@stjoseph/prumo 0.1.1 → 0.2.0

package/.prumo-templates/api/auth.md

@@ -27,6 +27,10 @@ not `database/entities.md`.
 Create what the application keeps about a user in `databaseHooks.user.create.after`, through a use case:
 `src/infra/di/index.ts` passes the hook into `createAuth`.
 
+Pin every Better Auth package to one version, and declare `@better-auth/core` as a direct dependency at that
+version: `better-auth`, `auth` and every `@better-auth/*` plugin, in the api and in every client. Upgrade them in
+one change, never one package at a time.
+
 ## Rationale
 
 The route sits inside Fastify, so the request id and the logs cover the authentication flow. **The error
@@ -51,6 +55,11 @@ Auth's tables as leftovers and every generated migration drops them, with every
 key is declared rather than written by hand in a migration because the ORM would otherwise drop that too,
 every time. `AuthUser` exists only as that anchor.
 
+`better-auth` pins its core exactly, but each plugin only asks for a compatible core as a peer. Without a
+direct `@better-auth/core`, pnpm satisfies that peer with the newest core on the registry, so a core release
+installs a second core beside the pinned one, and the plugins stop typechecking against it. One version and
+a declared core leave pnpm a single core to install.
+
 **The sign-up hook is not atomic:** the user and the application's row are written over two connections, so
 a failure between them leaves a user without a profile. The result is a visible 404, not corrupted data. And
 the foreign key means deleting a user fails while rows reference it, so the application removes them first.
@@ -82,5 +91,8 @@ so a configuration that would drop Better Auth's schema, or the foreign key, fai
 
 **The database.** A row referencing a user that does not exist is refused.
 
-**Review only.** That each `public: true` is deliberate: the one mistake that is invisible at runtime, because
+**Typecheck.** Two cores in one project usually fail `pnpm typecheck` in `src/infra/auth/`.
+
+**Review only.** That an upgrade moves the whole Better Auth family, `@better-auth/core` included. And that
+each `public: true` is deliberate: the one mistake that is invisible at runtime, because
 the route works, for everyone.

package/README.md

@@ -15,8 +15,9 @@ turned into something that actually runs.
 
 Put briefly, Prumo is the validation of a well built project without heavy architectural
 bureaucracy, done up front instead of discovered three months in. Well built here does not mean
-heavily layered. Every choice follows what the framework itself already indicates, so there are no
-ports, no adapters, and no in house architecture to learn before writing the first endpoint.
+heavily layered. Every choice follows what the framework itself already indicates, and the one
+structure of Prumo's own is the API's: ports and adapters, so the domain imports neither the
+database nor the HTTP framework.
 
 A new project receives two things. The first is code that already works: installed, wired together,
 and proven by starting rather than by compiling. The second is a `.prumo/` folder holding the
@@ -31,7 +32,8 @@ workspace holding four applications, without either one carrying rules it has no
 
 ## Requirements
 
-Node 22.17 or later, pnpm, and Docker for anything with an API. `prumo doctor` checks all of it.
+Node 22.18 or later, pnpm 10.26 or later, and Docker for anything with an API. `prumo doctor` checks
+all of it. Prumo runs on macOS and Linux; Windows is not supported yet.
 
 ## Running it
 
@@ -45,7 +47,11 @@ published package is [`@stjoseph/prumo`](https://www.npmjs.com/package/@stjoseph
 command it installs is `prumo`.
 
 It asks what to build, writes the project into `my-app/`, runs `git init`, and installs. Nothing is
-committed, so the first commit is yours and the diff shows everything Prumo wrote.
+committed, so the first commit is yours and the diff shows everything Prumo wrote. `prumo new .`
+writes into the current directory instead, which must be empty, and names the project after it. If
+anything fails or is interrupted, Prumo removes what it wrote, so the same command can run again.
+A project cannot be named `api`, `web`, `mobile` or `site`: those are the names its apps take inside
+a workspace.
 
 Every question also has a flag, which is how CI runs it without a terminal. Outside an interactive
 terminal a missing answer is an error rather than a default, so nothing important gets decided by
@@ -59,7 +65,7 @@ npx @stjoseph/prumo new my-app --types api,web --single-tenant --no-mcp
 |---|---|
 | `--types api,web,mobile,site` | What the project contains. More than one type makes a workspace |
 | `--alone` or `--monorepo` | How a single type is laid out |
-| `--multi-tenant` or `--single-tenant` | Whether the application serves several tenants |
+| `--multi-tenant` or `--single-tenant` | Whether the application serves several tenants. Multi-tenant ships the `multi-tenancy` conventions; the generated code itself is not tenant-aware yet |
 | `--mcp` or `--no-mcp` | With an api and a web: whether AI assistants reach the API through MCP, signed in as the user |
 | `--skip-install` | Stops after writing the files |
 
@@ -67,9 +73,9 @@ npx @stjoseph/prumo new my-app --types api,web --single-tenant --no-mcp
 
 | Command | What it does |
 |---|---|
-| `prumo new [name]` | Generates a project |
+| `prumo new [name \| .]` | Generates a project |
 | `prumo db` | Inside a project with an API: creates the development database in Docker and writes its URL into `.env` |
-| `prumo clean` | Removes what the project needed only once, today the database setup, once the database exists |
+| `prumo clean` | Removes what the project needed only once, today the database setup, once the database exists. Only the Prumo version that generated the project cleans it |
 | `prumo doctor` | Checks Node, pnpm, git and Docker on this machine |
 | `prumo version` · `--version` · `-v` | Prints the CLI version |
 | `prumo help [command]` · `--help` | Lists the commands, or describes one |
@@ -100,13 +106,13 @@ a month apart are the same project.
 
 | File | What it is |
 |---|---|
-| `.prumo/` | The conventions, in nine areas. Only the areas the answers call for are copied |
+| `.prumo/` | The conventions, in ten areas. Only the areas the answers call for are copied |
 | `.prumo/INDEX.md` | One line per document. Generated by the tool, and safe to regenerate |
 | `AGENTS.md` | The pointer into `.prumo/`, read by Codex, Cursor, Copilot, Gemini CLI and others |
 | `CLAUDE.md` | An `@AGENTS.md` import, for Claude Code |
 
-The nine areas are `core`, `api`, `database`, `client`, `web`, `mobile`, `site`, `monorepo` and
-`multi-tenancy`. Only `core` ships unconditionally, because everything in it is true of every type;
+The ten areas are `core`, `api`, `database`, `client`, `web`, `mobile`, `site`, `monorepo`,
+`multi-tenancy` and `mcp`. Only `core` ships unconditionally, because everything in it is true of every type;
 the rest follow the answers, since advice about a platform the project does not have is worse than
 no advice at all.
 
@@ -129,8 +135,7 @@ without a token in the repository. Any other push to `main` publishes nothing.
 
 ## Status
 
-Prumo is in beta. `0.0.1` is the first published version: every template runs and every generated
-project is verified in CI, and what a generated project looks like can still change before 1.0.
+Prumo is in beta: every template runs and every generated project is verified in CI, and what a generated project looks like can still change before 1.0.
 Updating a project's `.prumo/` in place comes after 1.0.
 
 MIT licensed. See [`LICENSE`](https://github.com/stjosephworks/prumo/blob/main/LICENSE).

package/dist/clean.js

@@ -1,9 +1,10 @@
 import { existsSync } from 'node:fs';
 import { readdir, readFile, rm, rmdir, writeFile } from 'node:fs/promises';
 import { dirname, join, relative } from 'node:path';
-import { apiPath, findProjectRoot } from "./database.js";
+import { apiPath, findProjectRoot, readConfig } from "./database.js";
 import { readJsonc, setJsonc } from "./jsonc.js";
 import { CliError } from "./output.js";
+import { cliVersion } from "./version.js";
 const SAMPLE_URL = 'postgresql://app:app@localhost:5432/app';
 export const API_DEV_PREFIX = 'node scripts/database.mjs --check && ';
 export const ROOT_DEV_PREFIX = 'node apps/api/scripts/database.mjs --check && ';
@@ -65,6 +66,15 @@ export async function planClean({ cwd, templates, force, }) {
     if (api === undefined) {
         return { root, items: [], apply: async () => { } };
     }
+    // "Exactly what was generated" is judged against this CLI's templates. Another version shipped other text, and
+    // every untouched file would read as changed by the team, so only the version that wrote the project cleans it.
+    const wrote = readConfig(root).prumo;
+    const running = cliVersion();
+    if (wrote !== running) {
+        throw new CliError('version_mismatch', wrote === undefined
+            ? `This project predates Prumo 0.1.1, which began recording its version. Run \`prumo clean\` from the version that generated it, such as \`npx @stjoseph/prumo@0.1.0 clean\`.`
+            : `This project was generated by Prumo ${wrote}, and this is ${running}. Run \`npx @stjoseph/prumo@${wrote} clean\`.`);
+    }
     const env = await readFile(join(api, '.env'), 'utf8').catch(() => undefined);
     if (!force && env !== undefined && /^DATABASE_URL=MISSING$/m.test(env)) {
         throw new CliError('database_missing', 'DATABASE_URL is still MISSING: set the database up before removing what sets it up, or pass --force.');

package/dist/cli.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { resolve } from 'node:path';
 import { parseArgs } from 'node:util';
 import * as prompt from '@clack/prompts';
 import { terminalAsker } from "./asker.js";
@@ -7,9 +6,9 @@ import { assetsFor, requireAssets } from "./assets.js";
 import { cleanText, planClean } from "./clean.js";
 import { COMMANDS, findCommand, helpText } from "./commands.js";
 import { runDatabase } from "./database.js";
-import { doctor, doctorText } from "./doctor.js";
+import { doctor, doctorText, systemProbe, toolChecks } from "./doctor.js";
 import { generate } from "./generate.js";
-import { validateProjectName } from "./names.js";
+import { projectProblem } from "./names.js";
 import { CliError, errorEnvelope, writeEnvelope } from "./output.js";
 import { resolveAnswers } from "./questions.js";
 import { cliVersion } from "./version.js";
@@ -43,6 +42,16 @@ async function runNew(args, json) {
     if (extra.length > 0) {
         throw new CliError('usage', `Unexpected argument: ${extra.join(' ')}`);
     }
+    const install = !values['skip-install'];
+    // Before the first question and the first file: a missing tool would otherwise surface halfway through.
+    const tools = toolChecks(systemProbe, install ? ['git', 'pnpm'] : ['git']);
+    if (tools.some((check) => check.status !== 'ok')) {
+        throw new CliError('not_ready', 'This machine is missing something Prumo needs.', {
+            ready: false,
+            checks: tools,
+        });
+    }
+    const cwd = process.cwd();
     const interactive = !json && process.stdin.isTTY === true && process.stdout.isTTY === true;
     const answers = await resolveAnswers({
         name,
@@ -53,23 +62,22 @@ async function runNew(args, json) {
         singleTenant: values['single-tenant'],
         mcp: values.mcp,
         noMcp: values['no-mcp'],
-    }, interactive ? terminalAsker(validateProjectName) : undefined);
+    }, interactive ? terminalAsker((input) => projectProblem(input, cwd)) : undefined, cwd);
     if (!json && answers.types.length > 1) {
         prompt.log.info(`${answers.types.length} types make a workspace: apps/ and packages/ under one root.`);
     }
-    const target = resolve(answers.name);
-    const install = !values['skip-install'];
+    const { target, ...chosen } = answers;
     await generate({
         ...requireAssets(assetsFor(import.meta.dirname)),
         target,
-        answers,
+        answers: chosen,
         install,
         childOutput: json ? 'stderr' : 'inherit',
     });
     if (!json) {
         prompt.outro(`Created ${answers.name}.`);
     }
-    return { data: { ...answers, target, installed: install }, text: '' };
+    return { data: { ...chosen, target, installed: install }, text: '' };
 }
 async function runClean(args, json) {
     const { values } = parseArgs({
@@ -108,6 +116,19 @@ async function runClean(args, json) {
     await plan.apply();
     return result(true);
 }
+// A command that takes no options of its own still refuses one it does not know.
+function noOptions(args, positionals = 0) {
+    const parsed = parseArgs({
+        args,
+        allowPositionals: true,
+        options: { json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' } },
+    });
+    if (parsed.positionals.length > positionals) {
+        throw new CliError('usage', `Unexpected argument: ${parsed.positionals.slice(positionals).join(' ')}`);
+    }
+    return parsed.positionals;
+}
+const GLOBAL_OPTIONS = ['--json', '--help', '-h', '--version', '-v'];
 async function main(argv) {
     const json = argv.includes('--json');
     const index = argv.findIndex((arg) => !arg.startsWith('-'));
@@ -116,19 +137,27 @@ async function main(argv) {
     const wantsHelp = argv.includes('--help') || argv.includes('-h');
     const name = command ?? (argv.includes('--version') || argv.includes('-v') ? 'version' : 'help');
     try {
+        const unknown = argv
+            .slice(0, index === -1 ? argv.length : index)
+            .find((arg) => !GLOBAL_OPTIONS.includes(arg));
+        if (unknown !== undefined) {
+            throw new CliError('usage', `Unknown option "${unknown}". Run \`prumo help\`.`);
+        }
         let result;
         if (wantsHelp && command !== undefined && command !== 'help') {
             result = help(command);
         }
         else if (name === 'help') {
-            const [topic] = args.filter((arg) => !arg.startsWith('-'));
+            const [topic] = noOptions(args, 1);
             result = help(topic);
         }
         else if (name === 'version') {
+            noOptions(args);
             const current = cliVersion();
             result = { data: { version: current }, text: current };
         }
         else if (name === 'doctor') {
+            noOptions(args);
             const report = await doctor();
             if (!report.ready) {
                 throw new CliError('not_ready', 'This machine is missing something Prumo needs.', report);

package/dist/commands.js

@@ -5,14 +5,17 @@ const JSON_OPTION = {
 export const COMMANDS = [
     {
         name: 'new',
-        usage: 'prumo new [name] [options]',
-        summary: 'Generate a project and the .prumo/ context it follows',
+        usage: 'prumo new [name | .] [options]',
+        summary: 'Generate a project and the .prumo/ context it follows; `.` generates into this empty directory',
         options: [
             { flag: '--types <list>', description: 'Comma-separated: api, web, mobile, site' },
             { flag: '--alone', description: 'One project of one type' },
             { flag: '--monorepo', description: 'A workspace, even for a single type' },
-            { flag: '--multi-tenant', description: 'Tenant-aware api, web and mobile' },
-            { flag: '--single-tenant', description: 'No tenancy' },
+            {
+                flag: '--multi-tenant',
+                description: 'Ship the multi-tenancy conventions; the code itself is not tenant-aware',
+            },
+            { flag: '--single-tenant', description: 'No multi-tenancy conventions' },
             { flag: '--mcp', description: 'An MCP server on the api, authorized through the web' },
             { flag: '--no-mcp', description: 'No MCP server' },
             { flag: '--skip-install', description: 'Do not run pnpm install' },

package/dist/compose.js

@@ -1,10 +1,10 @@
 import { existsSync } from 'node:fs';
 import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { join, relative } from 'node:path';
+import { join, relative, sep } from 'node:path';
 import { prependProperty, readJsonc, removeWhatBaseDeclares, setJsonc } from "./jsonc.js";
 import { applyMcp } from "./mcp.js";
 const CLIENTS = ['web', 'mobile'];
-// One exception to one-version-per-dependency, recorded in DECISIONS.md: stable NativeWind needs Tailwind 3.
+// One exception to one-version-per-dependency: stable NativeWind needs Tailwind 3.
 const NAMED_CATALOGS = [{ name: 'tailwind3', dependency: 'tailwindcss', major: '3' }];
 const NOT_COPIED = new Set([
     'node_modules',
@@ -36,7 +36,7 @@ export async function copyTemplate(source, destination) {
     await cp(source, destination, {
         recursive: true,
         filter: (path) => !relative(source, path)
-            .split('/')
+            .split(sep)
             .some((part) => NOT_COPIED.has(part) || NOT_COPIED_SUFFIXES.some((suffix) => part.endsWith(suffix))),
     });
     // Published, a template's .gitignore is `gitignore`, because npm deletes the dotted name from a tarball.

package/dist/doctor.js

@@ -1,9 +1,13 @@
 import { spawnSync } from 'node:child_process';
-const NODE_FLOOR = [22, 17, 0];
+const NODE_FLOOR = [22, 18, 0];
+// Every generated workspace approves dependency builds with `allowBuilds`, which pnpm added in 10.26.0.
+const PNPM_FLOOR = [10, 26, 0];
+// On Windows pnpm is a .cmd shim, and Node starts one only through a shell.
+export const SHELL = process.platform === 'win32';
 export const systemProbe = {
     nodeVersion: process.versions.node,
     run: (command, args) => {
-        const result = spawnSync(command, args, { encoding: 'utf8', timeout: 10_000 });
+        const result = spawnSync(command, args, { encoding: 'utf8', timeout: 10_000, shell: SHELL });
         return { ok: result.error === undefined && result.status === 0, stdout: result.stdout ?? '' };
     },
 };
@@ -20,6 +24,29 @@ function atLeast(version, floor) {
 function firstLine(text) {
     return text.trim().split('\n')[0] ?? '';
 }
+const TOOLS = {
+    pnpm: { why: 'installs and runs every generated project', floor: PNPM_FLOOR },
+    git: { why: 'every generated project starts as a repository', floor: undefined },
+};
+export function toolChecks(probe, tools) {
+    return tools.map((id) => {
+        const { why, floor } = TOOLS[id];
+        const result = probe.run(id, ['--version']);
+        const version = firstLine(result.stdout);
+        const base = { id, label: id, required: true };
+        if (!result.ok) {
+            return { ...base, status: 'fail', detail: `not found; it ${why}` };
+        }
+        if (floor !== undefined && !atLeast(version, floor)) {
+            return {
+                ...base,
+                status: 'fail',
+                detail: `${version}; ${floor.join('.')} or later is required`,
+            };
+        }
+        return { ...base, status: 'ok', detail: version };
+    });
+}
 export async function doctor(probe = systemProbe) {
     const checks = [];
     checks.push({
@@ -28,22 +55,9 @@ export async function doctor(probe = systemProbe) {
         required: true,
         ...(atLeast(probe.nodeVersion, NODE_FLOOR)
             ? { status: 'ok', detail: probe.nodeVersion }
-            : { status: 'fail', detail: `${probe.nodeVersion}; 22.17.0 or later is required` }),
+            : { status: 'fail', detail: `${probe.nodeVersion}; 22.18.0 or later is required` }),
     });
-    for (const [id, label, why] of [
-        ['pnpm', 'pnpm', 'installs and runs every generated project'],
-        ['git', 'git', 'every generated project starts as a repository'],
-    ]) {
-        const result = probe.run(id, ['--version']);
-        checks.push({
-            id,
-            label,
-            required: true,
-            ...(result.ok
-                ? { status: 'ok', detail: firstLine(result.stdout) }
-                : { status: 'fail', detail: `not found; it ${why}` }),
-        });
-    }
+    checks.push(...toolChecks(probe, ['pnpm', 'git']));
     const docker = probe.run('docker', ['--version']);
     const dockerRunning = docker.ok && probe.run('docker', ['info']).ok;
     checks.push({

package/dist/generate.js

@@ -1,13 +1,14 @@
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { composeWorkspace, copyTemplate } from "./compose.js";
 import { writeContext } from "./context.js";
+import { SHELL } from "./doctor.js";
 import { setJsonc } from "./jsonc.js";
 import { applyMcp } from "./mcp.js";
-import { schemeFor } from "./names.js";
+import { schemeFor, targetProblem } from "./names.js";
 import { CliError } from "./output.js";
 async function rewrite(path, change) {
     await writeFile(path, change(await readFile(path, 'utf8')));
@@ -50,20 +51,67 @@ async function nameCompose(api, name) {
         return text.replace(/^name: .*$/m, `name: ${name}`);
     });
 }
+// Ctrl+C reaches the child and Prumo alike. While a listener exists Prumo is not killed outright, so the run that
+// was stopped returns, its failure removes the half-written project, and the next run starts from nothing.
+let interrupted = false;
+function interrupt() {
+    interrupted = true;
+}
+function stopIfInterrupted() {
+    if (interrupted) {
+        throw new CliError('interrupted', 'Interrupted. Nothing was kept.');
+    }
+}
 function run(command, args, cwd, output) {
+    stopIfInterrupted();
     // Under --json stdout belongs to the result document, so a child's output goes to stderr instead.
     const result = spawnSync(command, args, {
         cwd,
         stdio: output === 'inherit' ? 'inherit' : ['ignore', 2, 2],
+        shell: SHELL,
     });
+    // spawnSync holds the event loop, so the listener has not run yet; the child says it instead, either by dying of
+    // the signal or, as pnpm does, by catching it and exiting with 130.
+    if (result.signal === 'SIGINT' || result.status === 130) {
+        interrupted = true;
+    }
+    stopIfInterrupted();
     if (result.status !== 0) {
-        throw new Error(`${command} ${args.join(' ')} failed in ${cwd}`);
+        const why = result.error?.message ??
+            (result.signal !== null ? `stopped by ${result.signal}` : `exit code ${result.status}`);
+        throw new Error(`${command} ${args.join(' ')} failed in ${cwd}: ${why}`);
+    }
+}
+// Only what this run wrote goes: a directory it created, or the contents of the empty one it was given.
+async function discard(target, created) {
+    if (created) {
+        await rm(target, { recursive: true, force: true });
+        return;
+    }
+    for (const entry of await readdir(target).catch(() => [])) {
+        await rm(join(target, entry), { recursive: true, force: true });
     }
 }
 export async function generate({ templates, knowledge, target, answers, install, childOutput = 'inherit', }) {
-    if (existsSync(target) && (await readdir(target)).length > 0) {
-        throw new CliError('target_not_empty', `${target} already exists and is not empty.`);
+    const occupied = targetProblem(target);
+    if (occupied !== undefined) {
+        throw new CliError('target_not_empty', occupied);
+    }
+    const created = !existsSync(target);
+    interrupted = false;
+    process.on('SIGINT', interrupt);
+    try {
+        await write({ templates, knowledge, target, answers, install, childOutput });
     }
+    catch (error) {
+        await discard(target, created);
+        throw error;
+    }
+    finally {
+        process.off('SIGINT', interrupt);
+    }
+}
+async function write({ templates, knowledge, target, answers, install, childOutput, }) {
     const [only] = answers.types;
     if (answers.architecture === 'alone' && only !== undefined) {
         await copyTemplate(join(templates, only), target);

package/dist/names.js

@@ -1,10 +1,52 @@
+import { readdirSync, statSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
 const PROJECT_NAME = /^[a-z][a-z0-9-]*$/;
+// npm refuses a longer package name.
+const MAX_LENGTH = 214;
+// In a workspace each app's package is named after its type, and `pnpm --filter <type>` would match the root too.
+const RESERVED = ['api', 'web', 'mobile', 'site'];
 export function validateProjectName(name) {
     if (!PROJECT_NAME.test(name)) {
         return 'Use lowercase letters, digits and hyphens, starting with a letter.';
     }
+    if (name.length > MAX_LENGTH) {
+        return `Use at most ${MAX_LENGTH} characters.`;
+    }
+    if (RESERVED.includes(name)) {
+        return 'That is the name an app takes inside a workspace; choose another.';
+    }
+    return undefined;
+}
+// Why a directory cannot receive a project, or undefined when it can: it does not exist yet, or it is empty.
+export function targetProblem(target) {
+    const stats = statSync(target, { throwIfNoEntry: false });
+    if (stats === undefined) {
+        return undefined;
+    }
+    if (!stats.isDirectory()) {
+        return `${target} already exists and is not a directory.`;
+    }
+    if (readdirSync(target).length > 0) {
+        return `${target} already exists and is not empty.`;
+    }
     return undefined;
 }
+// `.` is the current directory, and the project takes its name; anything else is a new directory inside it.
+export function projectAt(input, cwd) {
+    return input === '.'
+        ? { name: basename(cwd), target: cwd }
+        : { name: input, target: resolve(cwd, input) };
+}
+export function projectProblem(input, cwd) {
+    const { name, target } = projectAt(input, cwd);
+    const invalid = validateProjectName(name);
+    if (invalid !== undefined) {
+        return input === '.'
+            ? `This directory's name, "${name}", cannot name a project. ${invalid}`
+            : invalid;
+    }
+    return targetProblem(target);
+}
 export function schemeFor(name) {
     return name.replaceAll('-', '');
 }

package/dist/questions.js

@@ -1,4 +1,4 @@
-import { validateProjectName } from "./names.js";
+import { projectAt, targetProblem, validateProjectName } from "./names.js";
 import { CliError } from "./output.js";
 const TYPES = ['api', 'web', 'mobile', 'site'];
 const TENANT_AWARE = ['api', 'web', 'mobile'];
@@ -6,14 +6,20 @@ function missing(flag) {
     throw new CliError('needs_input', `Missing ${flag}. Outside an interactive terminal every answer must come from a flag.`);
 }
 function parseTypes(value) {
-    const types = value.split(',').map((type) => type.trim());
+    const types = value
+        .split(',')
+        .map((type) => type.trim())
+        .filter((type) => type !== '');
     const unknown = types.filter((type) => !TYPES.includes(type));
-    if (unknown.length > 0 || types.length === 0) {
+    if (types.length === 0) {
+        throw new CliError('invalid_input', `--types is empty. Choose from ${TYPES.join(', ')}.`);
+    }
+    if (unknown.length > 0) {
         throw new CliError('invalid_input', `Unknown type: ${unknown.join(', ')}. Choose from ${TYPES.join(', ')}.`);
     }
     return [...new Set(types)];
 }
-export async function resolveAnswers(flags, asker) {
+export async function resolveAnswers(flags, asker, cwd = process.cwd()) {
     if (flags.alone && flags.monorepo) {
         throw new CliError('invalid_input', 'Choose --alone or --monorepo, not both.');
     }
@@ -23,10 +29,17 @@ export async function resolveAnswers(flags, asker) {
     if (flags.multiTenant && flags.singleTenant) {
         throw new CliError('invalid_input', 'Choose --multi-tenant or --single-tenant, not both.');
     }
-    const name = flags.name ?? (asker === undefined ? missing('the project name') : await asker.name());
+    const input = flags.name ?? (asker === undefined ? missing('the project name') : await asker.name());
+    const { name, target } = projectAt(input, cwd);
     const invalid = validateProjectName(name);
     if (invalid !== undefined) {
-        throw new CliError('invalid_input', `Invalid project name "${name}". ${invalid}`);
+        const which = input === '.' ? ', taken from this directory' : '';
+        throw new CliError('invalid_input', `Invalid project name "${name}"${which}. ${invalid}`);
+    }
+    // Before the other questions, so nobody answers them all for a directory that cannot take the project.
+    const occupied = targetProblem(target);
+    if (occupied !== undefined) {
+        throw new CliError('target_not_empty', occupied);
     }
     let types;
     if (flags.types !== undefined) {
@@ -52,17 +65,20 @@ export async function resolveAnswers(flags, asker) {
         architecture = await asker.architecture();
     }
     let multiTenant = false;
-    if (types.some((type) => TENANT_AWARE.includes(type))) {
-        if (flags.multiTenant || flags.singleTenant) {
-            multiTenant = flags.multiTenant;
-        }
-        else if (asker !== undefined) {
-            multiTenant = await asker.multiTenant();
-        }
-        else {
-            missing('--multi-tenant or --single-tenant');
+    if (!types.some((type) => TENANT_AWARE.includes(type))) {
+        if (flags.multiTenant) {
+            throw new CliError('invalid_input', `--multi-tenant needs one of ${TENANT_AWARE.join(', ')} in --types.`);
         }
     }
+    else if (flags.multiTenant || flags.singleTenant) {
+        multiTenant = flags.multiTenant;
+    }
+    else if (asker !== undefined) {
+        multiTenant = await asker.multiTenant();
+    }
+    else {
+        missing('--multi-tenant or --single-tenant');
+    }
     // MCP authorizes through a sign-in and a consent page, which only a web app can serve.
     const mcpCapable = types.includes('api') && types.includes('web');
     let mcp = false;
@@ -80,5 +96,5 @@ export async function resolveAnswers(flags, asker) {
     else {
         missing('--mcp or --no-mcp');
     }
-    return { name, types, architecture, multiTenant, mcp };
+    return { name, types, architecture, multiTenant, mcp, target };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",
@@ -52,6 +52,6 @@
     "vitest": "4.1.11"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/api/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later, pnpm, and Docker Desktop running: the database and the tests both run in it.
+Node 22.18 or later, pnpm 10.26 or later, and Docker Desktop running: the database and the tests both run in it.
 
 ## Running it
 

package/templates/api/package.json

@@ -18,9 +18,10 @@
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/cimd": "1.7.6",
-    "@better-auth/expo": "1.7.6",
-    "@better-auth/mcp": "1.7.6",
+    "@better-auth/cimd": "1.7.7",
+    "@better-auth/core": "1.7.7",
+    "@better-auth/expo": "1.7.7",
+    "@better-auth/mcp": "1.7.7",
     "@fastify/cors": "11.3.0",
     "@fastify/swagger": "9.9.0",
     "@fastify/swagger-ui": "6.1.1",
@@ -28,7 +29,7 @@
     "@mikro-orm/migrations": "7.2.0",
     "@mikro-orm/postgresql": "7.2.0",
     "@modelcontextprotocol/server": "2.2.0",
-    "better-auth": "1.7.6",
+    "better-auth": "1.7.7",
     "fastify": "5.12.5",
     "fastify-type-provider-zod": "7.0.0",
     "pg": "8.23.0",
@@ -47,14 +48,14 @@
     "@types/node": "24.13.4",
     "@types/pg": "8.23.1",
     "@vitest/coverage-v8": "4.1.11",
-    "auth": "1.7.6",
+    "auth": "1.7.7",
     "pino-pretty": "13.1.3",
     "typescript": "6.0.3",
     "unplugin-swc": "1.6.0",
     "vitest": "4.1.11"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   },
   "mikro-orm": {
     "configPaths": [

package/templates/mobile/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later, pnpm, and the API running with `MOBILE_APP_SCHEME=app`. A simulator or a device with Expo Go
+Node 22.18 or later, pnpm 10.26 or later, and the API running with `MOBILE_APP_SCHEME=app`. A simulator or a device with Expo Go
 to open the app.
 
 ## Running it

package/templates/mobile/package.json

@@ -15,12 +15,13 @@
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.7.6",
+    "@better-auth/core": "1.7.7",
+    "@better-auth/expo": "1.7.7",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/query-sync-storage-persister": "5.102.8",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-query-persist-client": "5.102.8",
-    "better-auth": "1.7.6",
+    "better-auth": "1.7.7",
     "class-variance-authority": "0.7.1",
     "expo": "57.0.22",
     "expo-constants": "57.0.18",
@@ -59,6 +60,6 @@
     "typescript": "6.0.3"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/site/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later, and pnpm. The build downloads its font from Google Fonts, so it needs network access.
+Node 22.18 or later, and pnpm 10.26 or later. The build downloads its font from Google Fonts, so it needs network access.
 
 ## Running it
 

package/templates/site/package.json

@@ -35,6 +35,6 @@
     "vitest": "4.1.11"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/web/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later, pnpm, and the API running.
+Node 22.18 or later, pnpm 10.26 or later, and the API running.
 
 ## Running it
 

package/templates/web/package.json

@@ -16,12 +16,13 @@
   },
   "dependencies": {
     "@base-ui/react": "1.8.0",
-    "@better-auth/oauth-provider": "1.7.6",
+    "@better-auth/core": "1.7.7",
+    "@better-auth/oauth-provider": "1.7.7",
     "@fontsource-variable/geist": "5.3.0",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-router": "1.170.36",
-    "better-auth": "1.7.6",
+    "better-auth": "1.7.7",
     "class-variance-authority": "0.7.1",
     "cn": "0.3.0",
     "lucide-react": "1.45.0",
@@ -52,6 +53,6 @@
     "vitest": "4.1.11"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }

package/templates/workspace/README.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-Node 22.17 or later and pnpm. For the API, Docker Desktop running: its database and tests run in it.
+Node 22.18 or later and pnpm 10.26 or later. For the API, Docker Desktop running: its database and tests run in it.
 
 ## Layout
 

package/templates/workspace/package.json

@@ -12,6 +12,6 @@
     "@biomejs/biome": "catalog:"
   },
   "engines": {
-    "node": ">=22.17.0"
+    "node": ">=22.18.0"
   }
 }