create-basalt 1.1.0 → 1.1.1

package/dist/{chunk-XV5NMTXT.js → chunk-TYOPE3RU.js}

@@ -80,7 +80,7 @@ function tsconfigJson() {
 `;
 }
 function envTs(options) {
-  return `import { defineEnv } from '@basaltkit/env'
+  return `import { defineEnv${options.auth ? ", secret" : ""} } from '@basaltkit/env'
 import { z } from 'zod'
 
 export const env = defineEnv({
@@ -88,7 +88,9 @@ export const env = defineEnv({
   HOST: z.string().default('0.0.0.0'),
   LOG_LEVEL: z.string().default('info'),
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),${options.auth ? `
-  APP_SECRET: z.string().min(16).default('change-me-in-production--'),` : ""}
+  // Signs JWTs and sessions. secret() is fail-closed: required in production
+  // (no fallback), rejected if it looks like a placeholder. Dev uses devDefault.
+  APP_SECRET: secret({ minLength: 32, devDefault: 'dev-only-insecure-secret-please-change-me' }),` : ""}
 })
 `;
 }
@@ -97,20 +99,26 @@ function envExample(options) {
 HOST=0.0.0.0
 LOG_LEVEL=info
 NODE_ENV=development
-${options.auth ? "APP_SECRET=change-me-in-production--\n" : ""}`;
+${options.auth ? "# Required in production (the app refuses to boot without it).\n# Generate a strong one:  openssl rand -base64 48\n# APP_SECRET=\n" : ""}`;
 }
 function appTs(options) {
   const imports = [
     `import { createApp } from '@basaltkit/core'`,
     `import { configPlugin } from '@basaltkit/config'`,
     `import { eventsPlugin } from '@basaltkit/events'`,
-    `import { fastifyPlugin } from '@basaltkit/fastify'`,
+    `import { fastifyPlugin, securityPlugin } from '@basaltkit/fastify'`,
     `import { loggerPlugin } from '@basaltkit/logger'`
   ];
   const plugins = [
     `configPlugin({ app: { name: '${options.name}' } })`,
     `loggerPlugin({ level: options.logLevel ?? 'info', ...(options.pretty ? { pretty: true } : {}) })`,
-    `eventsPlugin()`
+    `eventsPlugin()`,
+    `securityPlugin({
+      // Secure response headers (HSTS, X-Frame-Options, nosniff, \u2026) are on by
+      // default. Turn on rate limiting and a CORS allow-list for production:
+      // rateLimit: { limit: 120, windowMs: 60_000 },
+      // cors: { origin: ['https://app.example.com'], credentials: true },
+    })`
   ];
   let routesExpression = "appRoutes";
   if (options.tenancy) {

package/dist/cli.js

@@ -3,7 +3,7 @@ import {
   TargetNotEmptyError,
   createProject,
   detectPackageManager
-} from "./chunk-XV5NMTXT.js";
+} from "./chunk-TYOPE3RU.js";
 
 // src/cli.ts
 import { spawn } from "child_process";

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   TargetNotEmptyError,
   createProject,
   detectPackageManager
-} from "./chunk-XV5NMTXT.js";
+} from "./chunk-TYOPE3RU.js";
 export {
   TargetNotEmptyError,
   createProject,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Scaffold a production-shaped Basalt SaaS app: npm create basalt my-saas [--billing] [--ui] [--cli] [--install] [--git]",
   "license": "MIT",
   "type": "module",