@m6d/cortex-cli 0.13.0 → 0.15.0

package/src/scaffold/templates/cspell.json.txt

@@ -0,0 +1,41 @@
+{
+    "version": "0.2",
+    "language": "en",
+    "words": ["mprocs"],
+    "ignorePaths": [
+        "node_modules/**",
+        "out/**",
+        "build/**",
+        "**/dist/**",
+        "coverage/**",
+        "*.tsbuildinfo",
+        "bun.lock",
+        "package-lock.json",
+        "pnpm-lock.yaml",
+        "yarn.lock",
+        "*.db",
+        "*.sqlite",
+        "scratch.*",
+        ".env*",
+        "**/*.min.js",
+        "**/*.min.css",
+        "**/db/migrations/**",
+        "**/i18n/**",
+        "docs",
+        ".claude",
+        ".angular",
+        ".vercel/**",
+        "vendor/**",
+        ".gitignore"
+    ],
+    "dictionaries": [
+        "typescript",
+        "node",
+        "npm",
+        "html",
+        "css",
+        "bash",
+        "companies",
+        "softwareTerms"
+    ]
+}

package/src/scaffold/templates/dockerignore.txt

@@ -1,7 +1,6 @@
-# The env files never go into an image: they hold this checkout's secrets.
-# With their example copies left out too, setup.ts writes none during the
-# image's own `bun install`.
+# .env never goes into an image: it holds this checkout's secrets. With
+# .env.example left out too, setup.ts writes none during the image's own
+# `bun install`.
 .env*
-cortex.env*
 node_modules/
 .git/

package/src/scaffold/templates/gitignore.txt

@@ -1,9 +1,8 @@
 # Dependencies
 node_modules/
 
-# Environment variables: the .example files are the committed ones
+# Environment variables: .env.example is the committed one
 .env
-cortex.env
 .env.local
 .env.*.local
 

package/src/scaffold/templates/setup.ts.txt

@@ -2,14 +2,13 @@ import { randomBytes } from "node:crypto";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 
 /*
- * Writes .env and cortex.env on every `bun install`: each starts from its
- * committed .example copy, and each value the copy leaves blank is
- * generated here, the Compose project this checkout's stack runs as among
- * them. A value already set is never changed, so a fresh clone gets a stack
- * and secrets of its own, and a rerun changes nothing. The one exception: a
- * cortex.env written now holds new keys, which cannot read the volumes of the
- * stack .env names, so the stack gets a new name too. Without the example
- * copies, as in an image build, it writes nothing.
+ * Writes .env on every `bun install`: it starts from the committed
+ * .env.example, or from .env when there is one, and each value left blank
+ * that is listed below is generated here, the Compose project this
+ * checkout's stack runs as among them. A value already set is never
+ * changed, so a fresh clone gets a stack and secrets of its own, and a rerun
+ * changes nothing. Without either file, as in an image build, it writes
+ * nothing.
  */
 
 const token = () => randomBytes(32).toString("base64url");
@@ -24,29 +23,22 @@ const project =
         .replace(/^-+|-+$/g, "") || "cortex";
 
 const GENERATED = [
-    [".env", "COMPOSE_PROJECT_NAME", () => `${project}-${randomBytes(4).toString("hex")}`],
-    [".env", "CORTEX_SERVER_KEY", token],
-    ["cortex.env", "DEFAULT_ADMIN_PASSWORD", token],
+    ["COMPOSE_PROJECT_NAME", () => `${project}-${randomBytes(4).toString("hex")}`],
+    ["CORTEX_SERVER_KEY", token],
+    ["DEFAULT_ADMIN_PASSWORD", token],
     // Cortex takes management keys only under this prefix. cspell:ignore mgmt
-    ["cortex.env", "BOOTSTRAP_MANAGEMENT_KEY", () => `cortex_mgmt_${token()}`],
-    ["cortex.env", "BETTER_AUTH_SECRET", key],
-    ["cortex.env", "SECRETS_MASTER_KEY", key],
+    ["BOOTSTRAP_MANAGEMENT_KEY", () => `cortex_mgmt_${token()}`],
+    ["BETTER_AUTH_SECRET", key],
+    ["SECRETS_MASTER_KEY", key],
 ] as const;
 
-const freshKeys = !existsSync("cortex.env") && existsSync("cortex.env.example");
-
-for (const file of [".env", "cortex.env"]) {
-    const source = existsSync(file) ? file : `${file}.example`;
-    if (!existsSync(source)) continue;
+const source = existsSync(".env") ? ".env" : ".env.example";
+if (existsSync(source)) {
     // Only its owner reads a file of secrets, however it was first created.
-    if (source === file) chmodSync(file, 0o600);
+    if (source === ".env") chmodSync(".env", 0o600);
     let text = readFileSync(source, "utf8");
-    if (file === ".env" && freshKeys) {
-        text = text.replace(/^COMPOSE_PROJECT_NAME=.*$/m, "COMPOSE_PROJECT_NAME=");
-    }
-    for (const [target, variable, generate] of GENERATED) {
-        if (target !== file) continue;
+    for (const [variable, generate] of GENERATED) {
         text = text.replace(new RegExp(`^${variable}=$`, "m"), `${variable}=${generate()}`);
     }
-    writeFileSync(file, text, { mode: 0o600 });
+    writeFileSync(".env", text, { mode: 0o600 });
 }

package/src/ui/prompts.ts

@@ -14,6 +14,7 @@ import {
     log,
     outro,
     password,
+    select,
     spinner,
     text,
 } from "@clack/prompts";
@@ -50,29 +51,50 @@ export function askName(check: (name: string) => string | undefined) {
     );
 }
 
-/** A yes-or-no question a flag left open, answered no unless the user says otherwise. */
-export function askConfirm(message: string) {
-    return orExit(confirm({ message, initialValue: false }));
+/** One of `options`, by its value; the first is the default. */
+export function askChoice<const TValue extends string>(
+    message: string,
+    options: Parameters<typeof select<TValue>>[0]["options"],
+) {
+    return orExit(select({ message, options }));
 }
 
-/** A required value a command was not given: asked by name, re-asked while empty. */
-export function askValue(name: string, hint?: string) {
+/** A yes-or-no question a flag left open, answered no unless the caller says otherwise. */
+export function askConfirm(message: string, initialValue = false) {
+    return orExit(confirm({ message, initialValue }));
+}
+
+/**
+ * A required value a command was not given: asked by name, re-asked while
+ * empty or while `check` returns a complaint about the trimmed value.
+ */
+export function askValue(
+    name: string,
+    hint?: string,
+    check: (value: string) => string | undefined = () => undefined,
+) {
     return orExit(
         text({
             message: name,
             placeholder: hint,
-            validate: (value) =>
-                (value ?? "").trim().length === 0 ? `${name} is required.` : undefined,
+            validate: function (value) {
+                const candidate = (value ?? "").trim();
+                return candidate.length === 0 ? `${name} is required.` : check(candidate);
+            },
         }),
     );
 }
 
-/** A credential: typed masked, never echoed. */
-export function askSecret(name: string) {
+/** A credential: typed masked, never echoed, and re-asked while `check` complains. */
+export function askSecret(
+    name: string,
+    check: (value: string) => string | undefined = () => undefined,
+) {
     return orExit(
         password({
             message: name,
-            validate: (value) => ((value ?? "").length === 0 ? `${name} is required.` : undefined),
+            validate: (value) =>
+                (value ?? "").length === 0 ? `${name} is required.` : check(value ?? ""),
         }),
     );
 }