@stjoseph/prumo 0.0.2 → 0.0.3

package/dist/generate.js

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { readdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
@@ -20,6 +21,23 @@ async function nameMobileApp(app, name) {
         return setJsonc(result, ['expo', 'scheme'], schemeFor(name));
     });
 }
+const SECRET_LINE = /^BETTER_AUTH_SECRET=.*$/m;
+// `.env` stays out of git, so the example is the committed truth and a fresh project gets a copy it can start with.
+// Only the secret differs: a sample value is public, so every generated API draws its own.
+async function writeLocalEnv(app, type) {
+    const example = join(app, '.env.example');
+    if (!existsSync(example)) {
+        return;
+    }
+    let env = await readFile(example, 'utf8');
+    if (type === 'api') {
+        if (!SECRET_LINE.test(env)) {
+            throw new Error(`${example} no longer carries a BETTER_AUTH_SECRET line`);
+        }
+        env = env.replace(SECRET_LINE, `BETTER_AUTH_SECRET=${randomBytes(32).toString('base64url')}`);
+    }
+    await writeFile(join(app, '.env'), env);
+}
 function run(command, args, cwd) {
     const result = spawnSync(command, args, { cwd, stdio: 'inherit' });
     if (result.status !== 0) {
@@ -34,6 +52,7 @@ export async function generate({ templates, knowledge, target, answers, install,
     if (answers.architecture === 'alone' && only !== undefined) {
         await copyTemplate(join(templates, only), target);
         await nameProject(target, answers.name);
+        await writeLocalEnv(target, only);
         if (only === 'mobile') {
             await nameMobileApp(target, answers.name);
         }
@@ -46,6 +65,9 @@ export async function generate({ templates, knowledge, target, answers, install,
             mobileScheme: schemeFor(answers.name),
         });
         await nameProject(target, answers.name);
+        for (const type of answers.types) {
+            await writeLocalEnv(join(target, 'apps', type), type);
+        }
         if (answers.types.includes('mobile')) {
             await nameMobileApp(join(target, 'apps', 'mobile'), answers.name);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",

package/templates/api/README.md

@@ -8,12 +8,14 @@ Node 22.17 or later, pnpm, and Docker.
 
 ```sh
 pnpm install
-cp .env.example .env        # then replace BETTER_AUTH_SECRET with 32 or more random characters
 docker compose up -d --wait
 pnpm db:migrate
 pnpm dev
 ```
 
+`.env` comes with the generated project, copied from `.env.example` with a random `BETTER_AUTH_SECRET`. It is not
+committed, so on a fresh clone run `cp .env.example .env` and replace the secret with 32 or more random characters.
+
 The API listens on `http://localhost:3000`. Outside production, its documentation is at `/api/docs`.
 
 `pnpm db:migrate` builds first, then runs Better Auth's migrations and then the application's. Before

package/templates/mobile/README.md

@@ -9,10 +9,12 @@ to open the app.
 
 ```sh
 pnpm install
-cp .env.example .env        # EXPO_PUBLIC_API_URL points at the API
 pnpm dev
 ```
 
+`.env` comes with the generated project, copied from `.env.example`; `EXPO_PUBLIC_API_URL` points at the API. It is
+not committed, so on a fresh clone run `cp .env.example .env`.
+
 On an Android emulator `localhost` is the emulator itself; point `EXPO_PUBLIC_API_URL` at your machine's address.
 
 ## Everyday commands

package/templates/web/README.md

@@ -8,10 +8,12 @@ Node 22.17 or later, pnpm, and the API running.
 
 ```sh
 pnpm install
-cp .env.example .env        # VITE_API_URL points at the API
 pnpm dev
 ```
 
+`.env` comes with the generated project, copied from `.env.example`; `VITE_API_URL` points at the API. It is not
+committed, so on a fresh clone run `cp .env.example .env`.
+
 The app runs on `http://localhost:5173`, which is the origin the API trusts by default (`WEB_ORIGIN`).
 
 Open it and you are sent to sign in, because everything but the sign-in and sign-up pages needs a session. Follow