@maestro-js/init 1.0.0-alpha.24 → 1.0.0-alpha.4

package/dist/bin.d.ts

@@ -1,2 +1 @@
-
-export {  }
+#!/usr/bin/env node

package/dist/bin.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
+#!/usr/bin/env node
 import {
   buildProjectTree,
-  getInitVersion,
   scaffold
-} from "./chunk-FO3IYFDW.js";
+} from "./chunk-P4YULL3I.js";
 
 // src/bin.ts
 import crypto from "crypto";
@@ -50,10 +50,10 @@ function deriveDbPort(name2) {
 }
 function installSkills(targetDir2) {
   const skillSources = [
-    { cmd: `npx --yes @maestro-js/agent-skills@${getInitVersion()}`, label: "maestro" },
-    { cmd: "npx skills add https://react-aria.adobe.com --skill react-aria -a claude-code -y", label: "react-aria" },
-    { cmd: "npx skills add anthropics/skills --skill skill-creator -a claude-code -y", label: "skill-creator" },
-    { cmd: "npx skills add mattpocock/skills --skill grill-me -a claude-code -y", label: "grill-me" },
+    { cmd: "npx --yes @maestro-js/agent-skills", label: "maestro" },
+    { cmd: "npx skills add https://react-aria.adobe.com --all", label: "react-aria" },
+    { cmd: "npx skills add anthropics/skills --skill skill-creator -y", label: "skill-creator" },
+    { cmd: "npx skills add mattpocock/skills --skill grill-me -y", label: "grill-me" },
     { cmd: "playwright-cli install --skills", label: "playwright-cli" }
   ];
   for (const { cmd, label } of skillSources) {

package/dist/{chunk-FO3IYFDW.js → chunk-P4YULL3I.js}

@@ -1,12 +1,7 @@
 #!/usr/bin/env node
 
-// src/index.ts
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-
 // src/templates/root.ts
-function rootPackageJson(name, maestroVersion) {
+function rootPackageJson(name) {
   return JSON.stringify(
     {
       type: "module",
@@ -16,13 +11,13 @@ function rootPackageJson(name, maestroVersion) {
         "fks-restrict": "maestro config:run --config services -- node ./scripts/foreign-key-delete-behavior.ts restrict"
       },
       dependencies: {
-        "@maestro-js/config": maestroVersion,
+        "@maestro-js/config": "latest",
         [`@${name}/services`]: "workspace:*"
       },
       devDependencies: {
-        "@maestro-js/cli": maestroVersion,
-        "@maestro-js/db-migrate": maestroVersion,
-        "@maestro-js/db": maestroVersion,
+        "@maestro-js/cli": "latest",
+        "@maestro-js/db-migrate": "latest",
+        "@maestro-js/db": "latest",
         "@types/node": "^22.19.11",
         tsx: "^4.21.0"
       }
@@ -139,7 +134,7 @@ var dbMigrateConfig = `export default async function (env: Record<string, string
 `;
 
 // src/templates/schemas.ts
-function schemasPackageJson(name, maestroVersion) {
+function schemasPackageJson(name) {
   return JSON.stringify(
     {
       name: `@${name}/schemas`,
@@ -150,7 +145,7 @@ function schemasPackageJson(name, maestroVersion) {
       dependencies: {
         "iso-fns": "npm:iso-fns@2.0.0-alpha.26",
         zod: "^4.3.0",
-        "@maestro-js/iso-zod": maestroVersion
+        "@maestro-js/iso-zod": "latest"
       },
       devDependencies: {}
     },
@@ -163,7 +158,7 @@ var schemasIndex = `// Export your Zod schemas here
 `;
 
 // src/templates/services.ts
-function servicesPackageJson(name, maestroVersion) {
+function servicesPackageJson(name) {
   return JSON.stringify(
     {
       name: `@${name}/services`,
@@ -177,29 +172,29 @@ function servicesPackageJson(name, maestroVersion) {
       dependencies: {
         [`@${name}/schemas`]: "workspace:*",
         "@aws-sdk/client-ses": "^3.1004.0",
-        "@maestro-js/auth": maestroVersion,
-        "@maestro-js/cache": maestroVersion,
-        "@maestro-js/config": maestroVersion,
-        "@maestro-js/crypt": maestroVersion,
-        "@maestro-js/custom-errors": maestroVersion,
-        "@maestro-js/db": maestroVersion,
-        "@maestro-js/exceptions": maestroVersion,
-        "@maestro-js/hash": maestroVersion,
-        "@maestro-js/helpers": maestroVersion,
-        "@maestro-js/iso-zod": maestroVersion,
-        "@maestro-js/log": maestroVersion,
-        "@maestro-js/mail": maestroVersion,
-        "@maestro-js/password": maestroVersion,
-        "@maestro-js/permissions": maestroVersion,
-        "@maestro-js/queue": maestroVersion,
-        "@maestro-js/rate-limiting": maestroVersion,
-        "@maestro-js/recurring-jobs": maestroVersion,
-        "@maestro-js/session": maestroVersion,
+        "@maestro-js/auth": "latest",
+        "@maestro-js/cache": "latest",
+        "@maestro-js/config": "latest",
+        "@maestro-js/crypt": "latest",
+        "@maestro-js/custom-errors": "latest",
+        "@maestro-js/db": "latest",
+        "@maestro-js/exceptions": "latest",
+        "@maestro-js/hash": "latest",
+        "@maestro-js/helpers": "latest",
+        "@maestro-js/iso-zod": "latest",
+        "@maestro-js/log": "latest",
+        "@maestro-js/mail": "latest",
+        "@maestro-js/password": "latest",
+        "@maestro-js/permissions": "latest",
+        "@maestro-js/queue": "latest",
+        "@maestro-js/rate-limiting": "latest",
+        "@maestro-js/recurring-jobs": "latest",
+        "@maestro-js/session": "latest",
         "iso-fns": "npm:iso-fns@2.0.0-alpha.26",
         zod: "^4.3.0"
       },
       devDependencies: {
-        "@maestro-js/cli": maestroVersion,
+        "@maestro-js/cli": "latest",
         "@types/node": "^22.0.0",
         "beartest-js": "^8.0.2"
       }
@@ -384,7 +379,7 @@ export { CustomErrors } from '@maestro-js/custom-errors'
 `;
 
 // src/templates/web.ts
-function webPackageJson(name, maestroVersion) {
+function webPackageJson(name) {
   return JSON.stringify(
     {
       name: `@${name}/${name}-web`,
@@ -402,9 +397,9 @@ function webPackageJson(name, maestroVersion) {
       dependencies: {
         [`@${name}/schemas`]: "workspace:*",
         [`@${name}/services`]: "workspace:*",
-        "@maestro-js/custom-errors": maestroVersion,
-        "@maestro-js/log": maestroVersion,
-        "@maestro-js/form": maestroVersion,
+        "@maestro-js/custom-errors": "latest",
+        "@maestro-js/log": "latest",
+        "@maestro-js/form": "latest",
         "@react-router/node": "^7.9.0",
         "@react-router/serve": "^7.9.0",
         "@sentry/react-router": "^9",
@@ -419,8 +414,8 @@ function webPackageJson(name, maestroVersion) {
         zod: "^4.0.0"
       },
       devDependencies: {
-        "@maestro-js/cli": maestroVersion,
-        "@maestro-js/react-router-file-routes": maestroVersion,
+        "@maestro-js/cli": "latest",
+        "@maestro-js/react-router-file-routes": "latest",
         "@playwright/test": "^1.52.0",
         "@react-router/dev": "^7.9.0",
         "@tailwindcss/vite": "^4.2.0",
@@ -909,93 +904,34 @@ export function getRequestContext(context: Readonly<RouterContextProvider>) {
   return request
 }
 `;
-var csrfMiddlewareServer = `import { timingSafeEqual } from 'node:crypto'
-import type { MiddlewareFunction } from 'react-router'
+var csrfMiddlewareServer = `import type { MiddlewareFunction } from 'react-router'
 import { getRequestContext } from './request-context.server'
 
-const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
-
 export const csrfMiddleware: MiddlewareFunction<Response> = async ({ request, context }, next) => {
-  if (!MUTATING_METHODS.has(request.method)) {
-    return next()
-  }
-
-  // Routes accepting JSON or other non-form bodies use an X-CSRF-Token header
-  // instead of a hidden form field. Either way, never throw 500 from this
-  // middleware on a malformed body \u2014 return a clean 403.
-  const contentType = request.headers.get('content-type') ?? ''
-  let clientCsrfToken: string | null = null
-  if (contentType.startsWith('application/x-www-form-urlencoded') || contentType.startsWith('multipart/form-data')) {
-    try {
-      const cloned = request.clone()
-      const formData = await cloned.formData()
-      const value = formData.get('__csrfToken')
-      clientCsrfToken = typeof value === 'string' ? value : null
-    } catch {
-      clientCsrfToken = null
+  const mutatingMethods = ['POST', 'PUT', 'DELETE']
+  if (mutatingMethods.includes(request.method)) {
+    const cloned = request.clone()
+    const formDataForMiddleware = await cloned.formData()
+    const clientCsrfToken = formDataForMiddleware.get('__csrfToken')
+    const requestContext = getRequestContext(context)
+    const sessionCsrfToken = requestContext.session.getCsrfToken()
+    if (clientCsrfToken !== sessionCsrfToken) {
+      throw new Response('Invalid CSRF token', { status: 403 })
     }
-  } else {
-    clientCsrfToken = request.headers.get('x-csrf-token')
-  }
-
-  const requestContext = getRequestContext(context)
-  const sessionCsrfToken = requestContext.session.getCsrfToken()
-
-  if (!clientCsrfToken || !constantTimeEqual(clientCsrfToken, sessionCsrfToken)) {
-    throw new Response('Invalid CSRF token', { status: 403 })
   }
   return next()
 }
-
-function constantTimeEqual(a: string, b: string): boolean {
-  const aBuf = Buffer.from(a)
-  const bBuf = Buffer.from(b)
-  if (aBuf.length !== bBuf.length) return false
-  return timingSafeEqual(aBuf, bBuf)
-}
 `;
 var securityHeadersMiddlewareServer = `import type { MiddlewareFunction } from 'react-router'
 
-// Security-headers middleware must be the OUTERMOST middleware so that headers
-// are applied to thrown Responses (e.g. 403s from csrfMiddleware) as well as
-// returned ones \u2014 try/finally ensures both code paths get the headers.
 export const securityHeadersMiddleware: MiddlewareFunction<Response> = async (_args, next) => {
-  let response: Response
-  try {
-    response = await next()
-  } catch (thrown) {
-    if (thrown instanceof Response) {
-      applySecurityHeaders(thrown.headers)
-    }
-    throw thrown
-  }
-  applySecurityHeaders(response.headers)
+  const response = await next()
+  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
+  response.headers.set('X-Content-Type-Options', 'nosniff')
+  response.headers.set('X-Frame-Options', 'DENY')
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
   return response
 }
-
-function applySecurityHeaders(headers: Headers) {
-  headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
-  headers.set('X-Content-Type-Options', 'nosniff')
-  headers.set('X-Frame-Options', 'DENY')
-  headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
-  // Default-deny CSP. Tighten with route-level nonces for inline <script>/<style>.
-  // Apps that need third-party origins (analytics, fonts, CDNs) should extend
-  // this list \u2014 ship something restrictive by default rather than leaving it
-  // off entirely.
-  if (!headers.has('Content-Security-Policy')) {
-    headers.set(
-      'Content-Security-Policy',
-      "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; " +
-        "script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
-    )
-  }
-  headers.set(
-    'Permissions-Policy',
-    'camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()'
-  )
-  headers.set('Cross-Origin-Opener-Policy', 'same-origin')
-  headers.set('Cross-Origin-Resource-Policy', 'same-origin')
-}
 `;
 var customErrorStatusCodeMiddlewareServer = `import * as Sentry from '@sentry/react-router'
 import { type MiddlewareFunction } from 'react-router'
@@ -1047,7 +983,7 @@ export function getSessionToast(session: Session): Toast | null {
 `;
 
 // src/templates/queue-processor.ts
-function queueProcessorPackageJson(name, maestroVersion) {
+function queueProcessorPackageJson(name) {
   return JSON.stringify(
     {
       name: `@${name}/queue-processor`,
@@ -1057,11 +993,11 @@ function queueProcessorPackageJson(name, maestroVersion) {
         start: "maestro config:run --config queue-processor -- tsx src/index.ts"
       },
       dependencies: {
-        "@maestro-js/config": maestroVersion,
+        "@maestro-js/config": "latest",
         [`@${name}/services`]: "workspace:*"
       },
       devDependencies: {
-        "@maestro-js/cli": maestroVersion,
+        "@maestro-js/cli": "latest",
         "@types/node": "^22.19.11",
         tsx: "^4.21.0"
       }
@@ -1254,16 +1190,9 @@ function replaceTokens(content, tokens) {
 }
 
 // src/index.ts
-function getInitVersion() {
-  const dir = path.dirname(fileURLToPath(import.meta.url));
-  const raw = fs.readFileSync(path.join(dir, "../package.json"), "utf-8");
-  const pkg = JSON.parse(raw);
-  return pkg.version;
-}
 function buildProjectTree(name) {
-  const maestroVersion = `^${getInitVersion()}`;
   return {
-    "package.json": rootPackageJson(name, maestroVersion),
+    "package.json": rootPackageJson(name),
     "pnpm-workspace.yaml": pnpmWorkspace(name),
     "tsconfig.json": rootTsconfig,
     ".env": rootEnv,
@@ -1276,13 +1205,13 @@ function buildProjectTree(name) {
     },
     packages: {
       schemas: {
-        "package.json": schemasPackageJson(name, maestroVersion),
+        "package.json": schemasPackageJson(name),
         src: {
           "index.ts": schemasIndex
         }
       },
       services: {
-        "package.json": servicesPackageJson(name, maestroVersion),
+        "package.json": servicesPackageJson(name),
         "tsconfig.json": servicesTsconfig,
         src: {
           "maestro.ts": maestroTs,
@@ -1291,7 +1220,7 @@ function buildProjectTree(name) {
       }
     },
     [`${name}-web`]: {
-      "package.json": webPackageJson(name, maestroVersion),
+      "package.json": webPackageJson(name),
       "tsconfig.json": webTsconfig,
       "vite.config.ts": viteConfig,
       "react-router.config.ts": reactRouterConfig,
@@ -1320,7 +1249,7 @@ function buildProjectTree(name) {
       }
     },
     "queue-processor": {
-      "package.json": queueProcessorPackageJson(name, maestroVersion),
+      "package.json": queueProcessorPackageJson(name),
       "tsconfig.json": queueProcessorTsconfig,
       src: {
         "index.ts": queueProcessorIndex,
@@ -1342,6 +1271,5 @@ function buildProjectTree(name) {
 
 export {
   scaffold,
-  getInitVersion,
   buildProjectTree
 };

package/dist/index.d.ts

@@ -4,7 +4,6 @@ type Tree = {
 type Tokens = Record<string, string>;
 declare function scaffold(tree: Tree, basePath: string, tokens?: Tokens): Promise<string[]>;
 
-declare function getInitVersion(): string;
 declare function buildProjectTree(name: string): Tree;
 
-export { type Tokens, type Tree, buildProjectTree, getInitVersion, scaffold };
+export { type Tokens, type Tree, buildProjectTree, scaffold };

package/dist/index.js

@@ -1,11 +1,9 @@
 #!/usr/bin/env node
 import {
   buildProjectTree,
-  getInitVersion,
   scaffold
-} from "./chunk-FO3IYFDW.js";
+} from "./chunk-P4YULL3I.js";
 export {
   buildProjectTree,
-  getInitVersion,
   scaffold
 };

package/package.json

@@ -14,9 +14,9 @@
   "devDependencies": {
     "@types/node": "^22.19.11"
   },
-  "version": "1.0.0-alpha.24",
+  "version": "1.0.0-alpha.4",
   "publishConfig": {
-    "access": "public"
+    "access": "restricted"
   },
   "files": [
     "dist"