@getstrata/starter 1.1.2 → 1.1.3

package/dist/cli.js

@@ -2638,6 +2638,8 @@ function renderEnvExample(projectName, layers) {
   ];
   lines.push("APP_DEBUG=false");
   lines.push("FEATURE_PUBLIC_READS=false");
+  lines.push("# wrapWebPublicRead / wrapPublicRead require login when false (production-safe default).");
+  lines.push("# Local storefronts/catalogs may set true in .env. Production boot rejects FEATURE_PUBLIC_READS=true.");
   lines.push("FEATURE_SIEM_EXPORT=false");
   lines.push("FEATURE_REGISTRATION=true");
   lines.push("FEATURE_SAML=false");
@@ -2856,9 +2858,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.1.2",
-    "@getstrata/cli": "^1.1.2",
-    "@getstrata/core": "^1.1.2"
+    "@getstrata/bootstrap": "^1.1.3",
+    "@getstrata/cli": "^1.1.3",
+    "@getstrata/core": "^1.1.3"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -3142,7 +3144,7 @@ The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything
 - Replace every \`change-me\` placeholder in \`.env\`. The guard rejects the values this generator wrote, not just empty ones.
 - Set \`APP_URL\` to the public origin (for example \`https://app.example.com\`). Signed links and redirects are built from it; localhost is rejected.
 - Set \`AUTH_DEV_HEADERS=false\`.
-- Set \`FEATURE_PUBLIC_READS=false\`. ${layers.frontend === "api" ? "This app already ships `false`." : "This app ships `true` so the local welcome page reads without a login. Production requires `false`."}
+- Set \`FEATURE_PUBLIC_READS=false\`. Generated \`.env.example\` already ships \`false\` so \`wrapWebPublicRead\` requires a login. Local storefronts may set \`true\` in \`.env\` for an anonymous catalog; \`assertProductionSecrets()\` rejects \`true\` in production. Do not ship a public-reads production boot.
 - Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
 - Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
 ${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^1.1.2",
-    "@getstrata/cli": "^1.1.2",
-    "@getstrata/core": "^1.1.2",
+    "@getstrata/bootstrap": "^1.1.3",
+    "@getstrata/cli": "^1.1.3",
+    "@getstrata/core": "^1.1.3",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",