create-bcp-app 0.2.3 → 0.2.5

package/README.md

@@ -19,6 +19,7 @@ Generated npm scripts use `bcp` because npm places `node_modules/.bin` on the sc
   "scripts": {
     "dev": "bcp dev",
     "build": "bcp build",
+    "package": "bcp package",
     "start": "bcp start",
     "routes": "bcp routes",
     "generate": "bcp generate",
@@ -27,6 +28,16 @@ Generated npm scripts use `bcp` because npm places `node_modules/.bin` on the sc
 }
 ```
 
+When Tailwind CSS is selected, the generated packaging script preserves the production CSS step:
+
+```json
+{
+  "scripts": {
+    "package": "npm run css:build:prod && bcp package"
+  }
+}
+```
+
 For direct PowerShell usage, prefer the collision-free local alias:
 
 ```powershell
@@ -37,6 +48,7 @@ npm exec -- bcp-framework generate page dashboard/users
 npm exec -- bcp-framework routes
 npm exec -- bcp-framework dev
 npm exec -- bcp-framework build
+npm exec -- bcp-framework package
 ```
 
 Microsoft SQL Server can install another Windows executable named `bcp.exe`, so `bcp-framework` is the recommended interactive Windows command name.
@@ -65,7 +77,7 @@ Select storage provider:
 
 Equivalent non-interactive flags are available for CI/scaffolding automation.
 
-## Generated project metadata — 0.1.29
+## Generated project metadata
 
 New projects include:
 
@@ -80,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.1.29",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.5",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.1.29"
+    "version": "0.2.5"
   },
   "packageManager": "npm",
   "presets": {
@@ -95,22 +107,10 @@ Example:
 }
 ```
 
-This manifest records scaffold identity only. It is intended for:
-
-- `bcp doctor`,
-- `bcp inspect`,
-- upgrade/migration tooling,
-- project-aware documentation,
-- `bcp-docs-web` examples/tooling.
-
-It must not contain secrets. Never put database passwords, AWS/R2 credentials, JWT/session secrets or tokens in `bcp.project.json`.
+This manifest records scaffold identity only. It is intended for framework diagnostics, update/migration tooling and project-aware documentation. It must not contain secrets.
 
 The file should normally be committed to source control.
 
-Existing projects created before `0.1.29` remain valid without it.
-
-Read more: `docs/project-metadata.md` in the BCP Framework repository.
-
 ## Generated application defaults
 
 Generated applications include the project-root `@/` alias and TypeScript settings compatible with the BCP bundler.
@@ -135,12 +135,12 @@ npm exec -- bcp-framework update --check
 
 When Tailwind is enabled, the project includes:
 
-- `tailwindcss`,
-- `@tailwindcss/cli`,
-- `concurrently`,
-- `app/globals.css`,
-- `/bcp.css` stylesheet setup,
-- starter utility classes.
+- `tailwindcss`
+- `@tailwindcss/cli`
+- `concurrently`
+- `app/globals.css`
+- `/bcp.css` stylesheet setup
+- starter utility classes
 
 Generated commands include:
 
@@ -150,7 +150,7 @@ npm run css:watch
 npm run css:build:prod
 ```
 
-`npm run build` creates the production stylesheet before the BCP production build.
+`npm run build` and `npm run package` create the production stylesheet before the BCP production build/package flow.
 
 ## Database presets
 
@@ -162,7 +162,7 @@ The database choice adds starter configuration and the matching driver:
 - MongoDB: `mongodb`
 - None: no database dependency
 
-For **MySQL**, **PostgreSQL** and **SQLite**, generated `lib/database.ts` exposes the framework database primitives through `bcp/database`. Provider connections are managed behind the Database Platform v2 adapter layer instead of being created directly in the generated application.
+For **MySQL**, **PostgreSQL** and **SQLite**, generated `lib/database.ts` exposes the framework database primitives through `bcp/database`. Provider connections are managed behind Database Platform v2 instead of being created directly in generated application code.
 
 Generated MySQL environment variables:
 
@@ -200,13 +200,7 @@ The generator intentionally does not force an ORM.
 
 ## Storage providers
 
-Selecting a storage provider creates:
-
-```text
-lib/storage.ts
-```
-
-and adds provider-specific environment settings.
+Selecting a storage provider creates `lib/storage.ts` and adds provider-specific environment settings.
 
 ### Local Server
 
@@ -214,31 +208,12 @@ and adds provider-specific environment settings.
 npx create-bcp-app my-app --storage local
 ```
 
-Generated structure:
-
-```text
-lib/
-└─ storage.ts
-
-storage/
-├─ .gitkeep
-└─ README.md
-```
-
 Environment:
 
 ```dotenv
 STORAGE_LOCAL_DIRECTORY=./storage
 ```
 
-`.gitignore` keeps the visible scaffold while ignoring runtime objects:
-
-```gitignore
-storage/*
-!storage/.gitkeep
-!storage/README.md
-```
-
 The generated helper uses `createLocalStorage()`.
 
 ### Amazon S3
@@ -276,17 +251,8 @@ R2_SECRET_ACCESS_KEY=
 R2_PREFIX=
 ```
 
-The helper configures the S3-compatible adapter with:
-
-```text
-region: auto
-endpoint: https://<account-id>.r2.cloudflarestorage.com
-```
-
 Storage credentials are server-only. Do not expose them through `BCP_PUBLIC_*` variables.
 
-The storage preset is only an initial scaffold; application routes/services can later use another BCP adapter while keeping generic storage APIs.
-
 ## JWT Cookie authentication
 
 Selecting `JWT Cookie` creates:
@@ -309,11 +275,71 @@ BCP_SESSION_SECRET=
 
 Set this to a cryptographically random secret of at least 32 bytes before real authentication use.
 
-The generated `authenticateCredentials(email, password)` returns `null` until the application connects it to its own user store and password-hash verification. This prevents a fresh project from trusting unverified browser identity data.
+The generated `authenticateCredentials(email, password)` returns `null` until the application connects it to its own user store and password-hash verification.
 
-## Project generators after creation
+Generated auth stays in backward-compatible stateless JWT-cookie mode by default.
+
+BCP `0.2.5+` can opt into revocable server-side auth state without changing the generated auth route structure:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+const frameworkAuth =
+    createAuth<AuthenticatedUser>({
+        store:
+            sessionStore,
+        idleTimeout:
+            60 * 30,
+    });
+```
+
+The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
+
+Authentication Platform v2 also provides `logoutAll()`, session/user revocation APIs and `createGuestGuard()` for login/register pages.
+
+## Application Packaging — 0.2.4+
+
+Generated projects include:
+
+```bash
+npm run package
+```
+
+This runs the BCP `standalone-node` application packaging flow and writes:
+
+```text
+.bcp-framework/package/
+├─ client/
+├─ server/
+├─ public/                 # when present
+├─ package.json
+├─ package-lock.json       # when a safe production lock can be derived
+├─ bcp.package.json
+├─ bcp.deployment.json
+├─ bcp.env.json
+├─ Dockerfile
+└─ README.md
+```
 
-BCP `0.1.29+` can scaffold additional framework files after the project has been created:
+The deployment package excludes application `devDependencies` and project `.env` values. Supply real secrets through the deployment environment.
+
+For a package with a generated production lockfile:
+
+```bash
+cd .bcp-framework/package
+npm ci --omit=dev
+npm start
+```
+
+If the package manifest reports that no lockfile was included, use the install command recorded in `bcp.package.json`.
+
+## Project generators after creation
 
 ```bash
 npm run generate -- page dashboard/users
@@ -368,5 +394,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.3.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.5.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/src/index.mjs

@@ -98,6 +98,8 @@ export async function createBcpApp(
                 "bcp dev",
             build:
                 "bcp build",
+            package:
+                "bcp package",
             start:
                 "bcp start",
             routes:
@@ -147,6 +149,13 @@ export async function createBcpApp(
             storage,
         });
 
+    if (
+        selectedOptions.tailwind
+    ) {
+        packageJson.scripts.package =
+            "npm run css:build:prod && bcp package";
+    }
+
     configureFrameworkDatabaseEntry(
         targetDirectory,
         selectedOptions.database

package/template/README.md

@@ -20,11 +20,12 @@ npm run routes
 npm run generate -- page dashboard/users
 npm run typecheck
 npm run build
+npm run package
 npm start
 npm run update
 ```
 
-The generated scripts call commands such as `bcp dev`, `bcp generate`, `bcp build` and `bcp start`. npm automatically adds the project's `node_modules/.bin` directory to `PATH` while an npm script is running.
+The generated scripts call commands such as `bcp dev`, `bcp generate`, `bcp build`, `bcp package` and `bcp start`. npm automatically adds the project's `node_modules/.bin` directory to `PATH` while an npm script is running.
 
 ## Project metadata
 
@@ -38,9 +39,37 @@ It records non-secret scaffold choices such as Tailwind, database, authenticatio
 
 Commit this file with the project. Do not put passwords, access keys, session secrets or tokens in it.
 
+## Authentication — BCP 0.2.5+
+
+Projects created with the `JWT Cookie` preset remain stateless by default and use the generated `lib/auth.ts` helpers.
+
+BCP Authentication Platform v2 can opt into revocable server-side session state:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+export const appAuth =
+    createAuth({
+        store:
+            sessionStore,
+        idleTimeout:
+            60 * 30,
+    });
+```
+
+The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
+
+Authentication Platform v2 also provides session revocation, `logoutAll()`, rotation with revocation, and `createGuestGuard()` for guest-only pages such as login/register routes.
+
 ## Generate framework files
 
-BCP `0.1.29+` can generate common project files:
+BCP can generate common project files:
 
 ```bash
 npm run generate -- page dashboard/users
@@ -80,6 +109,7 @@ npm exec -- bcp-framework generate page dashboard/users
 npm exec -- bcp-framework routes
 npm exec -- bcp-framework dev
 npm exec -- bcp-framework build
+npm exec -- bcp-framework package
 ```
 
 You can also execute the Windows command shim explicitly:
@@ -115,9 +145,9 @@ npm exec -- bcp-framework inspect --json
 
 Doctor checks common project/runtime problems while Inspect shows the resolved configuration, routes, dependencies and project metadata BCP sees.
 
-## Production
+## Production build
 
-Create the standalone production build:
+Create the raw standalone production build:
 
 ```bash
 npm run build
@@ -130,3 +160,31 @@ npm start
 ```
 
 The production build is written to `.bcp-framework/build` and runs as a standalone Node.js server.
+
+## Deployment package — BCP 0.2.4+
+
+Create a fresh production build and deployment-oriented package:
+
+```bash
+npm run package
+```
+
+The output is written to:
+
+```text
+.bcp-framework/package/
+```
+
+It contains the standalone client/server output, a production-only dependency manifest, deployment/environment metadata, file integrity hashes and a starter Dockerfile.
+
+BCP intentionally excludes project `.env` files and application `devDependencies` from the deployment package. Provide secrets through your deployment environment.
+
+For a package with a generated production lockfile:
+
+```bash
+cd .bcp-framework/package
+npm ci --omit=dev
+npm start
+```
+
+If `bcp.package.json` reports that no lockfile was included, use the install command recorded in that manifest instead.