create-basalt 1.0.0 → 1.1.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Machize Contributors
+Copyright (c) 2026 Basalt Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/{chunk-RFS7HGZ6.js → chunk-TYOPE3RU.js}

@@ -21,12 +21,22 @@ function packageJson(options) {
   if (options.billing) dependencies["@basaltkit/subscriptions"] = BASALT_VERSION;
   if (options.cli) {
     dependencies["@basaltkit/cli"] = BASALT_VERSION;
-    dependencies["@basaltkit/generator"] = BASALT_VERSION;
     dependencies["@basaltkit/prisma"] = BASALT_VERSION;
   }
   for (const pkg of Object.keys(dependencies)) {
     if (pkg.startsWith("@basaltkit/")) dependencies[pkg] = versionOf(pkg);
   }
+  const devDependencies = {
+    "@basaltkit/testing": versionOf("@basaltkit/testing"),
+    "@types/node": "^22.15.0",
+    "pino-pretty": "^13.0.0",
+    tsx: "^4.19.0",
+    typescript: "^5.8.0",
+    vitest: "^3.1.0"
+  };
+  if (options.cli) {
+    devDependencies["@basaltkit/generator"] = versionOf("@basaltkit/generator");
+  }
   return `${JSON.stringify(
     {
       name: options.name,
@@ -41,14 +51,7 @@ function packageJson(options) {
         ...options.cli ? { basalt: "tsx bin/basalt.ts" } : {}
       },
       dependencies: Object.fromEntries(Object.entries(dependencies).sort()),
-      devDependencies: {
-        "@basaltkit/testing": versionOf("@basaltkit/testing"),
-        "@types/node": "^22.15.0",
-        "pino-pretty": "^13.0.0",
-        tsx: "^4.19.0",
-        typescript: "^5.8.0",
-        vitest: "^3.1.0"
-      }
+      devDependencies: Object.fromEntries(Object.entries(devDependencies).sort())
     },
     null,
     2
@@ -77,7 +80,7 @@ function tsconfigJson() {
 `;
 }
 function envTs(options) {
-  return `import { defineEnv } from '@basaltkit/env'
+  return `import { defineEnv${options.auth ? ", secret" : ""} } from '@basaltkit/env'
 import { z } from 'zod'
 
 export const env = defineEnv({
@@ -85,7 +88,9 @@ export const env = defineEnv({
   HOST: z.string().default('0.0.0.0'),
   LOG_LEVEL: z.string().default('info'),
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),${options.auth ? `
-  APP_SECRET: z.string().min(16).default('change-me-in-production--'),` : ""}
+  // Signs JWTs and sessions. secret() is fail-closed: required in production
+  // (no fallback), rejected if it looks like a placeholder. Dev uses devDefault.
+  APP_SECRET: secret({ minLength: 32, devDefault: 'dev-only-insecure-secret-please-change-me' }),` : ""}
 })
 `;
 }
@@ -94,20 +99,26 @@ function envExample(options) {
 HOST=0.0.0.0
 LOG_LEVEL=info
 NODE_ENV=development
-${options.auth ? "APP_SECRET=change-me-in-production--\n" : ""}`;
+${options.auth ? "# Required in production (the app refuses to boot without it).\n# Generate a strong one:  openssl rand -base64 48\n# APP_SECRET=\n" : ""}`;
 }
 function appTs(options) {
   const imports = [
     `import { createApp } from '@basaltkit/core'`,
     `import { configPlugin } from '@basaltkit/config'`,
     `import { eventsPlugin } from '@basaltkit/events'`,
-    `import { fastifyPlugin } from '@basaltkit/fastify'`,
+    `import { fastifyPlugin, securityPlugin } from '@basaltkit/fastify'`,
     `import { loggerPlugin } from '@basaltkit/logger'`
   ];
   const plugins = [
     `configPlugin({ app: { name: '${options.name}' } })`,
     `loggerPlugin({ level: options.logLevel ?? 'info', ...(options.pretty ? { pretty: true } : {}) })`,
-    `eventsPlugin()`
+    `eventsPlugin()`,
+    `securityPlugin({
+      // Secure response headers (HSTS, X-Frame-Options, nosniff, \u2026) are on by
+      // default. Turn on rate limiting and a CORS allow-list for production:
+      // rateLimit: { limit: 120, windowMs: 60_000 },
+      // cors: { origin: ['https://app.example.com'], credentials: true },
+    })`
   ];
   let routesExpression = "appRoutes";
   if (options.tenancy) {
@@ -143,18 +154,19 @@ function appTs(options) {
     })`);
   }
   if (options.cli) {
-    imports.push(`import { commandsPlugin } from '@basaltkit/cli'`);
-    imports.push(`import { generatorCommands } from '@basaltkit/generator'`);
-    imports.push(`import { prismaSyncCommand } from '@basaltkit/prisma'`);
-    plugins.push(`commandsPlugin([...generatorCommands(), prismaSyncCommand()])`);
+    imports.push(`import { commandsPlugin, type CommandDefinition } from '@basaltkit/cli'`);
+    plugins.push(`...(options.commands && options.commands.length > 0 ? [commandsPlugin(options.commands)] : [])`);
   }
   plugins.push(`fastifyPlugin({ routes: ${routesExpression} })`);
+  const commandsField = options.cli ? `
+  /** Dev/CLI commands (make:*, ai:*, prisma:sync) \u2014 passed ONLY by bin/basalt.ts. */
+  commands?: CommandDefinition[]` : "";
   return `${imports.join("\n")}
 import { appRoutes } from './routes.js'
 
 export interface BuildAppOptions {
   logLevel?: string
-  pretty?: boolean
+  pretty?: boolean${commandsField}
 }
 
 export function buildApp(options: BuildAppOptions = {}) {
@@ -229,14 +241,22 @@ for (const signal of ['SIGINT', 'SIGTERM'] as const) {
 function basaltBin() {
   return `#!/usr/bin/env node
 import { runCli } from '@basaltkit/cli'
+import { generatorCommands } from '@basaltkit/generator'
+import { prismaSyncCommand } from '@basaltkit/prisma'
 import { buildApp } from '../src/app.js'
 
-// The 'basalt' CLI: boots the app, runs one command, shuts down.
+// The 'basalt' CLI: boots the app WITH the dev/CLI commands, runs one, shuts down.
+// The dev tools (@basaltkit/generator; add @basaltkit/ai for ai:*) are imported
+// ONLY here \u2014 the runtime server (src/server.ts) never loads them, so the SaaS
+// runs without the codegen/AI layer.
 //   pnpm basalt list                    \u2014 show available commands
 //   pnpm basalt routes                  \u2014 list registered HTTP routes
 //   pnpm basalt make:resource Project   \u2014 generate a full resource vertical
 //   pnpm basalt make:service Project    \u2014 generate a single artifact (schema/service/\u2026)
-const app = buildApp({ logLevel: 'silent' })
+const app = buildApp({
+  logLevel: 'silent',
+  commands: [...generatorCommands(), prismaSyncCommand()],
+})
 process.exit(await runCli({ app }))
 `;
 }

package/dist/cli.js

@@ -3,7 +3,7 @@ import {
   TargetNotEmptyError,
   createProject,
   detectPackageManager
-} from "./chunk-RFS7HGZ6.js";
+} from "./chunk-TYOPE3RU.js";
 
 // src/cli.ts
 import { spawn } from "child_process";

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   TargetNotEmptyError,
   createProject,
   detectPackageManager
-} from "./chunk-RFS7HGZ6.js";
+} from "./chunk-TYOPE3RU.js";
 export {
   TargetNotEmptyError,
   createProject,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Scaffold a production-shaped Basalt SaaS app: npm create basalt my-saas [--billing] [--ui] [--cli] [--install] [--git]",
   "license": "MIT",
   "type": "module",