create-avocado-site 0.11.5 → 0.11.7

package/dist/index.js

@@ -4,19 +4,31 @@ import { spawn } from "node:child_process";
 import { mkdir, readdir } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { runPrompts, demoConfig } from "./prompts.js";
+import { runPrompts, demoConfig, promptForApiKey } from "./prompts.js";
 import { collectFiles, collectDemoFiles, generateFiles } from "./generator.js";
 import { printInstructions } from "./instructions.js";
 async function main() {
     const cwd = process.cwd();
     /*
      * `npm create avocado-site my-demo` — a directory argument means the demo,
-     * with no questions. Somebody who has typed a name has already answered the
-     * only one that mattered, and the fastest path to seeing the product should
-     * not be gated behind three selects.
+     * with no *configuration* questions. Somebody who has typed a name has
+     * already answered the only one that mattered, and the fastest path to
+     * seeing the product should not be gated behind three selects.
+     *
+     * One question survives that rule, and it earns its place: the API key.
+     *
+     * Not to gate anything — everything except chat works without one, and that
+     * is deliberate and worth protecting, so Enter skips it. It is here because
+     * **keys are read at startup**. A key given now is live the first time the
+     * dev server runs; a key added afterwards needs a file edit *and* a restart,
+     * and nothing in the product confirms either happened. "I added the key and
+     * nothing changed" has no error message anywhere in the system, and this
+     * prompt is the cheapest way to stop most people arriving there.
      */
     const target = process.argv.slice(2).find((arg) => !arg.startsWith("-"));
-    const config = target ? await demoConfig(target) : await runPrompts(cwd);
+    const config = target
+        ? await demoConfig(target, await promptForApiKey())
+        : await runPrompts(cwd);
     if (!config)
         return;
     if (config.mode === "demo") {
@@ -90,7 +102,9 @@ async function bootstrapDemo(cwd, dirName, config) {
         `  default site when the URL does not name one. \`npm run dev\` opens this`,
         `  URL for you.`,
         ``,
-        `  No API key needed to look around; add ANTHROPIC_API_KEY to .env.local`,
+        config.apiKey
+            ? `  Chat is enabled \u2014 ${config.apiKey.variable} is in .env.local`
+            : `  No API key needed to look around; add ANTHROPIC_API_KEY to .env.local and restart`,
         `  when you want to edit by chat.`,
     ].join("\n"));
     p.outro("Done.");

package/dist/prompts.d.ts

@@ -1,8 +1,39 @@
 import type { ScaffoldConfig } from "./types.js";
 /** A directory name turned into something the orchestrator will accept as a site id. */
 export declare function toSiteId(name: string): string;
+/**
+ * Which provider a pasted key belongs to, by prefix.
+ *
+ * Exported so `api-key-prompt.test.ts` can check the classification without a
+ * terminal. Unknown shapes are not rejected — a key format can change, and
+ * refusing a real key because this list is out of date is worse than writing it
+ * under the most likely variable and letting the server report the truth.
+ */
+export declare function variableForKey(raw: string): string | null;
+/**
+ * Offer to take an API key now. One keypress to skip.
+ *
+ * The product deliberately works without one — the preview, click-to-select,
+ * the property panel, publishing and every metadata guarantee need no model,
+ * and "no API key needed to look around" is a real differentiator worth
+ * protecting. So this must never become a gate: Enter continues, and the copy
+ * says so before it says anything else.
+ *
+ * What it buys is the restart. Keys are read at startup, so a key set *here* is
+ * live the first time the dev server runs, while a key added afterwards needs
+ * a file edit and a restart — and nothing in the product confirms either
+ * happened. "I added the key and nothing changed" has no error message
+ * anywhere, and this is the cheapest way to stop most people reaching it.
+ */
+export declare function promptForApiKey(): Promise<{
+    variable: string;
+    value: string;
+} | undefined>;
 /** Everything a demo scaffold needs, with no questions asked. */
-export declare function demoConfig(dirName: string): Promise<ScaffoldConfig>;
+export declare function demoConfig(dirName: string, apiKey?: {
+    variable: string;
+    value: string;
+}): Promise<ScaffoldConfig>;
 /**
  * The mode question, asked first.
  *

package/dist/prompts.js

@@ -8,8 +8,64 @@ export function toSiteId(name) {
     const cleaned = name.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
     return cleaned.length > 0 ? cleaned : "avocado-demo";
 }
+/**
+ * Which provider a pasted key belongs to, by prefix.
+ *
+ * Exported so `api-key-prompt.test.ts` can check the classification without a
+ * terminal. Unknown shapes are not rejected — a key format can change, and
+ * refusing a real key because this list is out of date is worse than writing it
+ * under the most likely variable and letting the server report the truth.
+ */
+export function variableForKey(raw) {
+    const key = raw.trim();
+    if (!key)
+        return null;
+    if (key.startsWith("sk-ant-"))
+        return "ANTHROPIC_API_KEY";
+    if (key.startsWith("sk-"))
+        return "OPENAI_API_KEY";
+    if (key.startsWith("AIza"))
+        return "GOOGLE_GENAI_API_KEY";
+    return "ANTHROPIC_API_KEY";
+}
+/**
+ * Offer to take an API key now. One keypress to skip.
+ *
+ * The product deliberately works without one — the preview, click-to-select,
+ * the property panel, publishing and every metadata guarantee need no model,
+ * and "no API key needed to look around" is a real differentiator worth
+ * protecting. So this must never become a gate: Enter continues, and the copy
+ * says so before it says anything else.
+ *
+ * What it buys is the restart. Keys are read at startup, so a key set *here* is
+ * live the first time the dev server runs, while a key added afterwards needs
+ * a file edit and a restart — and nothing in the product confirms either
+ * happened. "I added the key and nothing changed" has no error message
+ * anywhere, and this is the cheapest way to stop most people reaching it.
+ */
+export async function promptForApiKey() {
+    const key = await p.password({
+        message: "Paste an API key to enable chat, or press Enter to skip",
+        mask: "\u2022",
+        validate: () => undefined,
+    });
+    if (p.isCancel(key))
+        return undefined;
+    const value = typeof key === "string" ? key.trim() : "";
+    if (!value) {
+        p.note("Chat will use the built-in demo planner, which handles simple, literal edits.\n" +
+            "Everything else works: the preview, click-to-select, the property panel and publishing.\n" +
+            "You can add a key to .env.local later and restart.", "No key \u2014 that is fine");
+        return undefined;
+    }
+    const variable = variableForKey(value);
+    if (!variable)
+        return undefined;
+    p.note(`Writing ${variable} to .env.local. No restart needed.`, "Key saved");
+    return { variable, value };
+}
 /** Everything a demo scaffold needs, with no questions asked. */
-export async function demoConfig(dirName) {
+export async function demoConfig(dirName, apiKey) {
     const sitePort = await findFreePort(3000);
     const editorPort = await findFreePort(4100);
     return {
@@ -21,6 +77,7 @@ export async function demoConfig(dirName) {
         editorPort,
         draftSecret: randomBytes(24).toString("hex"),
         publishToken: randomBytes(24).toString("hex"),
+        apiKey,
     };
 }
 /**
@@ -101,6 +158,7 @@ async function integratePrompts(cwd) {
         p.cancel("Cancelled.");
         return null;
     }
+    const apiKey = await promptForApiKey();
     return {
         mode: "integrate",
         cms: cms,
@@ -117,5 +175,6 @@ async function integratePrompts(cwd) {
         // that already looks filled in is a step nobody performs.
         draftSecret: randomBytes(24).toString("hex"),
         publishToken: randomBytes(24).toString("hex"),
+        apiKey,
     };
 }

package/dist/templates/demo-app.js

@@ -155,7 +155,9 @@ function envLocal(config) {
 #                         installs it for you and a Gemini plan fails on the
 #                         first call without it.
 #
-# ANTHROPIC_API_KEY=
+${config.apiKey
+        ? `${config.apiKey.variable}=${config.apiKey.value}`
+        : "# ANTHROPIC_API_KEY="}
 
 # The orchestrator runs inside this app, at /api/avocado. There is no third
 # service to start and nothing to deploy separately.
@@ -270,6 +272,7 @@ function devScript(config) {
  * at /api/avocado. Two processes, one terminal, no third service.
  */
 import { spawn } from "node:child_process"
+import { readFileSync } from "node:fs"
 import { createConnection } from "node:net"
 
 const SITE_PORT = process.env.PORT ?? "${config.sitePort}"
@@ -295,8 +298,34 @@ const OPEN_URL = \`\${EDITOR_URL}/?siteId=\${SITE_ID}&session=dev\`
 
 const children = []
 
+/*
+ * Read DRAFT_MODE_SECRET out of .env.local and hand it to the children.
+ *
+ * Next loads .env.local by itself; an npm script does not, so the editor CLI
+ * would otherwise never see it. Without it the editor cannot select or edit
+ * anything once the site is built for production — the SDK requires \`secret=\`
+ * on the preview URL there, and with none it renders an ordinary public page
+ * with no block markers at all.
+ */
+function envFromLocalFile() {
+  try {
+    const text = readFileSync(new URL("../.env.local", import.meta.url), "utf8")
+    const match = text.match(/^\\s*DRAFT_MODE_SECRET\\s*=\\s*(.+)\\s*$/m)
+    const value = match?.[1]?.trim().replace(/^["']|["']$/g, "")
+    return value ? { DRAFT_MODE_SECRET: value } : {}
+  } catch {
+    return {}
+  }
+}
+
+const EXTRA_ENV = envFromLocalFile()
+
 function run(command, args) {
-  const child = spawn(command, args, { stdio: "inherit", shell: process.platform === "win32" })
+  const child = spawn(command, args, {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    env: { ...process.env, ...EXTRA_ENV }
+  })
   children.push(child)
   child.on("exit", (code) => {
     // If either half dies the other is useless, so take both down rather than

package/dist/types.d.ts

@@ -40,6 +40,20 @@ export type ScaffoldConfig = {
      * `POST /api/editor/publish` took content from anyone who asked.
      */
     publishToken: string;
+    /**
+     * An API key pasted during setup, written straight into `.env.local`.
+     *
+     * Offered once, skippable in one keypress. The point is not to gate the
+     * product — everything except chat works without a key, and that is a real
+     * feature — it is that **a key set before the dev server first starts needs
+     * no restart**. Keys are read at startup, so one added afterwards requires
+     * editing a file *and* restarting, and "I added the key and nothing changed"
+     * is a failure mode with no error message anywhere.
+     */
+    apiKey?: {
+        variable: string;
+        value: string;
+    };
 };
 export type GeneratedFile = {
     path: string;

package/dist/versions.d.ts

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export declare const AVOCADO = "0.11.5";
+export declare const AVOCADO = "0.11.7";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/dist/versions.js

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export const AVOCADO = "0.11.5";
+export const AVOCADO = "0.11.7";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-avocado-site",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "description": "Bootstrap a runnable Avocado Studio demo site, or wire Avocado into an existing Next.js project",
   "type": "module",
   "bin": {
@@ -34,8 +34,8 @@
     "@types/node": "^22.13.10",
     "tsx": "^4.19.0",
     "typescript": "^5.7.3",
-    "@avocadostudio-ai/site-sdk": "0.11.5",
-    "@avocadostudio-ai/shared": "0.11.5"
+    "@avocadostudio-ai/site-sdk": "0.11.7",
+    "@avocadostudio-ai/shared": "0.11.7"
   },
   "license": "Apache-2.0",
   "homepage": "https://docs.avocadostudio.dev",