create-meridian-app 2.5.0 → 2.7.0

package/dist/{chunk-SO3S6MDJ.js → chunk-AR3BATX7.js}

@@ -7,6 +7,17 @@ import prompts from "prompts";
 import { execa as execa2 } from "execa";
 
 // src/templates/index.ts
+import { createRequire } from "module";
+function meridianDepRange() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const version = require2("../../package.json").version;
+    return `^${version}`;
+  } catch {
+    return "^2.6.0";
+  }
+}
+var MERIDIAN_DEP = meridianDepRange();
 function renderPackageJson(vars) {
   return JSON.stringify(
     {
@@ -24,20 +35,21 @@ function renderPackageJson(vars) {
         ...vars.seedDemo ? { "seed:demo": "node --import tsx/esm src/scripts/seed-demo.ts" } : {}
       },
       dependencies: {
-        "@meridianjs/meridian": "latest",
-        "@meridianjs/framework": "latest",
-        "@meridianjs/framework-utils": "latest",
-        "@meridianjs/types": "latest",
-        "@meridianjs/auth": "latest",
-        "@meridianjs/event-bus-local": "latest",
+        "@meridianjs/meridian": MERIDIAN_DEP,
+        "@meridianjs/framework": MERIDIAN_DEP,
+        "@meridianjs/framework-utils": MERIDIAN_DEP,
+        "@meridianjs/types": MERIDIAN_DEP,
+        "@meridianjs/auth": MERIDIAN_DEP,
+        "@meridianjs/event-bus-local": MERIDIAN_DEP,
+        "@meridianjs/plugin-mcp": MERIDIAN_DEP,
         "dotenv": "^16.0.0",
-        ...vars.dashboard ? { "@meridianjs/admin-dashboard": "latest" } : {},
+        ...vars.dashboard ? { "@meridianjs/admin-dashboard": MERIDIAN_DEP } : {},
         ...Object.fromEntries(
-          vars.optionalModules.map((id) => [`@meridianjs/${id}`, "latest"])
+          vars.optionalModules.map((id) => [`@meridianjs/${id}`, MERIDIAN_DEP])
         )
       },
       devDependencies: {
-        "create-meridian-app": "latest",
+        "create-meridian-app": MERIDIAN_DEP,
         typescript: "^5.4.0",
         tsx: "^4.0.0",
         "@types/node": "^22.0.0",
@@ -149,6 +161,9 @@ ${optBlocks}` : ""}
   ],
   plugins: [
     { resolve: "@meridianjs/meridian" },
+    // MCP server at /mcp \u2014 connect Claude, Cursor, and other LLM clients
+    // using personal access tokens (created at /admin/api-tokens)
+    { resolve: "@meridianjs/plugin-mcp" },
   ],
 })
 `;
@@ -186,11 +201,25 @@ process.on("SIGINT", async () => {
 `;
 }
 function renderMiddlewares() {
-  return `import { authenticateJWT } from "@meridianjs/auth"
-
+  return `import { authenticate } from "@meridianjs/auth"
+import { authRateLimit, oauthRateLimit, apiRateLimit } from "@meridianjs/framework"
+
+/**
+ * Route-level middleware configuration.
+ *
+ * /auth/login, /auth/register \u2014 strict rate limit (brute-force protection)
+ * /auth/google                \u2014 looser limit (a full OAuth flow = 3 requests)
+ * /admin/*                    \u2014 rate-limited + JWT or personal access token required
+ */
 export default {
   routes: [
-    { matcher: "/admin", middlewares: [authenticateJWT] },
+    { matcher: "/auth/login",           middlewares: [authRateLimit] },
+    { matcher: "/auth/register",        middlewares: [authRateLimit] },
+    { matcher: "/auth/forgot-password", middlewares: [authRateLimit] },
+    { matcher: "/auth/reset-password",  middlewares: [authRateLimit] },
+    { matcher: "/auth/google",          middlewares: [oauthRateLimit] },
+    { matcher: "/auth/invite",          middlewares: [authRateLimit] },
+    { matcher: "/admin", middlewares: [apiRateLimit, authenticate] },
   ],
 }
 `;

package/dist/cli.js

@@ -14,7 +14,7 @@ import {
   toKebabCase,
   toPascalCase,
   writeFile
-} from "./chunk-SO3S6MDJ.js";
+} from "./chunk-AR3BATX7.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -50,38 +50,23 @@ var MIME_TYPES = {
   ".woff2": "font/woff2"
 };
 function makeReactWindowPlugin() {
+  const globalFor = {
+    "react": "window.__React",
+    "react/jsx-runtime": "window.__ReactJsxRuntime",
+    "react/jsx-dev-runtime": "window.__ReactJsxRuntime",
+    "react-dom": "window.__ReactDOM",
+    "react-dom/client": "window.__ReactDOMClient"
+  };
   return {
     name: "react-window",
     setup(build2) {
-      build2.onResolve({ filter: /^react(\/.*)?$/ }, (args) => ({
+      build2.onResolve({ filter: /^react(-dom)?(\/.*)?$/ }, (args) => ({
         path: args.path,
         namespace: "react-window"
       }));
       build2.onLoad({ filter: /.*/, namespace: "react-window" }, (args) => {
-        if (args.path === "react/jsx-runtime") {
-          return {
-            contents: `
-              const { jsx, jsxs, Fragment } = window.__ReactJsxRuntime;
-              export { jsx, jsxs, Fragment };
-            `,
-            loader: "js"
-          };
-        }
-        return {
-          contents: `
-            const R = window.__React;
-            export default R;
-            export const {
-              createElement, createContext, cloneElement, isValidElement,
-              useState, useEffect, useContext, useReducer, useCallback, useMemo,
-              useRef, useImperativeHandle, useLayoutEffect, useDebugValue, useId,
-              useDeferredValue, useTransition, startTransition,
-              memo, forwardRef, lazy, Suspense, StrictMode, Fragment,
-              Component, PureComponent, Children, createRef,
-            } = R;
-          `,
-          loader: "js"
-        };
+        const target = globalFor[args.path] ?? "window.__React";
+        return { contents: `module.exports = ${target};`, loader: "js" };
       });
     }
   };
@@ -89,7 +74,8 @@ function makeReactWindowPlugin() {
 async function buildAdminExtensions(rootDir) {
   const entryPoint = path.join(rootDir, "src", "admin", "widgets", "index.tsx");
   if (!existsSync(entryPoint)) return null;
-  const outfile = path.join(os.tmpdir(), `meridian-ext-${Date.now()}.js`);
+  const outDir = fs.mkdtempSync(path.join(os.tmpdir(), "meridian-ext-"));
+  const outfile = path.join(outDir, "bundle.js");
   try {
     await esbuild.build({
       entryPoints: [entryPoint],
@@ -100,12 +86,9 @@ async function buildAdminExtensions(rootDir) {
       plugins: [makeReactWindowPlugin()],
       logLevel: "silent"
     });
-    const buf = fs.readFileSync(outfile);
-    fs.unlinkSync(outfile);
-    return buf;
-  } catch (err) {
-    if (existsSync(outfile)) fs.unlinkSync(outfile);
-    throw err;
+    return fs.readFileSync(outfile);
+  } finally {
+    fs.rmSync(outDir, { recursive: true, force: true });
   }
 }
 function startDashboardServer(distDir, port, apiPort, apiHost = "localhost", adminExtensionsBuf = null, apiUrlOverride, branding, projectDir) {
@@ -285,7 +268,14 @@ async function runDev() {
     {
       cwd: rootDir,
       stdio: "inherit",
-      env: { ...process.env, NODE_ENV: process.env.NODE_ENV ?? "development", FORCE_COLOR: "1" }
+      env: {
+        ...process.env,
+        NODE_ENV: process.env.NODE_ENV ?? "development",
+        // Auto-sync schema in dev (additive/safe). Production must use
+        // migrations — sync is off unless MERIDIAN_DB_SYNC is set.
+        MERIDIAN_DB_SYNC: process.env.MERIDIAN_DB_SYNC ?? "1",
+        FORCE_COLOR: "1"
+      }
     }
   );
   const shutdown = (signal) => {
@@ -296,8 +286,8 @@ async function runDev() {
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   await apiProc.catch((err) => {
+    dashServer?.close();
     if (err.signal === "SIGINT" || err.signal === "SIGTERM") {
-      dashServer?.close();
       process.exit(0);
     }
     throw err;
@@ -386,7 +376,7 @@ async function runBuild() {
     console.error(chalk4.red("  \u2716 Could not find meridian.config.ts. Are you inside a Meridian project?"));
     process.exit(1);
   }
-  console.log(chalk4.dim("  \u2192 Type-checking project..."));
+  console.log(chalk4.dim("  \u2192 Validating project (type-check; Meridian runs .ts directly via tsx)..."));
   console.log();
   const result = await execa3("npx", ["tsc", "--noEmit"], {
     cwd: rootDir,
@@ -398,7 +388,7 @@ async function runBuild() {
     process.exit(result.exitCode ?? 1);
   }
   console.log();
-  console.log(chalk4.green("  \u2713 Type check passed"));
+  console.log(chalk4.green("  \u2713 Type check passed \u2014 project is ready to run with `meridian start`"));
 }
 
 // src/commands/db-migrate.ts

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runNew
-} from "./chunk-SO3S6MDJ.js";
+} from "./chunk-AR3BATX7.js";
 
 // src/index.ts
 var projectName = process.argv[2];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meridian-app",
-  "version": "2.5.0",
+  "version": "2.7.0",
   "description": "Create a new Meridian project or manage an existing one",
   "main": "./dist/index.js",
   "type": "module",