@owlmeans/create-app 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/create-app",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "license": "MIT",
   "description": "Scaffold a minimal fullstack OwlMeans Common app — common + api + web workspaces, shadcn UI navigation/layout, no auth, and a session-scoped in-memory resource. Deploys agent skills via @owlmeans/agent-skills by default.",
   "type": "module",

package/template/README.md

@@ -28,6 +28,10 @@ Open the **Session** page and add/remove items — they are stored per browser s
 (a `sid` kept in `localStorage`) in an in-memory resource on the API. Restarting the API
 clears them; opening a different browser/incognito window gets an isolated session.
 
+> **Note:** The API runs over plain HTTP in dev (`cfg.security = { unsecure: true }` in
+> `sources/common/src/config.ts`). If you edit `sources/common`, restart `bun run dev` to
+> rebuild it before the API and web pick up the changes.
+
 ## How it fits together
 
 1. **`sources/common`** declares the API routes as OwlMeans *entrypoints* (`session.list`,

package/template/package.json

@@ -8,7 +8,7 @@
     "sources/*"
   ],
   "scripts": {
-    "dev": "bun run --filter './sources/*' --parallel dev",
+    "dev": "bun run --filter './sources/common' build && bun run --filter './sources/*' --parallel dev",
     "build": "bun run --filter './sources/*' build",
     "typecheck": "bun run --filter './sources/*' typecheck"
   },

package/template/sources/api/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "main": "build/index.js",
   "scripts": {
-    "dev": "sleep 3 && bun --watch --preserve-symlinks src/index.ts",
+    "dev": "bun --watch src/index.ts",
     "start": "bun src/index.ts",
     "build": "tsc -b",
     "typecheck": "tsc -b"

package/template/sources/common/src/config.ts

@@ -20,5 +20,8 @@ service({
 
 cfg.debug = { all: true }
 cfg.alias = APP
+// Local dev serves the API over plain HTTP. Without this the web client builds https:// URLs
+// and every call fails. In production put the API behind TLS and remove this line.
+cfg.security = { unsecure: true }
 
 export const commonConfig = cfg

package/template/sources/web/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "sleep 3 && vite",
+    "dev": "vite",
     "start": "vite",
     "build": "vite build",
     "typecheck": "tsc --noEmit",