create-basalt 1.2.1 → 1.3.0

package/dist/templates.d.ts

@@ -0,0 +1,38 @@
+export interface ProjectOptions {
+    name: string;
+    tenancy: boolean;
+    auth: boolean;
+    billing: boolean;
+    /** Scaffold a web/ frontend (React + shadcn + SDK). */
+    ui: boolean;
+    /** Scaffold the `basalt` CLI entrypoint (code generators + built-in commands). */
+    cli: boolean;
+    /** Expose opted-in routes as MCP tools (@basaltkit/mcp) over HTTP at `/mcp`. */
+    mcp: boolean;
+}
+/** The dependency range for a @basalt package (override, else the base line). */
+export declare const versionOf: (pkg: string) => string;
+export declare function packageJson(options: ProjectOptions): string;
+export declare function tsconfigJson(): string;
+export declare function envTs(options: ProjectOptions): string;
+export declare function envExample(options: ProjectOptions): string;
+export declare function appTs(options: ProjectOptions): string;
+export declare function routesTs(options: ProjectOptions): string;
+export declare function serverTs(): string;
+export declare function basaltBin(): string;
+export declare function appTest(options: ProjectOptions): string;
+export declare function readme(options: ProjectOptions): string;
+/**
+ * A Claude Code / generic MCP client config that registers the dev-only
+ * `basalt-ai-mcp` bridge for this project. Claude Code reads `.mcp.json` at the
+ * project root automatically; Claude Desktop uses the same server entry.
+ */
+export declare function mcpJson(_options: ProjectOptions): string;
+export declare function gitignore(): string;
+/**
+ * pnpm settings: esbuild's build script is required by tsx;
+ * msgpackr-extract (optional native accelerator via BullMQ) is declined —
+ * msgpackr falls back to pure JS. With --ui, `web` is a workspace member so
+ * its own dependencies resolve.
+ */
+export declare function pnpmWorkspaceYaml(options: ProjectOptions): string;

package/dist/templates.js

@@ -0,0 +1,461 @@
+/** Base release line for @basaltkit/* deps. */
+const BASALT_VERSION = '^1.0.0';
+/**
+ * Per-package range overrides. In semver 0.x, `^0.4.0` locks the minor, so a
+ * package that advances past the base line needs its own range or a fresh app
+ * can't install it. Add an entry when a package crosses a minor.
+ */
+const VERSIONS = {
+    // ai-mcp is on the 0.x line (published separately from the 1.x framework base).
+    '@basaltkit/ai-mcp': '^0.1.0',
+};
+/** The dependency range for a @basalt package (override, else the base line). */
+export const versionOf = (pkg) => VERSIONS[pkg] ?? BASALT_VERSION;
+export function packageJson(options) {
+    const dependencies = {
+        '@basaltkit/config': BASALT_VERSION,
+        '@basaltkit/core': BASALT_VERSION,
+        '@basaltkit/env': BASALT_VERSION,
+        '@basaltkit/events': BASALT_VERSION,
+        '@basaltkit/fastify': BASALT_VERSION,
+        '@basaltkit/logger': BASALT_VERSION,
+        zod: '^4.0.0',
+    };
+    if (options.tenancy)
+        dependencies['@basaltkit/tenancy'] = BASALT_VERSION;
+    if (options.auth)
+        dependencies['@basaltkit/auth'] = BASALT_VERSION;
+    if (options.billing)
+        dependencies['@basaltkit/subscriptions'] = BASALT_VERSION;
+    if (options.mcp)
+        dependencies['@basaltkit/mcp'] = BASALT_VERSION;
+    if (options.cli) {
+        // Runtime deps: app.ts uses commandsPlugin (@basaltkit/cli); prisma powers
+        // prismaPlugin + `basalt prisma:sync`. @basaltkit/generator is dev-only (below).
+        dependencies['@basaltkit/cli'] = BASALT_VERSION;
+        dependencies['@basaltkit/prisma'] = BASALT_VERSION;
+    }
+    // Apply per-package range overrides. Only @basaltkit/* packages: versionOf
+    // falls back to BASALT_VERSION, which would clobber third-party ranges
+    // (this once rewrote zod's range to the @basalt base line).
+    for (const pkg of Object.keys(dependencies)) {
+        if (pkg.startsWith('@basaltkit/'))
+            dependencies[pkg] = versionOf(pkg);
+    }
+    const devDependencies = {
+        '@basaltkit/testing': versionOf('@basaltkit/testing'),
+        '@types/node': '^22.15.0',
+        'pino-pretty': '^13.0.0',
+        tsx: '^4.19.0',
+        typescript: '^5.8.0',
+        vitest: '^3.1.0',
+    };
+    if (options.cli) {
+        // Dev-only: only bin/basalt.ts imports the code generator — the runtime server
+        // never does, so the app runs completely without the codegen/AI layer.
+        devDependencies['@basaltkit/generator'] = versionOf('@basaltkit/generator');
+    }
+    if (options.mcp) {
+        // Dev-only AI bridge: exposes analyze/plan/make to MCP clients (Claude
+        // Code/Desktop) via the `basalt-ai-mcp` bin. NEVER a runtime dependency — the
+        // app ships and runs without it (see `.mcp.json` for the client config).
+        devDependencies['@basaltkit/ai-mcp'] = versionOf('@basaltkit/ai-mcp');
+    }
+    return `${JSON.stringify({
+        name: options.name,
+        version: '0.1.0',
+        private: true,
+        type: 'module',
+        scripts: {
+            dev: 'tsx watch src/server.ts',
+            start: 'tsx src/server.ts',
+            test: 'vitest run',
+            typecheck: 'tsc --noEmit',
+            ...(options.cli ? { basalt: 'tsx bin/basalt.ts' } : {}),
+        },
+        dependencies: Object.fromEntries(Object.entries(dependencies).sort()),
+        devDependencies: Object.fromEntries(Object.entries(devDependencies).sort()),
+    }, null, 2)}\n`;
+}
+export function tsconfigJson() {
+    return `${JSON.stringify({
+        compilerOptions: {
+            target: 'ES2022',
+            module: 'NodeNext',
+            moduleResolution: 'NodeNext',
+            strict: true,
+            noUncheckedIndexedAccess: true,
+            verbatimModuleSyntax: true,
+            skipLibCheck: true,
+            noEmit: true,
+            types: ['node'],
+        },
+        include: ['src', 'tests'],
+    }, null, 2)}\n`;
+}
+export function envTs(options) {
+    return `import { defineEnv${options.auth ? ', secret' : ''} } from '@basaltkit/env'
+import { z } from 'zod'
+
+export const env = defineEnv({
+  PORT: z.coerce.number().default(3000),
+  HOST: z.string().default('0.0.0.0'),
+  LOG_LEVEL: z.string().default('info'),
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),${options.auth
+        ? `
+  // Signs JWTs and sessions. secret() is fail-closed: required in production
+  // (no fallback), rejected if it looks like a placeholder. Dev uses devDefault.
+  APP_SECRET: secret({ minLength: 32, devDefault: 'dev-only-insecure-secret-please-change-me' }),`
+        : ''}
+})
+`;
+}
+export function envExample(options) {
+    return `PORT=3000
+HOST=0.0.0.0
+LOG_LEVEL=info
+NODE_ENV=development
+${options.auth ? '# Required in production (the app refuses to boot without it).\n# Generate a strong one:  openssl rand -base64 48\n# APP_SECRET=\n' : ''}`;
+}
+export function appTs(options) {
+    const imports = [
+        `import { createApp } from '@basaltkit/core'`,
+        `import { configPlugin } from '@basaltkit/config'`,
+        `import { eventsPlugin } from '@basaltkit/events'`,
+        `import { fastifyPlugin, securityPlugin } from '@basaltkit/fastify'`,
+        `import { loggerPlugin } from '@basaltkit/logger'`,
+    ];
+    const plugins = [
+        `configPlugin({ app: { name: '${options.name}' } })`,
+        `loggerPlugin({ level: options.logLevel ?? 'info', ...(options.pretty ? { pretty: true } : {}) })`,
+        `eventsPlugin()`,
+        `securityPlugin({
+      // Secure response headers (HSTS, X-Frame-Options, nosniff, …) are on by
+      // default. Turn on rate limiting and a CORS allow-list for production:
+      // rateLimit: { limit: 120, windowMs: 60_000 },
+      // cors: { origin: ['https://app.example.com'], credentials: true },
+    })`,
+    ];
+    let routesExpression = 'appRoutes';
+    if (options.tenancy) {
+        imports.push(`import { headerResolver, MemoryTenantSource, subdomainResolver, tenancyPlugin } from '@basaltkit/tenancy'`);
+        plugins.push(`tenancyPlugin({
+      // Replace MemoryTenantSource with your database-backed source.
+      source: new MemoryTenantSource().add({ id: 'demo', name: 'Demo Tenant' }),
+      resolvers: [headerResolver(), subdomainResolver({ base: 'localhost' })],
+    })`);
+    }
+    if (options.auth) {
+        imports.push(`import { authPlugin, authRoutes, mfaRoutes, MemoryUserSource } from '@basaltkit/auth'`);
+        imports.push(`import { env } from './env.js'`);
+        plugins.push(`authPlugin({
+      // Replace MemoryUserSource with your database-backed source (e.g.
+      // @basaltkit/auth-sqlite or @basaltkit/auth-prisma). The default in-memory
+      // MFA store is enough for the ready-made TOTP flow below.
+      users: new MemoryUserSource(),
+      secret: env.APP_SECRET,
+    })`);
+        // authRoutes(): register, login, logout, refresh, me, email verification and
+        // password recovery. mfaRoutes(): TOTP enroll/activate/status/disable.
+        routesExpression = '[...appRoutes, ...authRoutes(), ...mfaRoutes()]';
+    }
+    if (options.billing) {
+        imports.push(`import { definePlans, subscriptionsPlugin } from '@basaltkit/subscriptions'`);
+        plugins.push(`subscriptionsPlugin({
+      plans: definePlans({
+        free: { price: 0, features: { projects: 3 } },
+        pro: { price: { monthly: 29, yearly: 290 }, trial: '14d', features: { projects: 50 } },
+      }),
+      fallbackPlan: 'free',
+    })`);
+    }
+    if (options.cli) {
+        // Only the commandsPlugin lives here. The dev tools (@basaltkit/generator, and
+        // @basaltkit/ai if installed) are imported ONLY by bin/basalt.ts and passed via
+        // \`options.commands\`, so the runtime server never imports them — the SaaS runs
+        // completely without the AI/codegen layer. Built-ins (routes, schedule:list) come free.
+        imports.push(`import { commandsPlugin, type CommandDefinition } from '@basaltkit/cli'`);
+        plugins.push(`...(options.commands && options.commands.length > 0 ? [commandsPlugin(options.commands)] : [])`);
+    }
+    let adapterRoutesExpr = routesExpression;
+    if (options.mcp) {
+        imports.push(`import { mcpPlugin, mcpRoutes } from '@basaltkit/mcp'`);
+        // The MCP server scans the SAME app routes for `meta.mcp` (see routes.ts); the
+        // `/mcp` transport is added to the adapter so agents POST JSON-RPC to it. Tool
+        // calls run through the neutral pipeline, so tenancy/auth apply unchanged.
+        plugins.push(`mcpPlugin({ routes: ${routesExpression}, serverInfo: { name: '${options.name}', version: '0.1.0' } })`);
+        adapterRoutesExpr =
+            routesExpression === 'appRoutes'
+                ? '[...appRoutes, ...mcpRoutes()]'
+                : routesExpression.replace(/]$/, ', ...mcpRoutes()]');
+    }
+    plugins.push(`fastifyPlugin({ routes: ${adapterRoutesExpr} })`);
+    const commandsField = options.cli
+        ? `\n  /** Dev/CLI commands (make:*, ai:*, prisma:sync) — passed ONLY by bin/basalt.ts. */\n  commands?: CommandDefinition[]`
+        : '';
+    return `${imports.join('\n')}
+import { appRoutes } from './routes.js'
+
+export interface BuildAppOptions {
+  logLevel?: string
+  pretty?: boolean${commandsField}
+}
+
+export function buildApp(options: BuildAppOptions = {}) {
+  return createApp({
+    plugins: [
+      ${plugins.join(',\n      ')},
+    ],
+  })
+}
+`;
+}
+export function routesTs(options) {
+    const endpoints = [
+        "'GET /'",
+        "'GET /health'",
+        ...(options.auth
+            ? [
+                "'POST /auth/register'",
+                "'POST /auth/login'",
+                "'POST /auth/refresh'",
+                "'POST /auth/logout'",
+                "'GET /auth/me'",
+            ]
+            : []),
+    ];
+    // Opt these read-only routes in as MCP tools when MCP is enabled. Only safe,
+    // non-mutating endpoints are exposed — auth routes are deliberately left out.
+    const overviewMeta = options.mcp
+        ? `\n    meta: { mcp: { name: 'overview', description: 'List what this API exposes: name, status and available endpoints.' } },`
+        : '';
+    const healthMeta = options.mcp
+        ? `\n    meta: { mcp: { name: 'health', description: 'Liveness check — returns ok and the current request id.' } },`
+        : '';
+    return `import { ctx } from '@basaltkit/core'
+import { route } from '@basaltkit/fastify'
+
+export const appRoutes = [
+  // Friendly index so \`GET /\` is never a bare 404 — lists what the API exposes.
+  route({
+    method: 'GET',
+    url: '/',${overviewMeta}
+    async handler() {
+      return {
+        name: '${options.name}',
+        status: 'ok',
+        endpoints: [${endpoints.join(', ')}],
+      }
+    },
+  }),
+  route({
+    method: 'GET',
+    url: '/health',${healthMeta}
+    async handler() {
+      return { ok: true, requestId: ctx().requestId${options.tenancy ? ', tenant: ctx().tenant?.id ?? null' : ''} }
+    },
+  }),
+]
+`;
+}
+export function serverTs() {
+    return `import { FASTIFY } from '@basaltkit/fastify'
+import { buildApp } from './app.js'
+import { env } from './env.js'
+
+const app = await buildApp({
+  logLevel: env.LOG_LEVEL,
+  pretty: env.NODE_ENV === 'development',
+}).boot()
+
+const server = app.container.get(FASTIFY)
+await server.listen({ port: env.PORT, host: env.HOST })
+console.log('ready at http://' + env.HOST + ':' + env.PORT)
+
+for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+  process.once(signal, async () => {
+    await app.shutdown()
+    process.exit(0)
+  })
+}
+`;
+}
+export function basaltBin() {
+    return `#!/usr/bin/env node
+import { runCli } from '@basaltkit/cli'
+import { generatorCommands } from '@basaltkit/generator'
+import { prismaSyncCommand } from '@basaltkit/prisma'
+import { buildApp } from '../src/app.js'
+
+// The 'basalt' CLI: boots the app WITH the dev/CLI commands, runs one, shuts down.
+// The dev tools (@basaltkit/generator; add @basaltkit/ai for ai:*) are imported
+// ONLY here — the runtime server (src/server.ts) never loads them, so the SaaS
+// runs without the codegen/AI layer.
+//   pnpm basalt dev                     — dev server: route table + watch (--worker for a queue worker)
+//   pnpm basalt list                    — show available commands
+//   pnpm basalt routes                  — list registered HTTP routes
+//   pnpm basalt make:resource Project   — generate a full resource vertical
+//   pnpm basalt make:service Project    — generate a single artifact (schema/service/…)
+const app = buildApp({
+  logLevel: 'silent',
+  commands: [...generatorCommands(), prismaSyncCommand()],
+})
+process.exit(await runCli({ app }))
+`;
+}
+export function appTest(options) {
+    return `import { describe, expect, it } from 'vitest'
+import { FASTIFY } from '@basaltkit/fastify'
+import { buildApp } from '../src/app.js'
+
+describe('app', () => {
+  it('boots and responds on /health', async () => {
+    const app = await buildApp({ logLevel: 'silent' }).boot()
+    const server = app.container.get(FASTIFY)
+
+    const index = await server.inject({ method: 'GET', url: '/' })
+    expect(index.statusCode).toBe(200)
+    expect(index.json().name).toBe('${options.name}')
+
+    const response = await server.inject({ method: 'GET', url: '/health' })
+    expect(response.statusCode).toBe(200)
+    expect(response.json().ok).toBe(true)${options.tenancy
+        ? `
+
+    const tenant = await server.inject({
+      method: 'GET',
+      url: '/health',
+      headers: { 'x-tenant-id': 'demo' },
+    })
+    expect(tenant.json().tenant).toBe('demo')`
+        : ''}
+    await app.shutdown()
+  })
+})
+`;
+}
+export function readme(options) {
+    const features = [
+        'typed routes with Zod validation',
+        'structured logging with request/tenant context',
+        'typed domain events',
+        ...(options.tenancy ? ['multi-tenancy (header + subdomain resolvers)'] : []),
+        ...(options.auth ? ['authentication (register/login/refresh/me)'] : []),
+        ...(options.billing ? ['subscriptions with plans and feature limits'] : []),
+        ...(options.ui ? ['web UI (React + shadcn/ui on @basaltkit/admin-shadcn + @basaltkit/sdk)'] : []),
+        ...(options.cli ? ['`basalt` CLI with code generators (`make:*`) and built-in commands'] : []),
+        ...(options.mcp ? ['MCP server — read-only routes exposed as AI-agent tools at `/mcp`'] : []),
+    ];
+    return `# ${options.name}
+
+A SaaS app scaffolded with [Basalt](https://github.com/basaltkit/basalt).
+
+Included: ${features.join(' · ')}.
+
+## Getting started
+
+\`\`\`bash
+pnpm install
+pnpm dev        # API on http://localhost:3000
+pnpm test
+\`\`\`
+${options.cli
+        ? `
+## The \`basalt\` CLI
+
+\`\`\`bash
+pnpm basalt list                    # available commands
+pnpm basalt routes                  # registered HTTP routes
+pnpm basalt make:resource Project   # schema → repository → service → plugin → routes → test
+pnpm basalt make:service Project    # a single artifact (--force to overwrite)
+\`\`\`
+
+Generated resources land in \`src/modules/<name>/\`. Register the generated
+plugin in \`src/app.ts\` to wire it up.
+`
+        : ''}${options.ui
+        ? `
+## Web UI
+
+\`\`\`bash
+pnpm dev                       # terminal 1 — API on :3000
+pnpm --filter ${options.name}-web dev   # terminal 2 — UI on http://localhost:5180
+\`\`\`
+
+Open <http://localhost:5180>. The Vite dev server proxies \`/api\` to the API,
+so there is no CORS to configure${options.auth ? '. Register, then sign in' : ''}.
+`
+        : ''}${options.mcp
+        ? `
+## MCP server
+
+Read-only routes marked with \`meta.mcp\` in \`src/routes.ts\` (the overview and
+health endpoints) are exposed as [Model Context Protocol](https://modelcontextprotocol.io)
+tools over HTTP at \`POST /mcp\`. Point any MCP client at it:
+
+\`\`\`bash
+# list the tools
+curl -s localhost:3000/mcp -H 'content-type: application/json' \\
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
+\`\`\`
+
+Tool calls run through the same neutral pipeline as HTTP, so validation, tenancy
+and auth apply unchanged. Add \`meta: { mcp: true }\` to any route to expose it —
+keep mutations and auth flows off unless an agent should really call them.
+
+### AI dev tools
+
+This project is also wired for AI-assisted development. \`.mcp.json\` registers the
+**dev-only** \`basalt-ai-mcp\` bridge (a \`devDependency\` — never shipped in your
+app's runtime) with MCP clients such as Claude Code and Claude Desktop. It exposes
+\`basalt_analyze\`, \`basalt_doctor\`, \`basalt_plan\`, \`basalt_review\` and
+\`basalt_make\` (preview by default, writes confined to this project) plus workflow
+prompts. Claude Code picks up \`.mcp.json\` automatically; for Claude Desktop add the
+same server to its config with \`--cwd=<absolute project path>\`.
+`
+        : ''}`;
+}
+/**
+ * A Claude Code / generic MCP client config that registers the dev-only
+ * `basalt-ai-mcp` bridge for this project. Claude Code reads `.mcp.json` at the
+ * project root automatically; Claude Desktop uses the same server entry.
+ */
+export function mcpJson(_options) {
+    return `${JSON.stringify({
+        mcpServers: {
+            'basalt-ai': {
+                command: 'npx',
+                args: ['-y', '@basaltkit/ai-mcp', '--cwd=.'],
+            },
+        },
+    }, null, 2)}\n`;
+}
+export function gitignore() {
+    return `node_modules/
+dist/
+.env
+.env.*
+!.env.example
+*.log
+`;
+}
+/**
+ * pnpm settings: esbuild's build script is required by tsx;
+ * msgpackr-extract (optional native accelerator via BullMQ) is declined —
+ * msgpackr falls back to pure JS. With --ui, `web` is a workspace member so
+ * its own dependencies resolve.
+ */
+export function pnpmWorkspaceYaml(options) {
+    return `${options.ui
+        ? `packages:
+  - web
+`
+        : ''}allowBuilds:
+  esbuild: true
+  msgpackr-extract: false
+# @basaltkit/* releases in lockstep, often within hours — exclude the scope from
+# pnpm's minimumReleaseAge policy so \`pnpm up\` is never blocked on a fresh release.
+minimumReleaseAgeExclude:
+  - '@basaltkit/*'
+`;
+}

package/dist/wizard.d.ts

@@ -0,0 +1,40 @@
+import type { PackageManager } from './index.js';
+import { type Choice, type Prompter } from './prompt.js';
+export type FeatureKey = 'tenancy' | 'auth' | 'billing' | 'ui' | 'cli' | 'mcp';
+/** The feature toggles offered in the "custom" preset (and shown in the summary). */
+export declare const FEATURES: Choice<FeatureKey>[];
+interface Preset {
+    value: string;
+    label: string;
+    hint: string;
+    /** null → let the user pick features (custom). */
+    features: FeatureKey[] | null;
+}
+export declare const PRESETS: Preset[];
+/** Validates a project name as an npm-installable package name. */
+export declare function validateProjectName(name: string): string | undefined;
+export interface WizardResult {
+    name: string;
+    tenancy: boolean;
+    auth: boolean;
+    billing: boolean;
+    ui: boolean;
+    cli: boolean;
+    mcp: boolean;
+    pm: PackageManager;
+    install: boolean;
+    git: boolean;
+}
+export interface WizardOptions {
+    /** Pre-filled name (from argv) — skips the name prompt when valid. */
+    name?: string;
+    /** Detected package manager, used as the default selection. */
+    defaultPm?: PackageManager;
+}
+/**
+ * The interactive scaffolding flow. Pure with respect to I/O — it drives the
+ * injected {@link Prompter}, so tests script the answers and assert the result.
+ * Throws {@link WizardCancelledError} if the user declines the final confirm.
+ */
+export declare function runWizard(prompter: Prompter, options?: WizardOptions): Promise<WizardResult>;
+export {};

package/dist/wizard.js

@@ -0,0 +1,97 @@
+import { WizardCancelledError } from './prompt.js';
+/** The feature toggles offered in the "custom" preset (and shown in the summary). */
+export const FEATURES = [
+    { value: 'tenancy', label: 'Multi-tenancy', hint: 'per-tenant data isolation' },
+    { value: 'auth', label: 'Authentication', hint: 'JWT, sessions, MFA, OAuth' },
+    { value: 'billing', label: 'Subscriptions / billing', hint: 'Stripe, Paddle, Lemon Squeezy' },
+    { value: 'ui', label: 'Web UI', hint: 'React + shadcn + SDK (pnpm workspace)' },
+    { value: 'cli', label: 'basalt CLI', hint: 'code generators + commands' },
+    { value: 'mcp', label: 'MCP server', hint: 'expose routes as AI-agent tools (/mcp)' },
+];
+export const PRESETS = [
+    { value: 'saas', label: 'SaaS starter', hint: 'tenancy + auth + billing + CLI', features: ['tenancy', 'auth', 'billing', 'cli'] },
+    { value: 'api', label: 'API only', hint: 'auth + MCP, no tenancy or UI', features: ['auth', 'mcp'] },
+    { value: 'full', label: 'Full stack', hint: 'everything + web UI', features: ['tenancy', 'auth', 'billing', 'ui', 'cli', 'mcp'] },
+    { value: 'minimal', label: 'Minimal', hint: 'no batteries, add them later', features: [] },
+    { value: 'custom', label: 'Custom', hint: 'pick features yourself', features: null },
+];
+const PACKAGE_MANAGERS = [
+    { value: 'pnpm', label: 'pnpm', hint: 'recommended' },
+    { value: 'npm', label: 'npm' },
+    { value: 'yarn', label: 'yarn' },
+    { value: 'bun', label: 'bun' },
+];
+/** Validates a project name as an npm-installable package name. */
+export function validateProjectName(name) {
+    const trimmed = name.trim();
+    if (!trimmed)
+        return 'Please enter a project name.';
+    if (trimmed.length > 214)
+        return 'Name is too long (max 214 characters).';
+    if (!/^(?:@[a-z0-9-~][a-z0-9-*._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(trimmed)) {
+        return 'Use a valid npm package name (lowercase, no spaces).';
+    }
+    return undefined;
+}
+/**
+ * The interactive scaffolding flow. Pure with respect to I/O — it drives the
+ * injected {@link Prompter}, so tests script the answers and assert the result.
+ * Throws {@link WizardCancelledError} if the user declines the final confirm.
+ */
+export async function runWizard(prompter, options = {}) {
+    prompter.intro('create-basalt — scaffold a Basalt application');
+    const name = options.name && !validateProjectName(options.name)
+        ? options.name
+        : await prompter.text({
+            message: 'Project name',
+            placeholder: 'my-saas',
+            initial: 'my-saas',
+            validate: validateProjectName,
+        });
+    const presetValue = await prompter.select({
+        message: 'Choose a starting point',
+        choices: PRESETS.map((p) => ({ value: p.value, label: p.label, hint: p.hint })),
+        initial: 0,
+    });
+    const preset = PRESETS.find((p) => p.value === presetValue) ?? PRESETS[0];
+    const featureSet = new Set(preset.features ??
+        (await prompter.multiselect({
+            message: 'Select features',
+            choices: FEATURES,
+            initial: ['tenancy', 'auth'],
+        })));
+    let pm = await prompter.select({
+        message: 'Package manager',
+        choices: PACKAGE_MANAGERS,
+        initial: Math.max(0, PACKAGE_MANAGERS.findIndex((m) => m.value === (options.defaultPm ?? 'pnpm'))),
+    });
+    // The web/ frontend is a pnpm workspace member — force pnpm when UI is on.
+    if (featureSet.has('ui') && pm !== 'pnpm') {
+        prompter.note(`  Note: the Web UI is a pnpm workspace — using pnpm instead of ${pm}.`);
+        pm = 'pnpm';
+    }
+    const install = await prompter.confirm({ message: 'Install dependencies now?', initial: false });
+    const git = await prompter.confirm({ message: 'Initialize a git repository?', initial: false });
+    const enabled = FEATURES.filter((f) => featureSet.has(f.value)).map((f) => f.label);
+    prompter.note(`\n  Summary\n` +
+        `    name      ${name}\n` +
+        `    features  ${enabled.length ? enabled.join(', ') : '(none)'}\n` +
+        `    pm        ${pm}\n` +
+        `    install   ${install ? 'yes' : 'no'}\n` +
+        `    git       ${git ? 'yes' : 'no'}\n`);
+    const ok = await prompter.confirm({ message: 'Create project?', initial: true });
+    if (!ok)
+        throw new WizardCancelledError();
+    return {
+        name,
+        tenancy: featureSet.has('tenancy'),
+        auth: featureSet.has('auth'),
+        billing: featureSet.has('billing'),
+        ui: featureSet.has('ui'),
+        cli: featureSet.has('cli'),
+        mcp: featureSet.has('mcp'),
+        pm,
+        install,
+        git,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Scaffold a production-shaped Basalt SaaS app: npm create basalt my-saas [--billing] [--ui] [--cli] [--install] [--git]",
   "license": "MIT",
   "type": "module",
@@ -17,10 +17,9 @@
     "dist"
   ],
   "devDependencies": {
-    "@types/node": "^22.15.0",
-    "tsup": "^8.4.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0",
+    "@types/node": "^26.3.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {
@@ -28,11 +27,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Zebedeu/basalt.git",
+    "url": "git+https://github.com/basaltkit/basalt.git",
     "directory": "packages/create-app"
   },
-  "homepage": "https://github.com/Zebedeu/basalt/tree/main/packages/create-app#readme",
-  "bugs": "https://github.com/Zebedeu/basalt/issues",
+  "homepage": "https://github.com/basaltkit/basalt/tree/main/packages/create-app#readme",
+  "bugs": "https://github.com/basaltkit/basalt/issues",
   "keywords": [
     "basalt",
     "typescript",
@@ -43,7 +42,7 @@
     "boilerplate"
   ],
   "scripts": {
-    "build": "tsup src/index.ts src/cli.ts --format esm --dts --clean",
+    "build": "tsc -p tsconfig.build.json",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }