create-basalt 1.10.0 → 1.12.0

package/dist/templates.js

@@ -1,4 +1,5 @@
 import { THIRD_PARTY_VERSIONS } from './latest-versions.js';
+import { DOCKERFILE, DOCKERIGNORE, PRODUCTION_ENTRY } from './stubs.js';
 import { SCAFFOLD_VERSIONS } from './versions.js';
 export { basaltBin } from './bin-template.js';
 export { SCAFFOLD_VERSIONS } from './versions.js';
@@ -29,6 +30,24 @@ export const thirdPartyVersionOf = (pkg) => {
     }
     return range;
 };
+/**
+ * The production path (BK-026): `build` compiles src/ with tsconfig.build.json
+ * (rootDir `.`, outDir `dist`) and `start` runs the result on plain node — the
+ * same entry the Dockerfile's CMD runs. `start:dev` keeps the old tsx start.
+ */
+export const BUILD_SCRIPT = 'tsc -p tsconfig.build.json';
+/** The `db:seed` script of a `--prisma` scaffold with tenancy (prisma.config.ts loads .env, then runs `migrations.seed`). */
+export const DB_SEED_SCRIPT = 'prisma db seed';
+export const START_SCRIPT = `node --enable-source-maps ${PRODUCTION_ENTRY}`;
+export const START_DEV_SCRIPT = 'tsx src/server.ts';
+/** The `start` script every create-basalt release before the production path wrote. */
+export const LEGACY_START_SCRIPT = 'tsx src/server.ts';
+/**
+ * package.json `imports` alias for the generated Prisma client. It lives in
+ * ./generated/prisma — outside src/, so tsc never has to copy its .js files —
+ * and `#db/*` resolves to it from src/ (tsx, vitest) and dist/src/ (node) alike.
+ */
+export const PRISMA_IMPORTS = { '#db/*': './generated/prisma/*' };
 /** The root `basalt` script of an app without `--cli`: create-basalt's project commands. */
 export const BASALT_PROJECT_SCRIPT = 'create-basalt --project';
 /** The root `dev:web` script of a `--ui` app (web/ is a pnpm workspace member). */
@@ -75,7 +94,11 @@ export function packageJson(options) {
     if (options.prisma) {
         // Prisma 7 talks to PostgreSQL through a driver adapter, so `pg` is a real
         // runtime dependency (see src/db.ts); the `prisma` CLI is dev-only.
-        for (const pkg of ['@prisma/adapter-pg', '@prisma/client', 'pg']) {
+        // @prisma/client-runtime-utils is required BY NAME from the generated
+        // client's runtime/ (./generated/prisma/runtime/client.js). Under pnpm it is
+        // only a transitive dependency of @prisma/client, out of reach of plain
+        // `node` — so the app declares it directly (BK-026).
+        for (const pkg of ['@prisma/adapter-pg', '@prisma/client', '@prisma/client-runtime-utils', 'pg']) {
             dependencies[pkg] = thirdPartyVersionOf(pkg);
         }
     }
@@ -108,11 +131,15 @@ export function packageJson(options) {
         version: '0.1.0',
         private: true,
         type: 'module',
+        ...(options.prisma ? { imports: PRISMA_IMPORTS } : {}),
         scripts: {
             // dev opts into NODE_ENV=development (src/dev.ts); start does not, so an
             // unset NODE_ENV counts as production and secrets are required.
             dev: 'tsx watch src/dev.ts',
-            start: 'tsx src/server.ts',
+            // Production: compile once, run on plain node (no tsx at runtime).
+            build: BUILD_SCRIPT,
+            start: START_SCRIPT,
+            'start:dev': START_DEV_SCRIPT,
             test: 'vitest run',
             typecheck: 'tsc --noEmit',
             // With --cli, bin/basalt.ts serves the generators AND hands the project
@@ -132,7 +159,11 @@ export function packageJson(options) {
                     // is deliberately no `db:push` script.
                     'db:migrate': 'prisma migrate dev',
                     'db:deploy': 'prisma migrate deploy',
-                    ...(options.tenancy ? { 'db:seed': 'tsx prisma/seed.ts' } : {}),
+                    // Through Prisma, not `tsx prisma/seed.ts`: prisma.config.ts loads
+                    // .env (the seed imports src/env.ts, which needs the database URL),
+                    // then runs the `migrations.seed` command it declares. Prisma 7's
+                    // `migrate dev` no longer seeds on its own.
+                    ...(options.tenancy ? { 'db:seed': DB_SEED_SCRIPT } : {}),
                 }
                 : {}),
         },
@@ -153,12 +184,34 @@ export function tsconfigJson(options) {
             noEmit: true,
             types: ['node'],
         },
-        // The generated Prisma client lives under src/generated (git-ignored, and
-        // re-created by `prisma generate`); the seed script under prisma/ is
-        // type-checked too.
+        // The generated Prisma client lives in ./generated (git-ignored,
+        // re-created by `prisma generate`, reached through the `#db/*` import
+        // alias); the seed script under prisma/ is type-checked too.
         include: ['src', 'tests', ...(options.prisma && options.tenancy ? ['prisma/seed.ts'] : [])],
     }, null, 2)}\n`;
 }
+/**
+ * `tsconfig.build.json` — what `pnpm build` compiles: src/ only (tests and
+ * bin/ stay dev-only), emitted to dist/ with rootDir `.`, so src/server.ts
+ * becomes dist/src/server.js. Extends tsconfig.json, so the compiler options
+ * (and `pnpm typecheck`) never diverge.
+ */
+export function tsconfigBuildJson() {
+    return `${JSON.stringify({
+        extends: './tsconfig.json',
+        compilerOptions: {
+            noEmit: false,
+            rootDir: '.',
+            outDir: 'dist',
+            sourceMap: true,
+        },
+        include: ['src'],
+    }, null, 2)}\n`;
+}
+/** The production Dockerfile — the same file `basalt publish dockerfile` writes. */
+export function dockerfile() {
+    return DOCKERFILE;
+}
 export function envTs(options) {
     const prefix = envPrefix(options.name);
     return `import { defineEnv${options.auth ? ', secret' : ''} } from '@basaltkit/env'
@@ -222,10 +275,19 @@ export function envPrefix(name) {
     base = base.slice(start, end);
     return base === '' || /^\d/.test(base) ? `APP_${base}` : base;
 }
+/**
+ * The opening lines of `.env.example`. Up to create-basalt 1.10 they read
+ * {@link LEGACY_ENV_EXAMPLE_LEAD} ("nothing loads this file"); `update`
+ * swaps that for this one in existing apps.
+ */
+export const ENV_EXAMPLE_LEAD = `# Development: copy this file to .env — \`pnpm dev\` and \`pnpm basalt\` load it
+# automatically (a new app already has one). \`pnpm start\` (production) does
+# NOT: there the variables come from the environment (or \`node --env-file\`).`;
+export const LEGACY_ENV_EXAMPLE_LEAD = `# Nothing loads this file for you: copy it to .env and start with
+# \`node --env-file=.env\` / \`tsx --env-file=.env\`, or export the variables.`;
 export function envExample(options) {
     const prefix = envPrefix(options.name);
-    return `# Nothing loads this file for you: copy it to .env and start with
-# \`node --env-file=.env\` / \`tsx --env-file=.env\`, or export the variables.
+    return `${ENV_EXAMPLE_LEAD}
 # --env-file NEVER overrides a variable already exported in your shell: if
 # another project exported PORT or DATABASE_URL, an app reading the generic
 # name would silently use THAT one. That is why src/env.ts reads app-prefixed
@@ -252,6 +314,20 @@ ${prefix}_DATABASE_URL=postgres://postgres:postgres@localhost:5432/${databaseNam
 # ${prefix}_DATABASE_URL=postgres://user:pass@localhost:5432/${options.name.replace(/^@[^/]+\//, '')}
 `}`;
 }
+/**
+ * The `.env` a new app starts with (git-ignored, never in the manifest): the
+ * values of `.env.example` for local development plus — with auth — a freshly
+ * generated APP_SECRET, so `pnpm dev` works without a copy step.
+ */
+export function devEnvFile(options, appSecret) {
+    const prefix = envPrefix(options.name);
+    const example = envExample(options);
+    const body = example.slice(example.indexOf(`${prefix}_PORT=`));
+    return `# Local development settings, generated by create-basalt from .env.example.
+# Git-ignored: never commit it. \`pnpm dev\` and \`pnpm basalt\` load it (a
+# variable exported in your shell wins); \`pnpm start\` (production) does not.
+${body.replace(`# ${prefix}_APP_SECRET=\n`, `${prefix}_APP_SECRET=${appSecret}\n`)}`;
+}
 /** A PostgreSQL-safe database name derived from the project name. */
 export function databaseName(name) {
     return name.replace(/^@[^/]+\//, '').replace(/[^a-zA-Z0-9]+/g, '_').toLowerCase();
@@ -511,7 +587,15 @@ import { env } from './env.js'
 const app = await buildApp({
   logLevel: env.LOG_LEVEL,
   pretty: env.NODE_ENV === 'development',
-}).boot()
+})
+  .boot()
+  .catch((error: unknown) => {
+    // A database failure diagnosed by @basaltkit/prisma (permission denied, not
+    // migrated, unreachable…) carries its one-line fix: print it above the stack.
+    const diagnosis = (error as { details?: { diagnosis?: { cause?: string; fix?: string } } } | null)?.details?.diagnosis
+    if (diagnosis) console.error('Cannot start: ' + diagnosis.cause + '\\nFix: ' + diagnosis.fix)
+    throw error
+  })
 
 const server = app.container.get(FASTIFY)
 await server.listen({ port: env.PORT, host: env.HOST })
@@ -526,14 +610,27 @@ for (const signal of ['SIGINT', 'SIGTERM'] as const) {
 `;
 }
 /**
- * `pnpm dev` entrypoint. Opts into NODE_ENV=development (dev secret defaults,
- * pretty logs) unless NODE_ENV is already set, then starts the server. Kept out
- * of server.ts on purpose: `pnpm start` runs server.ts directly, where an unset
- * NODE_ENV counts as production and secrets are required (fail-closed).
+ * `pnpm dev` entrypoint. Loads `.env` (when present) with `node --env-file`
+ * semantics — an exported variable wins, the file only fills in what is
+ * missing — and opts into NODE_ENV=development (dev secret defaults, pretty
+ * logs) unless NODE_ENV is already set, then starts the server. Kept out of
+ * server.ts on purpose: `pnpm start` runs server.ts directly, where nothing
+ * loads `.env` (production configuration comes from the real environment) and
+ * an unset NODE_ENV counts as production, so secrets are required (fail-closed).
  */
 export function devTs() {
     return `// Development entrypoint (\`pnpm dev\`). \`pnpm start\` runs server.ts directly,
 // where an unset NODE_ENV counts as production: secrets are then required.
+import { existsSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+// Development loads .env (when present) like \`node --env-file=.env\`: a variable
+// already exported in your shell still wins, the file only fills in what is
+// missing. \`pnpm start\` (production) never loads it — there the configuration
+// comes from the real environment.
+const envFile = fileURLToPath(new URL('../.env', import.meta.url))
+if (existsSync(envFile)) process.loadEnvFile(envFile)
+
 process.env['NODE_ENV'] ??= 'development'
 await import('./server.js')
 `;
@@ -558,9 +655,17 @@ const PRISMA_MODELS = {
 }
 
 model TenantDomain {
-  domain   String @id
-  tenantId String
-  tenant   Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  domain            String    @id
+  tenantId          String
+  // Custom-domain verification (PrismaDomainStore). A row with a NULL token
+  // mirrors \`tenant.domains\` and is written by PrismaTenantSource; a row with a
+  // token is a CustomDomains claim, which the source never deletes, and which
+  // only resolves a request once \`verified\` is true.
+  verificationToken String?
+  verified          Boolean   @default(true)
+  createdAt         DateTime  @default(now())
+  verifiedAt        DateTime?
+  tenant            Tenant    @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@index([tenantId])
   @@map("tenant_domains")
@@ -575,9 +680,11 @@ model TenantDomain {
 }
 
 model AuthSession {
-  id        String   @id
-  userId    String
-  expiresAt DateTime
+  id         String    @id
+  userId     String
+  expiresAt  DateTime
+  /// Last use, for the idle timeout (trackSessionActivity: true).
+  lastSeenAt DateTime?
 
   @@index([userId])
   @@map("auth_sessions")
@@ -756,7 +863,9 @@ export function prismaSchema(options) {
 
 generator client {
   provider = "prisma-client-js"
-  output   = "../src/generated/prisma"
+  // Outside src/ on purpose: src/db.ts imports it as \`#db/client.js\` (the
+  // package.json "imports" alias), which resolves from src/ and dist/src/ alike.
+  output   = "../generated/prisma"
 }
 
 datasource db {
@@ -792,9 +901,9 @@ export function prismaConfigTs(options) {
     return `import { loadEnvFile } from 'node:process'
 import { defineConfig } from 'prisma/config'
 
-// Prisma loads no .env for you (neither does the app — see src/env.ts). This
-// mirrors \`node --env-file=.env\`: a variable already exported in your shell
-// still wins, the file only fills in what is missing.
+// Prisma loads no .env for you. Like the app's dev entrypoints (src/dev.ts,
+// bin/basalt.ts) this mirrors \`node --env-file=.env\`: a variable already
+// exported in your shell still wins, the file only fills in what is missing.
 try {
   loadEnvFile('.env')
 } catch {
@@ -804,7 +913,7 @@ try {
 export default defineConfig({
   schema: 'prisma/schema.prisma',${options.tenancy
         ? `
-  // Runs after \`prisma migrate dev\` / \`prisma migrate reset\`.
+  // Run by \`prisma db seed\` (\`pnpm db:seed\`), with the .env loaded above.
   migrations: { seed: 'tsx prisma/seed.ts' },`
         : ''}
   datasource: {
@@ -824,7 +933,9 @@ export default defineConfig({
  */
 export function dbTs(options) {
     return `import { PrismaPg } from '@prisma/adapter-pg'${options.tenancy ? `\nimport { tenancyExtension } from '@basaltkit/prisma'` : ''}
-import { PrismaClient } from './generated/prisma/client.js'
+// The generated client (./generated/prisma), through the package.json
+// "imports" alias — the same specifier works under tsx and from dist/.
+import { PrismaClient } from '#db/client.js'
 import { env } from './env.js'
 
 /**
@@ -860,8 +971,9 @@ export const db = prisma
 }
 /**
  * `prisma/seed.ts` — creates the `demo` tenant the scaffolded resolvers expect
- * (`x-tenant-id: demo`, `demo.localhost`). Runs from `pnpm db:seed` and after
- * `prisma migrate dev` (prisma.config.ts declares it).
+ * (`x-tenant-id: demo`, `demo.localhost`). Runs from `pnpm db:seed`
+ * (`prisma db seed`, the command prisma.config.ts declares) — Prisma 7's
+ * `migrate dev` does not run it.
  */
 export function prismaSeedTs(options) {
     return `import { prismaTenantSource } from '@basaltkit/tenancy-prisma'
@@ -947,8 +1059,9 @@ Included: ${features.join(' · ')}.
 \`\`\`bash
 pnpm install${options.prisma
         ? `
-# point ${envPrefix(options.name)}_DATABASE_URL at a PostgreSQL database (.env.example), then
-pnpm db:migrate # create the tables${options.tenancy ? ` (runs the seed too)` : ''}`
+# start PostgreSQL — .env points ${envPrefix(options.name)}_DATABASE_URL at localhost:5432 — then
+pnpm db:migrate # create the tables${options.tenancy ? `
+pnpm db:seed    # the 'demo' tenant the resolvers expect` : ''}`
         : ''}
 pnpm dev        # API on http://localhost:3000
 pnpm test
@@ -962,11 +1075,11 @@ the models this app needs — the reference models of the \`@basaltkit/*-prisma\
 packages it uses, plus your own \`Project\` at the end.
 
 \`\`\`bash
-pnpm db:migrate     # prisma migrate dev  — change the schema, write a migration${options.tenancy
+pnpm db:migrate --name <change>  # prisma migrate dev — writes AND applies a migration (asks for a name without --name)${options.tenancy
             ? `
-pnpm db:seed        # the 'demo' tenant the resolvers expect (also run by db:migrate)`
+pnpm db:seed        # prisma db seed — the 'demo' tenant the resolvers expect`
             : ''}
-pnpm db:generate    # prisma generate — refresh src/generated/prisma (also runs on install)
+pnpm db:generate    # prisma generate — refresh generated/prisma after a schema change (also runs on install; migrate dev does not)
 pnpm db:deploy      # prisma migrate deploy — apply pending migrations in production
 \`\`\`
 
@@ -1005,16 +1118,18 @@ scaffold with \`--cli\` — \`pnpm basalt prisma:sync\` does the merge for you.)
         : ''}
 ## Environment
 
-\`src/env.ts\` validates \`process.env\` — nothing loads \`.env\` for you. Copy
-\`.env.example\` to \`.env\` and launch with \`--env-file=.env\` (Node/tsx), or
-export the variables.
+\`src/env.ts\` validates \`process.env\`. For development, ${options.cli ? '`pnpm dev` and `pnpm basalt` load' : '`pnpm dev` loads'} \`.env\`
+automatically — create-basalt wrote one for you: git-ignored, with local
+values${options.auth ? ' and a generated secret' : ''}. \`.env.example\` is its committed template.
+\`pnpm start\` (production, \`${PRODUCTION_ENTRY}\`) loads **nothing**: there the
+variables come from the real environment (or \`node --env-file=.env\`).
 
 The variables are **app-prefixed**: \`${envPrefix(options.name)}_PORT\`,
 \`${envPrefix(options.name)}_HOST\`, \`${envPrefix(options.name)}_LOG_LEVEL\`${options.auth ? `, \`${envPrefix(options.name)}_APP_SECRET\`` : ''}${options.prisma ? `, \`${envPrefix(options.name)}_DATABASE_URL\`` : ''}. \`NODE_ENV\` is never prefixed.
 
-Why: **\`--env-file\` never overrides a variable that is already exported.** In a
-shell where another project exported \`DATABASE_URL\` (or \`PORT\`), an app reading
-the generic name boots against THAT value and only fails on the first request
+Why: **loading \`.env\` (like \`--env-file\`) never overrides a variable that is
+already exported.** In a shell where another project exported \`DATABASE_URL\`
+(or \`PORT\`), an app reading the generic name boots against THAT value and only fails on the first request
 that touches it. \`src/env.ts\` therefore passes \`prefix: '${envPrefix(options.name)}'\` to
 \`defineEnv\`: each variable is read as \`${envPrefix(options.name)}_<NAME>\` first and
 **falls back** to the bare \`<NAME>\`, so a deployment that already exports the
@@ -1030,6 +1145,24 @@ To drop the fallback entirely (prefixed names only), write
 \`prefix: { value: '${envPrefix(options.name)}', fallback: false }\`. When in doubt about what
 your shell exports: \`env | grep DATABASE_URL\`.
 
+## Build & ship
+
+\`\`\`bash
+pnpm build          # tsc -p tsconfig.build.json → dist/ (src only)
+pnpm start          # node --enable-source-maps ${PRODUCTION_ENTRY} — no tsx at runtime
+pnpm start:dev      # the server from source with tsx, without building
+docker build -t ${options.name} .   # the Dockerfile: build stage + plain-node runtime
+\`\`\`
+
+\`pnpm start\` runs the compiled server, so build first. The \`Dockerfile\` (also
+what \`basalt publish dockerfile\` writes) installs, ${options.prisma ? 'generates the Prisma client, ' : ''}builds, drops the
+devDependencies and runs ${PRODUCTION_ENTRY} as the \`node\` user, with a
+\`HEALTHCHECK\` on \`/health\`. Pass the configuration as environment variables${options.prisma ? ', and apply migrations (\`pnpm db:deploy\`) before rolling out — the image does not run them' : ''}.${options.prisma
+        ? ` The Prisma client is generated into \`generated/prisma\` (outside \`src/\`) and
+imported as \`#db/client.js\` through the package.json \`imports\` alias, so the same
+import works under tsx and from \`dist/\`.`
+        : ''}
+
 ## Keeping it up to date
 
 \`\`\`bash
@@ -1139,20 +1272,7 @@ export function mcpJson(_options) {
  * `certs/server.key` through.
  */
 export function dockerignore() {
-    return `**/.env
-**/.env.*
-!**/.env.example
-**/.npmrc
-**/.git
-**/node_modules
-**/coverage
-**/*.log
-**/*.pem
-**/*.key
-**/*.p12
-**/*.pfx
-**/.DS_Store
-`;
+    return DOCKERIGNORE;
 }
 export function gitignore(options) {
     return `node_modules/
@@ -1163,12 +1283,14 @@ dist/
 *.log
 ${options.prisma
         ? `# Generated by \`prisma generate\` (runs on install) — never edit or commit it.
-src/generated/
+generated/
 `
         : ''}`;
 }
 /**
- * pnpm settings: esbuild's build script is required by tsx;
+ * pnpm settings: esbuild's build script is required by tsx; with --prisma,
+ * the Prisma CLI's build scripts (prisma, @prisma/engines) are approved too — pnpm 11 fails
+ * the install on an unapproved build;
  * msgpackr-extract (optional native accelerator via BullMQ) is declined —
  * msgpackr falls back to pure JS. With --ui, `web` is a workspace member so
  * its own dependencies resolve.
@@ -1186,7 +1308,13 @@ export function pnpmWorkspaceYaml(options) {
 `
         : ''}allowBuilds:
   esbuild: true
-  msgpackr-extract: false
+  msgpackr-extract: false${options.prisma
+        ? `
+  # The Prisma CLI's install scripts fetch its engines; pnpm 11 refuses to finish
+  # an install (ERR_PNPM_IGNORED_BUILDS) while a dependency's build is unapproved.
+  '@prisma/engines': true
+  prisma: true`
+        : ''}
 # @basaltkit/* releases in lockstep, often within hours — exclude the scope (and
 # create-basalt, which serves \`pnpm basalt update\`) from pnpm's minimumReleaseAge
 # policy so an update is never blocked on a fresh release.

package/dist/versions.js

@@ -4,26 +4,26 @@
 export const SCAFFOLD_VERSIONS = {
     '@basaltkit/admin': '^2.0.0',
     '@basaltkit/admin-shadcn': '^1.1.0',
-    '@basaltkit/ai-mcp': '^0.3.0',
-    '@basaltkit/auth': '^4.1.0',
-    '@basaltkit/auth-prisma': '^2.0.0',
-    '@basaltkit/cli': '^1.3.0',
+    '@basaltkit/ai-mcp': '^0.4.0',
+    '@basaltkit/auth': '^4.2.0',
+    '@basaltkit/auth-prisma': '^2.1.0',
+    '@basaltkit/cli': '^1.4.0',
     '@basaltkit/config': '^1.1.0',
-    '@basaltkit/core': '^1.5.0',
+    '@basaltkit/core': '^1.6.0',
     '@basaltkit/env': '^3.1.0',
     '@basaltkit/events': '^1.3.0',
-    '@basaltkit/fastify': '^2.5.0',
-    '@basaltkit/generator': '^1.5.0',
+    '@basaltkit/fastify': '^2.6.0',
+    '@basaltkit/generator': '^1.6.0',
     '@basaltkit/logger': '^1.3.0',
-    '@basaltkit/mcp': '^5.0.0',
-    '@basaltkit/prisma': '^3.0.0',
+    '@basaltkit/mcp': '^5.1.0',
+    '@basaltkit/prisma': '^3.1.0',
     '@basaltkit/sdk': '^2.1.0',
     '@basaltkit/subscriptions': '^5.0.0',
     '@basaltkit/subscriptions-prisma': '^3.0.0',
-    '@basaltkit/teams': '^4.0.0',
+    '@basaltkit/teams': '^4.1.0',
     '@basaltkit/teams-prisma': '^1.1.0',
-    '@basaltkit/tenancy': '^3.1.0',
-    '@basaltkit/tenancy-prisma': '^2.0.0',
+    '@basaltkit/tenancy': '^3.2.0',
+    '@basaltkit/tenancy-prisma': '^2.1.0',
     '@basaltkit/testing': '^2.0.0',
-    'create-basalt': '^1.10.0',
+    'create-basalt': '^1.12.0',
 };

package/dist/wizard.js

@@ -11,9 +11,9 @@ export const FEATURES = [
 ];
 export const PRESETS = [
     { value: 'saas', label: 'SaaS starter', hint: 'tenancy + auth + billing + database + CLI', features: ['tenancy', 'auth', 'billing', 'prisma', 'cli'] },
-    { value: 'api', label: 'API only', hint: 'auth + MCP, no tenancy or UI', features: ['auth', 'mcp'] },
+    { value: 'api', label: 'API only', hint: 'auth + MCP + CLI, no tenancy or UI', features: ['auth', 'mcp', 'cli'] },
     { value: 'full', label: 'Full stack', hint: 'everything + web UI', features: ['tenancy', 'auth', 'billing', 'prisma', 'ui', 'cli', 'mcp'] },
-    { value: 'minimal', label: 'Minimal', hint: 'no batteries, add them later', features: [] },
+    { value: 'minimal', label: 'Minimal', hint: 'just the CLI, add the rest later', features: ['cli'] },
     { value: 'custom', label: 'Custom', hint: 'pick features yourself', features: null },
 ];
 const PACKAGE_MANAGERS = [
@@ -59,7 +59,7 @@ export async function runWizard(prompter, options = {}) {
         (await prompter.multiselect({
             message: 'Select features',
             choices: FEATURES,
-            initial: ['tenancy', 'auth'],
+            initial: ['tenancy', 'auth', 'cli'],
         })));
     let pm = await prompter.select({
         message: 'Package manager',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -23,33 +23,35 @@
   "devDependencies": {
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",
+    "@prisma/client-runtime-utils": "^7.10.0",
     "@types/node": "^26.6.1",
     "@types/pg": "^8.23.1",
     "pg": "^8.23.0",
     "prisma": "^7.10.0",
+    "tsx": "^4.23.13",
     "typescript": "^7.0.2",
     "vitest": "^5.0.1",
     "zod": "^4.6.5",
-    "@basaltkit/core": "^1.5.0",
+    "@basaltkit/auth": "^4.2.0",
+    "@basaltkit/auth-prisma": "^2.1.0",
+    "@basaltkit/cli": "^1.4.0",
+    "@basaltkit/core": "^1.6.0",
     "@basaltkit/events": "^1.3.0",
-    "@basaltkit/env": "^3.1.1",
-    "@basaltkit/fastify": "^2.5.0",
-    "@basaltkit/auth": "^4.1.0",
-    "@basaltkit/auth-prisma": "^2.0.0",
+    "@basaltkit/fastify": "^2.6.0",
+    "@basaltkit/config": "^1.1.2",
+    "@basaltkit/generator": "^1.6.0",
     "@basaltkit/logger": "^1.3.0",
-    "@basaltkit/mcp": "^5.0.0",
-    "@basaltkit/prisma": "^3.0.0",
+    "@basaltkit/env": "^3.1.1",
+    "@basaltkit/mcp": "^5.1.0",
+    "@basaltkit/prisma": "^3.1.0",
+    "@basaltkit/subscriptions": "^5.0.0",
     "@basaltkit/subscriptions-prisma": "^3.0.0",
-    "@basaltkit/teams": "^4.0.0",
-    "@basaltkit/generator": "^1.5.0",
-    "@basaltkit/cli": "^1.3.0",
-    "@basaltkit/tenancy": "^3.1.0",
+    "@basaltkit/teams": "^4.1.0",
+    "@basaltkit/tenancy": "^3.2.0",
     "@basaltkit/teams-prisma": "^1.1.0",
-    "@basaltkit/tenancy-prisma": "^2.0.0",
-    "@basaltkit/testing": "^2.0.3",
-    "@basaltkit/subscriptions": "^5.0.0",
+    "@basaltkit/tenancy-prisma": "^2.1.0",
     "@basaltkit/tsconfig": "^0.24.0",
-    "@basaltkit/config": "^1.1.2"
+    "@basaltkit/testing": "^2.0.3"
   },
   "publishConfig": {
     "access": "public"
@@ -71,8 +73,9 @@
     "boilerplate"
   ],
   "scripts": {
-    "build": "node scripts/sync-versions.mjs && tsc -p tsconfig.build.json",
+    "build": "node scripts/sync-versions.mjs && node scripts/sync-stubs.mjs && tsc -p tsconfig.build.json",
     "sync-versions": "node scripts/sync-versions.mjs",
+    "sync-stubs": "node scripts/sync-stubs.mjs",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }