create-bcp-app 0.2.8 → 0.2.10

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.8",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.10",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.8"
+    "version": "0.2.10"
   },
   "packageManager": "npm",
   "presets": {
@@ -107,9 +107,7 @@ Example:
 }
 ```
 
-This manifest records scaffold identity only. It is intended for framework diagnostics, update/migration tooling and project-aware documentation. It must not contain secrets.
-
-The file should normally be committed to source control.
+This manifest records scaffold identity only. It must not contain secrets and should normally be committed to source control.
 
 ## Generated application defaults
 
@@ -133,14 +131,7 @@ npm exec -- bcp-framework update --check
 
 ## Tailwind CSS
 
-When Tailwind is enabled, the project includes:
-
-- `tailwindcss`
-- `@tailwindcss/cli`
-- `concurrently`
-- `app/globals.css`
-- `/bcp.css` stylesheet setup
-- starter utility classes
+When Tailwind is enabled, the project includes `tailwindcss`, `@tailwindcss/cli`, `concurrently`, `app/globals.css`, `/bcp.css` stylesheet setup and starter utility classes.
 
 Generated commands include:
 
@@ -162,235 +153,195 @@ The database choice adds starter configuration and the matching driver:
 - MongoDB: `mongodb`
 - None: no database dependency
 
-For **MySQL**, **PostgreSQL** and **SQLite**, generated `lib/database.ts` exposes the framework database primitives through `bcp/database`. Provider connections are managed behind Database Platform v2 instead of being created directly in generated application code.
-
-Generated MySQL environment variables:
-
-```dotenv
-DB_HOST=localhost
-DB_PORT=3306
-DB_USER=
-DB_PASSWORD=
-DB_NAME=bcp_app
-```
-
-Generated PostgreSQL environment variable:
-
-```dotenv
-DATABASE_URL=postgresql://postgres:password@localhost:5432/bcp_app
-```
-
-Generated SQLite environment variable:
-
-```dotenv
-DATABASE_URL=./data/bcp.sqlite
-```
-
-`bcp/database` infers PostgreSQL from `postgres://` or `postgresql://` connection URLs. SQLite is inferred from `:memory:`, `sqlite:` / `file:` locations and common `.sqlite`, `.sqlite3` or `.db` file paths. Applications may also configure `DB_DRIVER` explicitly.
-
-Placeholder syntax follows the selected provider:
-
-```text
-MySQL       ?
-SQLite      ?
-PostgreSQL  $1, $2, ...
-```
+For **MySQL**, **PostgreSQL** and **SQLite**, generated `lib/database.ts` exposes framework database primitives through `bcp/database`.
 
 The generator intentionally does not force an ORM.
 
 ## Storage providers
 
-Selecting a storage provider creates `lib/storage.ts` and adds provider-specific environment settings.
+Selecting a storage provider creates `lib/storage.ts` and provider-specific environment settings. Supported presets are Local Server, Amazon S3 and Cloudflare R2.
 
-### Local Server
+Storage credentials are server-only. Do not expose them through `BCP_PUBLIC_*` variables.
 
-```bash
-npx create-bcp-app my-app --storage local
-```
+## JWT Cookie authentication
 
-Environment:
+Selecting `JWT Cookie` creates `lib/auth.ts` and starter `/api/auth/login`, `/logout` and `/me` routes, and adds:
 
 ```dotenv
-STORAGE_LOCAL_DIRECTORY=./storage
+BCP_SESSION_SECRET=
 ```
 
-The generated helper uses `createLocalStorage()`.
-
-### Amazon S3
-
-```bash
-npx create-bcp-app my-app --storage amazon-s3
-```
+Set this to a cryptographically random secret of at least 32 bytes before real authentication use.
 
-Generated environment settings:
+BCP `0.2.5+` can opt into revocable server-side auth state through `AuthSessionStore`.
 
-```dotenv
-AWS_S3_BUCKET=
-AWS_REGION=ap-southeast-1
-AWS_ACCESS_KEY_ID=
-AWS_SECRET_ACCESS_KEY=
-AWS_SESSION_TOKEN=
-AWS_S3_PREFIX=
-```
+## Authorization & request security — 0.2.6+
 
-The helper uses `createS3Storage()`. Explicit credentials can remain unset when deployment uses the AWS SDK server-side credential chain, such as an IAM role.
+Generated applications can use permission guards and resource policies from `bcp/auth`, plus same-origin and CSRF protection from `bcp/server`.
 
-### Cloudflare R2
+Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
 
-```bash
-npx create-bcp-app my-app --storage cloudflare-r2
-```
+## Observability — 0.2.7+
 
-Generated environment settings:
+Generated projects can opt into process-local metrics and health/readiness without adding another dependency:
 
-```dotenv
-R2_ACCOUNT_ID=
-R2_BUCKET=
-R2_ACCESS_KEY_ID=
-R2_SECRET_ACCESS_KEY=
-R2_PREFIX=
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
 ```
 
-Storage credentials are server-only. Do not expose them through `BCP_PUBLIC_*` variables.
-
-## JWT Cookie authentication
-
-Selecting `JWT Cookie` creates:
+`bcp/observability` is server-only. Protect metrics and operational health detail with an appropriate network or authorization boundary when needed.
 
-```text
-lib/
-└─ auth.ts
+## Background jobs — 0.2.8+
 
-app/api/auth/
-├─ login/route.ts
-├─ logout/route.ts
-└─ me/route.ts
-```
+Generated projects can create a server-only background job queue:
 
-and adds:
+```ts
+import {
+    createJobQueue,
+} from "bcp/jobs";
 
-```dotenv
-BCP_SESSION_SECRET=
+export const jobs =
+    createJobQueue();
 ```
 
-Set this to a cryptographically random secret of at least 32 bytes before real authentication use.
-
-The generated `authenticateCredentials(email, password)` returns `null` until the application connects it to its own user store and password-hash verification.
+Workers support concurrency, delayed jobs, retry/backoff and cancellation.
 
-Generated auth stays in backward-compatible stateless JWT-cookie mode by default.
+## Job scheduling — 0.2.9+
 
-BCP `0.2.5+` can opt into revocable server-side auth state without changing the generated auth route structure:
+Recurring schedules use the same `bcp/jobs` entrypoint:
 
 ```ts
 import {
-    createAuth,
-    createMemoryAuthSessionStore,
-} from "bcp/auth";
-
-const sessionStore =
-    createMemoryAuthSessionStore();
+    createJobScheduler,
+} from "bcp/jobs";
 
-const frameworkAuth =
-    createAuth<AuthenticatedUser>({
-        store: sessionStore,
-        idleTimeout: 60 * 30,
+export const scheduler =
+    createJobScheduler({
+        queue: jobs,
     });
 ```
 
-The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
-
-## Authorization & request security — 0.2.6+
-
-Generated applications can add permissions to their application user shape and use server-side permission guards without changing the auth preset routes:
+Interval schedule:
 
 ```ts
-import {
-    createPermissionGuard,
-    hasPermission,
-} from "bcp/auth";
+await scheduler.schedule(
+    "cache.cleanup",
+    {},
+    {
+        everyMs: 300_000,
+    }
+);
 ```
 
-For resource-specific decisions, use `defineAuthorizationPolicy()`, `can()` or `authorize()`.
-
-Cookie-authenticated mutation routes can opt into same-origin and CSRF protection through `bcp/server`:
+UTC cron schedule:
 
 ```ts
-import {
-    createCsrfToken,
-    requireCsrfRequest,
-    requireSameOriginRequest,
-} from "bcp/server";
+await scheduler.schedule(
+    "report.weekday",
+    {},
+    {
+        cron: "30 9 * * 1-5",
+    }
+);
 ```
 
-`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`, so the generated JWT auth preset does not require another environment variable to get started. Production applications may define a separate `BCP_CSRF_SECRET` for independent key rotation.
-
-Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
-
-## Observability — 0.2.7+
+## Durable jobs — 0.2.10+
 
-Generated projects can opt into process-local metrics and health/readiness without adding another dependency:
+BCP `0.2.10` adds worker visibility leases, heartbeat renewal, stale-running recovery, DLQ/requeue, retention cleanup and queue statistics.
 
 ```ts
-import {
-    createHealthRegistry,
-    createMetricsRegistry,
-    createRequestMetricsMiddleware,
-} from "bcp/observability";
-
-export const metrics =
-    createMetricsRegistry();
+const worker =
+    jobs.startWorker({
+        workerId: "worker-a",
+        concurrency: 4,
+        visibilityTimeoutMs: 30_000,
+        heartbeatIntervalMs: 10_000,
+    });
+```
 
-export const health =
-    createHealthRegistry();
+Inspect failed jobs:
 
-export const requestMetrics =
-    createRequestMetricsMiddleware(
-        metrics
-    );
+```ts
+const deadLetters =
+    await jobs.deadLetters();
 ```
 
-Expose metrics from an application API route with `createMetricsResponse(metrics)`. The response uses Prometheus-compatible text format.
+Requeue:
 
-Health endpoints can return `health.response()`, which uses HTTP `200` when all checks pass and `503` when any dependency check fails or times out.
+```ts
+await jobs.requeueDeadLetter(
+    deadLetters[0].id,
+    {
+        resetAttempts: true,
+    }
+);
+```
 
-The default HTTP request metrics use `method` and `status` labels only. Raw paths are intentionally excluded to avoid high-cardinality metric series.
+### Redis-compatible durable adapters
 
-`bcp/observability` is server-only. Protect metrics and operational health detail with an appropriate network or authorization boundary when needed.
+BCP intentionally does not install a Redis client library. Applications own the Redis connection and pass a minimal command client to BCP:
 
-## Background jobs — 0.2.8+
+```ts
+interface RedisCommandClient {
+    sendCommand(
+        command: string[]
+    ): Promise<unknown>;
+}
+```
 
-Generated projects can create a server-only background job queue without adding another package:
+Queue adapter:
 
 ```ts
 import {
     createJobQueue,
+    createRedisJobQueueAdapter,
 } from "bcp/jobs";
 
+const adapter =
+    createRedisJobQueueAdapter({
+        client: redisCommandClient,
+        namespace: "my-app:{jobs}",
+    });
+
 export const jobs =
-    createJobQueue();
+    createJobQueue({
+        adapter,
+    });
 ```
 
-Register handlers and enqueue work:
+Scheduler store:
 
 ```ts
-jobs.register(
-    "email.welcome",
-    async ({ payload }) => {
-        await sendWelcomeEmail(
-            payload.userId
-        );
-    }
-);
+import {
+    createJobScheduler,
+    createRedisJobScheduleStore,
+} from "bcp/jobs";
 
-await jobs.enqueue(
-    "email.welcome",
-    {
-        userId: 42,
-    }
-);
+const store =
+    createRedisJobScheduleStore({
+        client: redisCommandClient,
+        namespace: "my-app:{jobs}",
+    });
+
+export const scheduler =
+    createJobScheduler({
+        queue: jobs,
+        store,
+        ownerId: "scheduler-a",
+    });
 ```
 
-Workers support concurrency, delayed jobs, retry/backoff and cancellation. The default memory adapter is process-local and should be replaced with a durable `JobQueueAdapter` for multi-process/container production workloads that must survive restarts.
+A typical application may configure its Redis client with:
+
+```dotenv
+REDIS_URL=redis://localhost:6379
+```
+
+BCP does not read `REDIS_URL` automatically. Redis credentials, TLS/Cluster/Sentinel configuration and connection lifecycle stay application-owned.
 
 `bcp/jobs` is server-only and must not be imported into page/client bundles.
 
@@ -402,32 +353,8 @@ Generated projects include:
 npm run package
 ```
 
-This runs the BCP `standalone-node` application packaging flow and writes:
-
-```text
-.bcp-framework/package/
-├─ client/
-├─ server/
-├─ public/                 # when present
-├─ package.json
-├─ package-lock.json       # when a safe production lock can be derived
-├─ bcp.package.json
-├─ bcp.deployment.json
-├─ bcp.env.json
-├─ Dockerfile
-└─ README.md
-```
-
 The deployment package excludes application `devDependencies` and project `.env` values. Supply real secrets through the deployment environment.
 
-For a package with a generated production lockfile:
-
-```bash
-cd .bcp-framework/package
-npm ci --omit=dev
-npm start
-```
-
 ## Project generators after creation
 
 ```bash
@@ -455,25 +382,13 @@ bcp generate migration create_users
 --database <database>     none | mysql | postgresql | sqlite | mongodb
 --auth <preset>           none | jwt-cookie
 --storage <provider>      none | local | amazon-s3 | cloudflare-r2
--y, --yes                 Accept defaults (Tailwind enabled, no database, no auth, no storage)
+-y, --yes                 Accept defaults
 --bcp <specifier>         Override dependencies.bcp
 -h, --help                Show help
 ```
 
-Examples:
-
-```bash
-npx create-bcp-app my-app --tailwind --database mysql --auth jwt-cookie --storage local
-npx create-bcp-app my-app --database postgresql
-npx create-bcp-app my-app --database sqlite
-npx create-bcp-app my-app --storage amazon-s3
-npx create-bcp-app my-app --storage cloudflare-r2
-npx create-bcp-app my-app --no-tailwind --database mongodb
-npx create-bcp-app my-app --yes
-```
-
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.8.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.10.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -25,17 +25,11 @@ npm start
 npm run update
 ```
 
-The generated scripts call commands such as `bcp dev`, `bcp generate`, `bcp build`, `bcp package` and `bcp start`. npm automatically adds the project's `node_modules/.bin` directory to `PATH` while an npm script is running.
+The generated scripts call commands such as `bcp dev`, `bcp generate`, `bcp build`, `bcp package` and `bcp start`.
 
 ## Project metadata
 
-Projects created with BCP `0.1.29+` include:
-
-```text
-bcp.project.json
-```
-
-It records non-secret scaffold choices such as Tailwind, database, authentication and storage presets so BCP diagnostics/tooling can understand the project without guessing configuration from source files.
+Projects created with BCP `0.1.29+` include `bcp.project.json` with non-secret scaffold metadata.
 
 Commit this file with the project. Do not put passwords, access keys, session secrets or tokens in it.
 
@@ -43,131 +37,187 @@ Commit this file with the project. Do not put passwords, access keys, session se
 
 Projects created with the `JWT Cookie` preset remain stateless by default and use the generated `lib/auth.ts` helpers.
 
-BCP Authentication Platform v2 can opt into revocable server-side session state:
+BCP Authentication Platform v2 can opt into revocable server-side session state with `createAuth()` and `AuthSessionStore`.
 
-```ts
-import {
-    createAuth,
-    createMemoryAuthSessionStore,
-} from "bcp/auth";
+## Authorization & request security — BCP 0.2.6+
 
-const sessionStore =
-    createMemoryAuthSessionStore();
+Use permission guards and resource policies from `bcp/auth`, and same-origin/CSRF protection from `bcp/server`.
 
-export const appAuth =
-    createAuth({
-        store: sessionStore,
-        idleTimeout: 60 * 30,
-    });
+Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
+
+## Observability — BCP 0.2.7+
+
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
 ```
 
-The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
+Protect operational endpoints when their contents should not be public.
 
-## Authorization & request security — BCP 0.2.6+
+## Background jobs — BCP 0.2.8+
 
-Server-side permission guards:
+Create a server-only background queue:
 
 ```ts
 import {
-    createPermissionGuard,
-} from "bcp/auth";
+    createJobQueue,
+} from "bcp/jobs";
 
-export const guard =
-    createPermissionGuard(
-        "dashboard.read"
-    );
+export const jobs =
+    createJobQueue();
 ```
 
-For ownership or resource-specific rules, use `defineAuthorizationPolicy()`, `can()` and `authorize()` from `bcp/auth`.
+Register typed work:
+
+```ts
+jobs.register<{
+    userId: number;
+}>(
+    "email.welcome",
+    async ({ payload }) => {
+        await sendWelcomeEmail(
+            payload.userId
+        );
+    }
+);
+```
 
-Cookie-authenticated mutation routes can validate browser origin and CSRF state:
+## Job scheduling — BCP 0.2.9+
 
 ```ts
 import {
-    createCsrfToken,
-    requireCsrfRequest,
-    requireSameOriginRequest,
-} from "bcp/server";
+    createJobScheduler,
+} from "bcp/jobs";
+
+export const scheduler =
+    createJobScheduler({
+        queue: jobs,
+    });
 ```
 
-`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`.
+Example UTC cron schedule:
 
-Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
+```ts
+await scheduler.schedule(
+    "report.weekday",
+    {},
+    {
+        cron: "30 9 * * 1-5",
+    }
+);
+```
 
-## Observability — BCP 0.2.7+
+## Durable jobs — BCP 0.2.10+
 
-Create process-local metrics and health/readiness registries:
+Workers can use visibility leases, heartbeat renewal and stale-running recovery:
 
 ```ts
-import {
-    createHealthRegistry,
-    createMetricsRegistry,
-    createRequestMetricsMiddleware,
-} from "bcp/observability";
+const worker =
+    jobs.startWorker({
+        workerId: "worker-a",
+        concurrency: 4,
+        visibilityTimeoutMs: 30_000,
+        heartbeatIntervalMs: 10_000,
+    });
+```
 
-export const metrics =
-    createMetricsRegistry();
+Retry-exhausted jobs are available through the adapter DLQ contract:
 
-export const health =
-    createHealthRegistry();
+```ts
+const deadLetters =
+    await jobs.deadLetters();
 
-export const requestMetrics =
-    createRequestMetricsMiddleware(
-        metrics
-    );
+await jobs.requeueDeadLetter(
+    deadLetters[0].id,
+    {
+        resetAttempts: true,
+    }
+);
 ```
 
-Expose Prometheus-compatible metrics with `createMetricsResponse(metrics)` from a server API route.
+Operational helpers:
 
-Use `health.response()` for readiness endpoints. It returns HTTP `200` when all checks pass and `503` when a check fails or times out.
+```ts
+await jobs.recoverStale();
+const stats = await jobs.stats();
+await jobs.cleanup({
+    before:
+        Date.now() -
+        7 * 24 * 60 * 60 * 1000,
+});
+```
 
-The default request metrics use bounded `method` and `status` labels and do not include raw paths.
+### Redis-compatible adapters
 
-Protect operational endpoints when their contents should not be public.
+BCP does not install a Redis library. Supply an application-owned command client:
 
-## Background jobs — BCP 0.2.8+
+```ts
+interface RedisCommandClient {
+    sendCommand(
+        command: string[]
+    ): Promise<unknown>;
+}
+```
 
-Create a server-only background queue:
+Create a durable queue:
 
 ```ts
 import {
     createJobQueue,
+    createRedisJobQueueAdapter,
 } from "bcp/jobs";
 
+const adapter =
+    createRedisJobQueueAdapter({
+        client: redisCommandClient,
+        namespace: "my-app:{jobs}",
+    });
+
 export const jobs =
-    createJobQueue();
+    createJobQueue({
+        adapter,
+    });
 ```
 
-Register and enqueue work:
+Create a shared schedule store:
 
 ```ts
-jobs.register(
-    "email.welcome",
-    async ({ payload }) => {
-        await sendWelcomeEmail(
-            payload.userId
-        );
-    }
-);
+import {
+    createJobScheduler,
+    createRedisJobScheduleStore,
+} from "bcp/jobs";
 
-await jobs.enqueue(
-    "email.welcome",
-    {
-        userId: 42,
-    }
-);
+const store =
+    createRedisJobScheduleStore({
+        client: redisCommandClient,
+        namespace: "my-app:{jobs}",
+    });
+
+export const scheduler =
+    createJobScheduler({
+        queue: jobs,
+        store,
+        ownerId: "scheduler-a",
+    });
+```
+
+A typical deployment may use:
+
+```dotenv
+REDIS_URL=redis://localhost:6379
 ```
 
-Workers support delayed jobs, retry/backoff, cancellation and configurable concurrency.
+BCP does not read this variable automatically. The application owns Redis connection creation, credentials, TLS/Cluster configuration and shutdown.
 
-The default memory adapter is process-local and not durable. For production jobs that must survive restarts or run across multiple processes/containers, implement `JobQueueAdapter` with shared durable infrastructure.
+The processing model is at-least-once, so side-effecting job handlers should be idempotent when duplicate execution is unsafe.
 
 `bcp/jobs` is server-only and cannot be imported into page/client bundles.
 
 ## Generate framework files
 
-BCP can generate common project files:
-
 ```bash
 npm run generate -- page dashboard/users
 npm run generate -- api users
@@ -175,7 +225,7 @@ npm run generate -- middleware
 npm run generate -- migration create_users
 ```
 
-Equivalent direct BCP CLI commands are:
+Equivalent direct commands:
 
 ```bash
 bcp generate page dashboard/users
@@ -186,102 +236,37 @@ bcp generate migration create_users
 
 Existing page/API/middleware targets are not replaced unless `--force` is supplied explicitly.
 
-After generating routes, inspect them with:
-
-```bash
-npm run routes
-```
-
 ## Direct CLI usage
 
-BCP Framework is installed as a project-local dependency. It is not installed globally by `create-bcp-app`.
+BCP Framework is installed as a project-local dependency.
 
-PowerShell does not automatically add `node_modules/.bin` to its normal command search path, so use `npm exec` for direct commands:
+For PowerShell direct usage:
 
 ```powershell
 npm exec -- bcp-framework --version
 npm exec -- bcp-framework doctor
 npm exec -- bcp-framework inspect
-npm exec -- bcp-framework generate page dashboard/users
 npm exec -- bcp-framework routes
 npm exec -- bcp-framework dev
 npm exec -- bcp-framework build
 npm exec -- bcp-framework package
 ```
 
-You can also execute the Windows command shim explicitly:
-
-```powershell
-.\node_modules\.bin\bcp-framework.cmd --version
-```
-
 Microsoft SQL Server can install another Windows executable named `bcp.exe`, so the `bcp-framework` alias avoids that command-name collision.
 
-Use this convention:
-
-```text
-Inside npm scripts      -> bcp ...
-Direct PowerShell usage -> npm exec -- bcp-framework ...
-```
-
-## Project diagnostics
-
-Run:
-
-```powershell
-npm exec -- bcp-framework doctor
-npm exec -- bcp-framework inspect
-```
-
-Machine-readable reports:
-
-```powershell
-npm exec -- bcp-framework doctor --json
-npm exec -- bcp-framework inspect --json
-```
-
-Doctor checks common project/runtime problems while Inspect shows the resolved configuration, routes, dependencies and project metadata BCP sees.
-
 ## Production build
 
-Create the raw standalone production build:
-
 ```bash
 npm run build
-```
-
-Start it with:
-
-```bash
 npm start
 ```
 
-The production build is written to `.bcp-framework/build` and runs as a standalone Node.js server.
-
 ## Deployment package — BCP 0.2.4+
 
-Create a fresh production build and deployment-oriented package:
-
 ```bash
 npm run package
 ```
 
-The output is written to:
-
-```text
-.bcp-framework/package/
-```
-
-It contains the standalone client/server output, a production-only dependency manifest, deployment/environment metadata, file integrity hashes and a starter Dockerfile.
+The output is written to `.bcp-framework/package/` and contains standalone output, production dependency metadata, deployment/environment manifests, integrity hashes and a starter Dockerfile.
 
 BCP intentionally excludes project `.env` files and application `devDependencies` from the deployment package. Provide secrets through your deployment environment.
-
-For a package with a generated production lockfile:
-
-```bash
-cd .bcp-framework/package
-npm ci --omit=dev
-npm start
-```
-
-If `bcp.package.json` reports that no lockfile was included, use the install command recorded in that manifest instead.