accessServiceUrl %>
 DIRECTORY_URL=<%= directoryServiceUrl %>
 TENANT_REALM=<%= tenantRealm %>
 CLIENT_ID=urn:ads:<%= tenant %>:<%= projectName %>
-CLIENT_SECRET=
-MONGODB_URI=mongodb://localhost:27017/<%= projectName %>_dev

package/src/generators/express-service/files-mongo/scripts/dev-db.sh__tmpl__

@@ -32,7 +32,12 @@ until podman exec "${CONTAINER}" mongosh --quiet --eval "quit()" &>/dev/null; do
 done
 echo "MongoDB is ready."
 
-# Write MONGODB_URI to .env.local so the app picks it up without manual .env editing.
-# Overridden by the Secret in OpenShift at runtime.
-echo "MONGODB_URI=mongodb://localhost:${PORT}/${DB_NAME}" > .env.local
+# Merge MONGODB_URI into .env.local rather than overwriting it wholesale —
+# CLIENT_SECRET (written once by the generator after Keycloak provisioning) may
+# already be there. Overridden by the Secret in OpenShift at runtime.
+if [ -f .env.local ]; then
+  grep -v '^MONGODB_URI=' .env.local > .env.local.tmp || true
+  mv .env.local.tmp .env.local
+fi
+echo "MONGODB_URI=mongodb://localhost:${PORT}/${DB_NAME}" >> .env.local
 echo "MONGODB_URI written to .env.local"

package/src/generators/express-service/files-postgres/.env.example__tmpl__

@@ -1,8 +1,12 @@
-# Copy this file to .env and set CLIENT_SECRET.
-# DATABASE_URL is written automatically to .env.local by 'nx dev-db <%= projectName %>'.
+# Every value below already has a matching default in src/environment.ts — you
+# only need to copy this to .env if you want to override one (e.g. point at a
+# different environment temporarily).
+#
+# CLIENT_SECRET is written automatically to .env.local after Keycloak
+# provisioning (or set it there yourself, as CLIENT_SECRET=<value>, for manual
+# setup). DATABASE_URL is written automatically to .env.local by
+# 'nx dev-db <%= projectName %>'. Neither belongs here.
 KEYCLOAK_ROOT_URL=<%= accessServiceUrl %>
 DIRECTORY_URL=<%= directoryServiceUrl %>
 TENANT_REALM=<%= tenantRealm %>
 CLIENT_ID=urn:ads:<%= tenant %>:<%= projectName %>
-CLIENT_SECRET=
-DATABASE_URL=postgresql://<%= projectName %>:<%= projectName %>@localhost:5432/<%= projectName %>_dev

package/src/generators/express-service/files-postgres/scripts/dev-db.sh__tmpl__

@@ -37,7 +37,12 @@ until podman exec "${CONTAINER}" pg_isready -U "${DB_USER}" -d "${DB_NAME}" &>/d
 done
 echo "Postgres is ready."
 
-# Write DATABASE_URL to .env.local so Drizzle and the app pick it up without
-# manual .env editing. Overridden by the SECRET in OpenShift at runtime.
-echo "DATABASE_URL=postgresql://${DB_USER}:${DB_PASS}@localhost:${PORT}/${DB_NAME}" > .env.local
+# Merge DATABASE_URL into .env.local rather than overwriting it wholesale —
+# CLIENT_SECRET (written once by the generator after Keycloak provisioning) may
+# already be there. Overridden by the SECRET in OpenShift at runtime.
+if [ -f .env.local ]; then
+  grep -v '^DATABASE_URL=' .env.local > .env.local.tmp || true
+  mv .env.local.tmp .env.local
+fi
+echo "DATABASE_URL=postgresql://${DB_USER}:${DB_PASS}@localhost:${PORT}/${DB_NAME}" >> .env.local
 echo "DATABASE_URL written to .env.local"

package/src/generators/vue-app/files/AGENTS.md__tmpl__

@@ -31,7 +31,8 @@ executors read options from `project.json` and do not prompt.
 | File | Purpose |
 |------|---------|
 | `src/main.ts` | Entry — registers Pinia, Router, and Keycloak plugin |
-| `src/App.vue` | Shell — nav header with sign-in/out, hero banner, `<RouterView>` |
+| `src/App.vue` | Shell — nav header with sign-in/out, hero banner, `<RouterView>` wrapped in `AppLayout` |
+| `src/components/AppLayout.vue` | Shared content gutter (centered, max-width, token padding). Every view lands inside it — no per-view spacing to add. Width via route meta `layout` |
 | `src/router/index.ts` | Routes — `/protected` guarded with `requiresAuth` meta |
 | `src/views/HomeView.vue` | Public page — calls public and private APIs |
 | `src/views/ProtectedView.vue` | Authenticated page — shows user info from token |
@@ -157,12 +158,17 @@ across every Vue app in this workspace — fix or extend a wrapper once in
 
 ## Adding a view
 
-1. Create `src/views/MyFeatureView.vue` as a `<script setup>` SFC
+1. Create `src/views/MyFeatureView.vue` as a `<script setup>` SFC. **Don't add your
+   own page margins/centering** — every view renders inside `AppLayout`'s gutter, so
+   any top-level tag (`<div>`, `<section>`, …) is already centered and padded.
 2. Add the route to `src/router/index.ts`:
    ```typescript
    { path: '/my-feature', component: () => import('../views/MyFeatureView.vue') }
    // For an authenticated route:
    { path: '/my-feature', component: () => import('../views/MyFeatureView.vue'), meta: { requiresAuth: true } }
+   // For a wider (data table) or narrower (form) view, set the layout width:
+   { path: '/queue', component: () => import('../views/QueueView.vue'), meta: { layout: 'wide' } }
+   { path: '/apply', component: () => import('../views/ApplyView.vue'), meta: { layout: 'form' } }
    ```
 3. Add a nav link to `src/App.vue` if needed
 

package/src/generators/vue-app/files/src/App.vue__tmpl__

@@ -1,6 +1,8 @@
 <script setup lang="ts">
+import { computed } from 'vue';
 import { useKeycloak } from '@dsb-norge/vue-keycloak-js';
-import { RouterView } from 'vue-router';
+import { RouterView, useRoute } from 'vue-router';
+import AppLayout from './components/AppLayout.vue';
 
 // Keep the reactive instance — do NOT destructure. useKeycloak() returns a
 // readonly(reactive()); destructuring snapshots each field at setup time, so
@@ -8,6 +10,13 @@ import { RouterView } from 'vue-router';
 // `authenticated` would never flip. Access fields on `kc` to stay reactive.
 const kc = useKeycloak();
 
+// Content width per view, from route meta (default 'page'). Views opt into a
+// different width with `meta: { layout: 'wide' | 'form' }` in the router.
+const route = useRoute();
+const layout = computed(
+  () => (route.meta.layout as 'page' | 'wide' | 'form' | undefined) ?? 'page'
+);
+
 function login() { kc.keycloak?.login(); }
 function logout() { kc.keycloak?.logout({ redirectUri: window.location.origin }); }
 </script>
@@ -29,20 +38,11 @@ function logout() { kc.keycloak?.logout({ redirectUri: window.location.origin })
     </goa-button-group>
   </goa-app-header>
   <goa-hero-banner heading="<%= projectName %>" backgroundurl="/assets/banner.jpg" />
-  <main>
+  <AppLayout :variant="layout">
     <RouterView />
-  </main>
+  </AppLayout>
 </template>
 
 <style>
 body { margin: 0; }
-main {
-  display: grid;
-  grid-template-columns: repeat(6, auto);
-}
-main > section {
-  grid-column: 2 / span 2;
-  margin-top: 40px;
-  margin-bottom: 40px;
-}
 </style>

package/src/generators/vue-app/files/src/components/AppLayout.vue__tmpl__

@@ -0,0 +1,45 @@
+<script setup lang="ts">
+// Shared page layout. App.vue wraps <RouterView> in this, so EVERY routed view
+// gets the standard content gutter (centered, max-width, token-driven padding)
+// regardless of its own top-level tag — there's no "wrap your view in <section>"
+// convention to remember, and a plain <div> works fine.
+//
+// Width variant is chosen per-view via route meta `layout` (App.vue reads it):
+//   meta: { layout: 'form' }   // single-column forms      → 640px
+//   (default)                  // general content          → 1000px
+//   meta: { layout: 'wide' }   // data-heavy pages / tables → 1200px
+withDefaults(defineProps<{ variant?: 'page' | 'wide' | 'form' }>(), {
+  variant: 'page',
+});
+</script>
+
+<template>
+  <main id="main-content">
+    <div :class="`${variant}-content`">
+      <slot />
+    </div>
+  </main>
+</template>
+
+<style scoped>
+.page-content,
+.wide-content,
+.form-content {
+  margin-inline: auto;
+  box-sizing: border-box;
+  /* Design-token gutter; fallbacks apply only if tokens aren't loaded. */
+  padding: var(--goa-space-xl, 2.5rem) var(--goa-space-l, 1.5rem);
+}
+
+.form-content { max-width: 640px; }
+.page-content { max-width: 1000px; }
+.wide-content { max-width: 1200px; }
+
+@media (max-width: 623.98px) {
+  .page-content,
+  .wide-content,
+  .form-content {
+    padding: var(--goa-space-m, 1rem);
+  }
+}
+</style>

package/src/generators/vue-app/vue-app.spec.ts

@@ -72,6 +72,24 @@ describe('Vue App Generator', () => {
     expect(agents).not.toContain('ui-components.alberta.ca');
   }, 30000);
 
+  it('wraps views in a shared AppLayout gutter (not a bare tag selector)', async () => {
+    await generator(host, options);
+
+    // Shared layout component provides the content gutter for every view.
+    expect(host.exists('apps/test/src/components/AppLayout.vue')).toBeTruthy();
+    const layout = host.read('apps/test/src/components/AppLayout.vue').toString();
+    // Three named width variants, token-driven padding.
+    expect(layout).toContain('form-content');
+    expect(layout).toContain('wide-content');
+    expect(layout).toContain('--goa-space');
+
+    // App.vue uses AppLayout and no longer relies on the `main > section` gutter
+    // (which silently failed when a view's top-level tag wasn't <section>).
+    const app = host.read('apps/test/src/App.vue').toString();
+    expect(app).toContain('AppLayout');
+    expect(app).not.toContain('main > section');
+  });
+
   it('provisions the shared GoA wrapper library and points the app at it', async () => {
     await generator(host, options);